# dockersocket

dockersocket is a self-hosted network services app. This is a security-enhanced proxy for the Docker Socket. It is open source and self-hosted, installable on Unraid.

Canonical page: https://ourlocalhost.com/app/7080/dockersocket

## Description

This is a security-enhanced proxy for the Docker Socket.

## Platform availability

Available on 1 of 9 platforms: Unraid.

## Health score

57/100 (Fair), based on 3 of 4 factors.
- Maintained: 67 (last commit 82 days ago)
- Popular: 69 (2,832 GitHub stars)
- Easy to install: 20 (1 install platform, Docker image)

## Links

- Unraid: https://ca.unraid.net/apps/dockersocket-09jr3hv0j7k93r?q=dockersocket
- GitHub: https://github.com/Tecnativa/docker-socket-proxy

## Common questions

### Does docker-socket-proxy support TLS?

No, it does not include TLS support. It provides a plain HTTP proxy to the host Docker Unix socket, so access should be restricted with a private Docker network or firewall.

### How do I restrict which Docker API actions are allowed?

Use environment variables that match the API URL prefixes you want to control. Set a variable to 1 to grant access or 0 to revoke access, and blocked requests return HTTP 403.

### Should I expose the proxy's 2375 port publicly?

No, never expose the proxy's port to a public network. Expose it only on Docker networks that contain the proxy and the service that needs it.

### Why must the proxy container be started as privileged?

The --privileged flag is required because it connects to the Docker socket. That connection can be treated as privileged in some SELinux or AppArmor contexts and would otherwise be blocked.

### Can it be used to limit a reverse proxy's Docker socket access?

Yes, a container can be given the Docker socket while a reverse proxy such as Traefik talks through it. The socket proxy can then limit the reverse proxy to only the API access it needs.

---
Source: Our Local Host (https://ourlocalhost.com/app/7080/dockersocket), the self-hosted and open-source app directory.