Wasn’t sure if this was a Security topic or just a general software question, so if this should be moved, feel free.
Finally got some parts enough to warrant trying out Home Asst. Install on Proxmox went fine. While poking around however, I noticed, well, a lot of hardware inside of HA. Hardware that, as a VM, I certainly did not pass through or give any virtualized versions of…then it hit me, it’s the freaking host hardware. I fully admit I read the install for an operating system as a virtual machine as just that, a VM of an OS. After more poking it became obvious that it is less that and more docker.
What I have not been able to find anywhere is exactly what type of setup this is and specifically, is this a docker with root privilege on my hypervisor? The documents and forum posts I’ve been going through have been less than forthcoming. I do go to some lengths to make sure the IoT and cameras are all locked away in their own pocket dimension, virtual routing table and all and yet I now have the distinct impression the new head inmate has the keys to all of the cells and not just the ones inside the IoT wing. Can anyone provide some clarity on this topic? Just to be clear this is a totally fresh install, no plugins, add-ons, etc… as I know I saw a Proxmox plugin.
If you’re using the recommended installation you likely have HAOS for Home Assistant. Then yes, it is Docker. But a Docker installed and managed by HAOS itself. I strongly suggest you don’t mess with it just yet, and follow their recommended administration procedures.
There are 2 types of hardware inside of HA. If you have for example Zigbee as one of the communications protocols, you likely have plugged in a Zigbee stick into your physical Proxmox node. You will need to pass this through to HAOS to make it work.
Then there’s hardware in your home, things like smart bulbs, door sensors, temperature sensors, etc. Whatever you have installed. HAOS scans all networks it has access to, recognizes compatible hardware and offers to install them for you.
It also detects things like smart speakers, cameras, smart TVs etc. Again, if it has network access to them.
So it is up to you to give HAOS access through your network infrastructure and Proxmox to the VLANs that you want it to see.
In my experience, a virtual machine has no knowledge of the hypervisor’s storage layout. Nor of any of the rest of its hardware, outside of those things that are passed through or the virtual devices assigned to it. A docker does, one with root, certainly. Hence the question I asked, and that is still unanswered: does anyone know the extent and privileges of this docker install that is called a virtual machine, yet very obviously is not.
When I said there are no add-ons or plugins I meant none. As in no zwave JS no zigbeeMQTT, nothing. I can see the host’s hardware from inside of the HA install. Again, that, in my experience, is not normal for a virtual machine.
I have a HAOS install on a true VM inside Proxmox and haven’t detected anything unusual beyond what I mentioned earlier. It does not have any knowledge, and no way to gain such knowledge, of the actual hardware of the Proxmox node.
Did you create an actual VM inside Proxmox and install HAOS on that, or did you create a LXC container, or (hope not) installed HAOS on the same host as Proxmox instead of in a VM? In other words, did you manually or through a script, create an actual Virtual Machine on Proxmox before you installed HAOS, and have actually installed HAOS on the VM you created?
VM hardware abstration is enforced at hypervisor level. What you install inside a VM has no way to bypass the abstraction. It does not gain access to the host hardware unless you give it in some partial way.
Storage wise, HAOS creates it’s own storage layout on whatever raw storage disks Proxmox provides as part of the VM definition you have set.
Also any plugin you install in HAOS cannot bypass the Proxmox virtualization abstraction. It may make your HAOS install unstable, or less secure, but not escape the boundaries of the VM it is installed in.
Can you perhaps provide any screenshots or relevant detail what you mean by knowledge HAOS shouldn’t have but has in your case? If you are positive it is seeing your actual physical Proxmox node hardware such as disk arrays, RAM, motherboard, etc it means it was incorrectly installed onto the actual physical machine hosting Proxmox instead of in a VM defined in Proxmox.