← Directory

dockersocket

This is a security-enhanced proxy for the Docker Socket.

  • Network Services
  • Security
  • Tools & Utilities
This is a security-enhanced proxy for the Docker Socket.

Platform availability

Available on 1 of 9 platforms

  • Unraid
  • TrueNAS (not listed)
  • Umbrel (not listed)
  • ZimaOS (not listed)
  • Proxmox (not listed)
  • Helm (not listed)
  • Mac (not listed)
  • Windows (not listed)
  • Linux (not listed)

Health score?A 0-100 score computed nightly from four factors: maintained (40%: recent commits and steady activity), popular (25%: GitHub stars, log scale), easy to install (20%: platforms, install notes, setup guides, Docker image) and light to run (15%: minimum RAM, ARM support). When the source code has been checked, a fifth factor, security check (20%: automated scan for committed secrets, unsafe desktop-app settings, known-vulnerable dependencies and project hygiene; any serious finding caps it at 20), is added. Factors without data are left out and the rest are rescaled.

57/100 Fair

Maintained
67last commit 82 days ago
Popular
692,832 GitHub stars
Easy to install
201 install platform, Docker image
Light to run
No data

Based on 3 of 4 factors.

Availability: platform listings confirmed today

No GitHub repository data collected yet.

Resources & Compatibility

ARM (e.g. Raspberry Pi) is supported.

Checked today - source: Docker Hub image tags and published docs

First-install notes

No first-install notes yet.

Alternatives

No alternatives collected yet.

Common questions

Does docker-socket-proxy support TLS?

No, it does not include TLS support. It provides a plain HTTP proxy to the host Docker Unix socket, so access should be restricted with a private Docker network or firewall.

How do I restrict which Docker API actions are allowed?

Use environment variables that match the API URL prefixes you want to control. Set a variable to 1 to grant access or 0 to revoke access, and blocked requests return HTTP 403.

Should I expose the proxy's 2375 port publicly?

No, never expose the proxy's port to a public network. Expose it only on Docker networks that contain the proxy and the service that needs it.

Why must the proxy container be started as privileged?

The --privileged flag is required because it connects to the Docker socket. That connection can be treated as privileged in some SELinux or AppArmor contexts and would otherwise be blocked.

Can it be used to limit a reverse proxy's Docker socket access?

Yes, a container can be given the Docker socket while a reverse proxy such as Traefik talks through it. The socket proxy can then limit the reverse proxy to only the API access it needs.

Answers sourced from github.com, www.reddit.com

Community

Collected today - public community threads