zachbg/docker-socket-proxy repository overview

⁠Docker Socket Proxy

A lightweight, security-focused proxy for the Docker socket. Restrict which Docker API endpoints are accessible to containers, preventing unauthorized access.

⁠Why?

Mounting /var/run/docker.sock into containers (for Traefik, Portainer, etc.) gives full Docker API access — equivalent to root on the host. This proxy sits between containers and the Docker socket, only allowing whitelisted endpoints.

⁠Quick Start

services:
  socket-proxy:
    image: zachbg/docker-socket-proxy:latest
    restart: unless-stopped
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    environment:
      CONTAINERS: 1
      NETWORKS: 1
    ports:
      - "127.0.0.1:2375:2375"

  traefik:
    image: traefik:v3
    depends_on:
      - socket-proxy
    environment:
      DOCKER_HOST: tcp://socket-proxy:2375
    # No docker.sock mount needed!

⁠Environment Variables

⁠Endpoint Controls (set to 1 to allow)

⁠Method Controls

⁠General

⁠Use Cases

⁠Traefik (read-only container discovery)

environment:
  CONTAINERS: 1
  NETWORKS: 1

⁠Portainer (full management)

environment:
  CONTAINERS: 1
  IMAGES: 1
  NETWORKS: 1
  VOLUMES: 1
  EVENTS: 1
  SYSTEM: 1
  INFO: 1
  VERSION: 1
  POST: 1
  DELETE: 1

⁠Monitoring only

environment:
  CONTAINERS: 1
  INFO: 1
  VERSION: 1
  EVENTS: 1
  PING: 1

⁠Security

• Read-only socket mount: Always mount with :ro
• No network exposure: Bind to 127.0.0.1 or use Docker networks only
• Deny by default: All endpoints blocked unless explicitly enabled
• Static binary: Minimal attack surface, no shell
• Non-root: Runs as UID 65534