Skip to content

Commit 49eeeba

Browse files
11notes11notes
committed
2 parents a7a3d09 + 983e21c commit 49eeeba

1 file changed

Lines changed: 120 additions & 0 deletions

File tree

‎README.md‎

Lines changed: 120 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,120 @@
1+
![banner](https://github.com/11notes/defaults/blob/main/static/img/banner.png?raw=true)
2+
3+
# 🇨🇭 SOCKET-PROXY
4+
[<img src="https://img.shields.io/badge/github-source-blue?logo=github&color=040308">](https://github.com/11notes/docker-SOCKET-PROXY)![size](https://img.shields.io/docker/image-size/11notes/socket-proxy/2.0.0?color=0eb305)![version](https://img.shields.io/docker/v/11notes/socket-proxy/2.0.0?color=eb7a09)![pulls](https://img.shields.io/docker/pulls/11notes/socket-proxy?color=2b75d6)[<img src="https://img.shields.io/github/issues/11notes/docker-SOCKET-PROXY?color=7842f5">](https://github.com/11notes/docker-SOCKET-PROXY/issues)
5+
6+
Access your docker socket safely as read-only, rootless and distroless
7+
8+
# MAIN TAGS 🏷️
9+
These are the main tags for the image. There is also a tag for each commit and its shorthand sha256 value.
10+
11+
* [2.0.0](https://hub.docker.com/r/11notes/socket-proxy/tags?name=2.0.0)
12+
* [stable](https://hub.docker.com/r/11notes/socket-proxy/tags?name=stable)
13+
* [latest](https://hub.docker.com/r/11notes/socket-proxy/tags?name=latest)
14+
15+
# SYNOPSIS 📖
16+
**What can I do with this?** This image will run a proxy to access your docker socket as read-only. The exposed proxy socket is run as 1000:1000, not as root, although the image starts the proxy process as root to interact with the actual docker socket. There is also a TCP endpoint started at 2375 that will also proxy to the actual docker socket if needed. It is not exposed by default and must be exposed via using ```- "2375:2375/tcp"``` in your compose.
17+
18+
# UNIQUE VALUE PROPOSITION 💶
19+
**Why should I run this image and not the other image(s) that already exist?** Good question! All the other images on the market that do exactly the same don’t do or offer these options:
20+
21+
* This image runs the proxy part as a specific UID/GID (not root), all other images run everything as root
22+
* This image uses a single binary, all other images use apps like Nginx or HAProxy (bloat)
23+
* This image has no shell since it is 100% distroless, all other images run on a distro like Debian or Alpine with full shell access (security)
24+
* This image does not ship with any CVE and is automatically maintained via CI/CD, all other images mostly have no CVE scanning or code quality tools in place
25+
* This image has no upstream dependencies, all other images have upstream dependencies
26+
* This image exposes the socket as a UNIX socket and TCP socket, all other images only expose it via a TCP socket
27+
28+
If you value security, simplicity and the ability to interact with the maintainer and developer of an image. Then using my images is a great start in the right direction.
29+
30+
# COMPOSE ✂️
31+
```yaml
32+
name: "traefik" # this is a compose example for Traefik
33+
services:
34+
socket-proxy:
35+
image: "11notes/socket-proxy:2.0.0"
36+
volumes:
37+
- "/run/docker.sock:/run/docker.sock:ro" # mount host docker socket, the :ro does not mean read-only for the socket, just for the actual file
38+
- "socket-proxy:/run/proxy" # this socket is run as 1000:1000, not as root!
39+
restart: "always"
40+
41+
traefik:
42+
image: "11notes/traefik:3.2.0"
43+
depends_on:
44+
socket-proxy:
45+
condition: "service_healthy"
46+
restart: true
47+
command:
48+
- "--global.checkNewVersion=false"
49+
- "--global.sendAnonymousUsage=false"
50+
- "--api.dashboard=true"
51+
- "--api.insecure=true"
52+
- "--log.level=INFO"
53+
- "--log.format=json"
54+
- "--providers.docker.exposedByDefault=false" # use docker provider but do not expose by default
55+
- "--entrypoints.http.address=:80"
56+
- "--entrypoints.https.address=:443"
57+
- "--serversTransport.insecureSkipVerify=true" # do not verify downstream SSL certificates
58+
ports:
59+
- "80:80/tcp"
60+
- "443:443/tcp"
61+
- "8080:8080/tcp"
62+
networks:
63+
frontend:
64+
backend:
65+
volumes:
66+
- "socket-proxy:/var/run"
67+
sysctls:
68+
net.ipv4.ip_unprivileged_port_start: 80
69+
restart: "always"
70+
71+
nginx: # example container
72+
image: "11notes/nginx:1.26.2"
73+
labels:
74+
- "traefik.enable=true"
75+
- "traefik.http.routers.default.priority=1"
76+
- "traefik.http.routers.default.rule=PathPrefix(`/`)"
77+
- "traefik.http.routers.default.entrypoints=http"
78+
- "traefik.http.routers.default.service=default"
79+
- "traefik.http.services.default.loadbalancer.server.port=8443"
80+
- "traefik.http.services.default.loadbalancer.server.scheme=https" # proxy from http to https since this image runs by default on https
81+
networks:
82+
backend: # allow container only to be accessed via traefik
83+
restart: "always"
84+
85+
volumes:
86+
socket-proxy:
87+
88+
networks:
89+
frontend:
90+
backend:
91+
internal: true
92+
```
93+
94+
# ENVIRONMENT 📝
95+
| Parameter | Value | Default |
96+
| --- | --- | --- |
97+
| `TZ` | [Time Zone](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones) | |
98+
| `DEBUG` | Will activate debug option for container image and app (if available) | |
99+
| `SOCKET_PROXY_VOLUME` | path to the docker volume used to expose the prox socket | /run/proxy |
100+
| `SOCKET_PROXY_DOCKER_SOCKET` | path to the actual docker socket | /run/docker.sock |
101+
| `SOCKET_PROXY_UID` | the UID used to run the proxy parts | 1000 |
102+
| `SOCKET_PROXY_GID` | the GID used to run the proxy parts | 1000 |
103+
104+
# SOURCE 💾
105+
* [11notes/socket-proxy](https://github.com/11notes/docker-SOCKET-PROXY)
106+
107+
# PARENT IMAGE 🏛️
108+
* [scratch](https://hub.docker.com/_/scratch)
109+
110+
# BUILT WITH 🧰
111+
* [11notes/util](https://github.com/11notes/docker-util)
112+
113+
# GENERAL TIPS 📌
114+
* Use a reverse proxy like Traefik, Nginx, HAproxy to terminate TLS and to protect your endpoints
115+
* Use Let’s Encrypt DNS-01 challenge to obtain valid SSL certificates for your services
116+
117+
# ElevenNotes™️
118+
This image is provided to you at your own risk. Always make backups before updating an image to a different version. Check the [releases](https://github.com/11notes/docker-socket-proxy/releases) for breaking changes. If you have any problems with using this image simply raise an [issue](https://github.com/11notes/docker-socket-proxy/issues), thanks. If you have a question or inputs please create a new [discussion](https://github.com/11notes/docker-socket-proxy/discussions) instead of an issue. You can find all my other repositories on [github](https://github.com/11notes?tab=repositories).
119+
120+
*created 24.03.2025, 09:25:13 (CET)*

0 commit comments

Comments
 (0)