← Directory

Docker Socket Proxy

A security proxy that sits between Docker containers and the Docker socket.

  • Network Services
  • Security
  • Tools & Utilities
A security proxy that sits between Docker containers and the Docker socket. It exposes only the specific Docker socket API endpoints each container is allowed to use, based on environment variables, instead of granting the container full root-equivalent control of the host daemon. It is built for homelab and server operators who must hand out socket access to monitoring, backup, or orchestration tools, and it is worth using to contain the security risk of exposing /var/run/docker.sock.

Platform availability

Available on 1 of 9 platforms

  • Unraid
  • TrueNAS (not listed)
  • Umbrel (not listed)
  • ZimaOS (not listed)
  • Proxmox (not listed)
  • Helm (not listed)
  • Mac (not listed)
  • Windows (not listed)
  • Linux (not listed)

Health score?A 0-100 score computed nightly from four factors: maintained (40%: recent commits and steady activity), popular (25%: GitHub stars, log scale), easy to install (20%: platforms, install notes, setup guides, Docker image) and light to run (15%: minimum RAM, ARM support). When the source code has been checked, a fifth factor, security check (20%: automated scan for committed secrets, unsafe desktop-app settings, known-vulnerable dependencies and project hygiene; any serious finding caps it at 20), is added. Factors without data are left out and the rest are rescaled.

54/100 Fair

Maintained
67last commit 80 days ago
Popular
692,815 GitHub stars
Easy to install
201 install platform, Docker image
Light to run
404 GB minimum RAM, runs on ARM

Availability: platform listings confirmed today, links checked 17 days ago

GitHub stars
2,815
Open issues
54
Last commit
2026-07-27
Latest release
v0.5.0
License
Apache-2.0
Activity
stale

Checked 8 days ago - source: GitHub (Tecnativa/docker-socket-proxy)

Resources & Compatibility

Minimum requirements: 4 GB RAM, 6 GB disk. ARM (e.g. Raspberry Pi) is supported.

Checked 17 days ago - source: Docker Hub image tags and published docs

First-install notes

  • First Install No extra packages are required. On first install, set the environment variables that list the Docker socket endpoints each container may call; the proxy blocks every other call with HTTP 403. source

Fetched today - each note links to its source

Alternatives

No alternatives collected yet.

Common questions

Do I need to run the Docker socket proxy with the privileged flag?

Yes, the README says --privileged is required because it connects to the Docker socket. That socket connection can be treated as privileged in some SELinux or AppArmor contexts.

How do I restrict which Docker API sections can pass through?

Set the relevant environment variables to 0 to revoke access or 1 to grant it. The variables normally match the API URL prefix, and blocked requests get an HTTP 403 Forbidden response.

Should I expose the proxy's port to the public network?

No, the README says to keep it out of public networks. It should only be reachable from Docker networks that contain the proxy and the service using it.

Answers sourced from github.com

Community

Collected 12 days ago - public community threads