tecnativa/docker-socket-proxy

To maintain a secure environment when using this proxy:

1. Restrict Network Exposure: Never expose the proxy's port to a public network. Only expose it to Docker networks containing the proxy and the specific services that require it.
2. Principle of Least Privilege: Revoke access to any API section that your service does not explicitly need.
3. Understand TLS: This image does not include TLS support; it provides a plain HTTP proxy to the host Docker Unix socket. Use Docker's built-in firewall to restrict access.

To run the API proxy, use the docker container run command. Note that the --privileged flag is required to allow the container to connect to the Docker socket in certain SELinux/AppArmor contexts.

By default, the proxy listens on port 2375. It is recommended to bind it to 127.0.0.1 to avoid exposing the socket to public networks.

$ docker container run \
    -d --privileged \
    --name dockerproxy \
    -v /var/run/docker.sock:/var/run/docker.sock \
    -p 127.0.0.1:2375:2375 \
    tecnativa/docker-socket-proxy

You can grant or revoke access to specific Docker API sections using environment variables.

• Set a variable to 1 to grant access.
• Set a variable to 0 to revoke access.

Variables typically match the URL prefix of the Docker API. For example, AUTH controls access to /auth/*.

Use the LOG_LEVEL environment variable to set the severity level of the logs. The default value is info.

Supported values: debug, info, notice, warning, err, crit, alert, and emerg.

The following environment variables control access to specific Docker API sections. Access is managed by setting the value to 0 (revoke) or 1 (grant).

### Access granted by default
- `EVENTS`
- `PING`
- `VERSION`

### Access revoked by default (Security-critical)
- `AUTH`
- `SECRETS`
- `POST` (When disabled, only `GET` and `HEAD` operations are allowed, making the API read-only)

### Other API sections (Revoked by default)
- `BUILD`
- `COMMIT`
- `CONFIGS`
- `CONTAINERS`
- `ALLOW_START` (containers/`id`/`start`)
- `ALLOW_STOP` (containers/`id`/`stop`)
- `ALLOW_RESTARTS` (containers/`id`/`stop`|`restart`|`kill`)
- `ALLOW_PAUSE` (containers/`id`/`pause`)
- `ALLOW_UNPAUSE` (containers/`id`/`unpause`)
- `DISTRIBUTION`
- `EXEC`
- `GRPC`
- `IMAGES`
- `INFO`
- `NETWORKS`
- `NODES`
- `PLUGINS`
- `SERVICES`
- `SESSION`
- `SWARM`
- `SYSTEM`
- `TASKS`
- `VOLUMES`