← Directory

Docker-Socket-Proxy

The Socket Proxy is a security-enhanced proxy which allows you to apply access rules to the Docker socket, limiting the attack surface for containers such as…

  • Home Automation
  • Infrastructure
  • Other
  • Productivity
  • Security
  • Tools & Utilities
The Socket Proxy is a security-enhanced proxy which allows you to apply access rules to the Docker socket, limiting the attack surface for containers such as watchtower or Traefik that need to use it.

Platform availability

Available on 2 of 9 platforms

  • Unraid
  • TrueNAS (not listed)
  • Umbrel (not listed)
  • ZimaOS
  • Proxmox (not listed)
  • Helm (not listed)
  • Mac (not listed)
  • Windows (not listed)
  • Linux (not listed)

Health score?A 0-100 score computed nightly from four factors: maintained (40%: recent commits and steady activity), popular (25%: GitHub stars, log scale), easy to install (20%: platforms, install notes, setup guides, Docker image) and light to run (15%: minimum RAM, ARM support). When the source code has been checked, a fifth factor, security check (20%: automated scan for committed secrets, unsafe desktop-app settings, known-vulnerable dependencies and project hygiene; any serious finding caps it at 20), is added. Factors without data are left out and the rest are rescaled.

15/100 Low

Maintained
0GitHub repository no longer exists
Popular
No data
Easy to install
452 install platforms, install notes, Docker image
Light to run
No data

Based on 2 of 4 factors.

Availability: platform listings confirmed today, links checked 15 days ago

No GitHub repository data collected yet.

Checked 17 days ago - source: GitHub (BigBearTechWorld/socket-proxy)

Resources & Compatibility

ARM (e.g. Raspberry Pi) is supported.

Checked 17 days ago - source: Docker Hub image tags and published docs

First-install notes

  • Run the proxy on port 3128 Start the container with port 3128 exposed and mount folders for its cache and certificates (trust files used to verify secure connections). Without the exposed port Docker cannot reach the proxy, and without the mounted folders the cache and certificates are lost when the container is removed. source
  • Tell Docker where the proxy is Set Docker's HTTPS_PROXY setting (the value that tells Docker to route HTTPS image pulls through a proxy) to the proxy host and port, often 3128. If Docker is not told where the proxy is, it will pull images directly and ignore the cache or network workaround. source
  • Docker Desktop for Mac setup If you use Docker Desktop for Mac, add the proxy CA certificate (the trust file from the proxy) inside the Docker VM (the small Linux machine Docker Desktop runs containers in) using the documented steps. Without this, Docker may reject secure image pulls that go through the proxy. source

Fetched 17 days ago - each note links to its source

Alternatives

No alternatives collected yet.

Common questions

Why use Docker Socket Proxy with Traefik instead of mounting the Docker socket directly?

The socket proxy can limit Traefik's access to the socket to only what is necessary. This reduces the potential damage an attacker can cause.

What setup concern is mentioned when using Docker Socket Proxy through a Portainer stack?

A Portainer thread seeks advice on implementing the proxy through a Portainer stack. It also mentions changing the proxy configuration as a concern.

Why might Home Assistant’s Docker integration show no containers when using Docker Socket Proxy?

A Home Assistant community thread reports that the Docker integration can show no containers when pointed at Docker Socket Proxy. This can happen even though the proxy reports Docker status entities.

Answers sourced from community.home-assistant.io, www.reddit.com, www.reddit.com

Community

Collected 11 days ago - public community threads