Sign inSign up

cerede2000/docker-socket-proxy

By cerede2000

•Updated about 1 month ago

Secure Docker socket proxy with per-client profiles and fine-grained container access control.

Image
Security
0

1.2K

cerede2000/docker-socket-proxy repository overview

⁠docker-socket-proxy

A minimal, security-focused HTTP proxy in front of the Docker socket.

Instead of mounting /var/run/docker.sock directly into an application, assign each client container a profile with the Docker API permissions it actually needs. Access is denied by default.

⁠Highlights

  • Per-client profiles discovered from the socketproxy.role label
  • Explicit Docker API permissions: containers, images, networks, events, volumes, exec, and more
  • Per-container scope: all, allowlist, or blacklist
  • Per-container exceptions: deny or readonly
  • Read-only targets support inspect, logs, stats, top, and changes, while mutations remain blocked
  • Container name / ID cache for fast authorization checks
  • Multi-architecture image: linux/amd64 and linux/arm64
  • Runs as non-root in a Distroless Debian 13 image

⁠Pull

docker pull cerede2000/docker-socket-proxy:latest

⁠Quick start

services:
  docker-socket-proxy:
    image: cerede2000/docker-socket-proxy:latest
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./profiles.yml:/config/profiles.yml:ro
    networks:
      - socketproxy

networks:
  socketproxy:
    internal: true

⁠Client labels

Associate a client with a profile using socketproxy.role (or the socketproxy.service alias):

labels:
  socketproxy.role: traefik-manager

⁠Example: Traefik and Traefik Manager

Traefik gets only the read access required by its Docker provider. Traefik Manager can inspect and restart only the traefik container.

services:
  docker-socket-proxy:
    image: cerede2000/docker-socket-proxy:latest
    container_name: docker-socket-proxy
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./profiles.yml:/config/profiles.yml:ro
    networks: [socketproxy]
    restart: unless-stopped

  traefik:
    image: traefik:v3
    container_name: traefik
    command:
      - --providers.docker=true
      - --providers.docker.endpoint=tcp://docker-socket-proxy:2375
      - --providers.docker.exposedbydefault=false
    labels:
      socketproxy.role: traefik
    networks: [socketproxy, frontend]
    restart: unless-stopped

  traefik-manager:
    image: ghcr.io/chr0nzz/traefik-manager:latest
    container_name: traefik-manager
    environment:
      DOCKER_HOST: tcp://docker-socket-proxy:2375
      RESTART_METHOD: proxy
      TRAEFIK_CONTAINER: traefik
    labels:
      socketproxy.role: traefik-manager
    networks: [socketproxy, frontend]
    restart: unless-stopped

networks:
  socketproxy:
    internal: true
  frontend:
    external: true

traefik:
  ping: true
  version: true
  containers: true
  networks: true
  events: true
  session: true

traefik-manager:
  ping: true
  version: true
  containers: true
  post: true
  allow_restart: true
  container_scope: allowlist
  allowed_containers:
    - traefik

⁠Example: broad profile with protected targets

Dockhand can manage most containers, but never sees the socket proxy. It can inspect Dockman, read its logs and stats, but cannot restart it or open an exec session.

dockhand:
  ping: true
  version: true
  info: true
  events: true
  containers: true
  images: true
  networks: true
  volumes: true
  exec: true
  system: true
  post: true
  allow_start: true
  allow_stop: true
  allow_restart: true
  container_scope: blacklist
  blocked_containers:
    - docker-socket-proxy
  container_rules:
    - name: dockman
      access: readonly

⁠Example: deny a critical container

portainer:
  containers: true
  images: true
  networks: true
  post: true
  allow_start: true
  allow_stop: true
  allow_restart: true
  container_scope: all
  container_rules:
    - name: docker-socket-proxy
      access: deny

Full documentation, configuration reference, and additional examples: github.com/cerede2000/docker-socket-proxy⁠.

Tag summary

Content type

Image

Digest

sha256:4a5fb112b…

Size

4 MB

Last updated

about 1 month ago

docker pull cerede2000/docker-socket-proxy