• Blog - all the things you can do with our containers including How-To guides, opinions and much more!
• Discord - realtime support / chat with the community and the team.
• Discourse - post on our community forum.
• Fleet - an online web interface which displays all of our maintained images.
• GitHub - view the source for all of our repositories.
• Open Collective - please consider helping us by either donating or contributing to our budget

linuxserver/socket-proxy

Supported Architectures

Application Setup

• Never expose this container's port to a public network. It should be treated the same way you would treat the docker socket or TCP endpoint.
• Revoke access to any API section that you consider your service should not need.
• To see the versions of the API your Docker daemon and client support, use docker version and check the API version.
• Read the docs for the API version you are using for an explanation of all the available endpoints.

Podman / libpod API

- LIBPOD_CONTAINERS=1
- LIBPOD_INFO=1
- LIBPOD_NETWORKS=1
- LIBPOD_PODS=1
- LIBPOD_VOLUMES=1
- LIBPOD_IMAGES=1
- LIBPOD_EVENTS=1

Rootless Podman as a non-root user

• Socket ownership. The rootless Podman socket ($XDG_RUNTIME_DIR/podman/podman.sock) is owned by your host user. That user maps to root inside the container's namespace, so a non-root user in the container cannot read it. Use --userns=keep-id:uid=65534,gid=65534 to map your host user onto UID/GID 65534 inside the container, so nobody owns the socket and can proxy it.
• A writable /run. The entrypoint renders the HAProxy config into /run/haproxy at startup, so /run must be writable by the non-root user. Mount it as a tmpfs with mode=1777 (this also satisfies read-only operation).

podman run -d \
  --name=socket-proxy \
  --user 65534:65534 \
  --userns=keep-id:uid=65534,gid=65534 \
  -e CONTAINERS=1 `#optional` \
  -e LIBPOD_CONTAINERS=1 `#optional` \
  -e POST=0 `#optional` \
  -v $XDG_RUNTIME_DIR/podman/podman.sock:/var/run/docker.sock:ro \
  -p 2375:2375 \
  --read-only \
  --tmpfs /run:rw,mode=1777 \
  --restart unless-stopped \
  lscr.io/linuxserver/socket-proxy:latest

[Container]
ContainerName=socket-proxy
Image=lscr.io/linuxserver/socket-proxy:latest
User=65534:65534
UserNS=keep-id:uid=65534,gid=65534
Environment=CONTAINERS=1
Environment=LIBPOD_CONTAINERS=1
Environment=POST=0
Volume=%t/podman/podman.sock:/var/run/docker.sock:ro
PublishPort=2375:2375
ReadOnly=true
Tmpfs=/run:rw,mode=1777

[Install]
WantedBy=default.target

!NOTE On SELinux-enforcing hosts (e.g. Fedora/RHEL), add --security-opt label=disable to the podman run (or SecurityLabelDisable=true to the Quadlet) so the container can access the mounted socket.

Read-Only Operation

Usage

docker compose (recommended, click here for more info)

---
services:
  socket-proxy:
    image: lscr.io/linuxserver/socket-proxy:latest
    container_name: socket-proxy
    environment:
      - ALLOW_START=0 #optional
      - ALLOW_STOP=0 #optional
      - ALLOW_RESTARTS=0 #optional
      - ALLOW_PAUSE=0 #optional
      - ALLOW_UNPAUSE=0 #optional
      - AUTH=0 #optional
      - BUILD=0 #optional
      - COMMIT=0 #optional
      - CONFIGS=0 #optional
      - CONTAINERS=0 #optional
      - DISABLE_IPV6=0 #optional
      - DISTRIBUTION=0 #optional
      - EVENTS=1 #optional
      - EXEC=0 #optional
      - IMAGES=0 #optional
      - INFO=0 #optional
      - LOG_LEVEL=info #optional
      - NETWORKS=0 #optional
      - NODES=0 #optional
      - PING=1 #optional
      - PLUGINS=0 #optional
      - POST=0 #optional
      - SECRETS=0 #optional
      - SERVICES=0 #optional
      - SESSION=0 #optional
      - SWARM=0 #optional
      - SYSTEM=0 #optional
      - TASKS=0 #optional
      - TZ=Etc/UTC #optional
      - VERSION=1 #optional
      - VOLUMES=0 #optional
      - LIBPOD_ALLOW_PAUSE=0 #optional
      - LIBPOD_ALLOW_POD_PAUSE=0 #optional
      - LIBPOD_ALLOW_POD_RESTARTS=0 #optional
      - LIBPOD_ALLOW_POD_START=0 #optional
      - LIBPOD_ALLOW_POD_STOP=0 #optional
      - LIBPOD_ALLOW_POD_UNPAUSE=0 #optional
      - LIBPOD_ALLOW_RESTARTS=0 #optional
      - LIBPOD_ALLOW_START=0 #optional
      - LIBPOD_ALLOW_STOP=0 #optional
      - LIBPOD_ALLOW_UNPAUSE=0 #optional
      - LIBPOD_CONTAINERS=0 #optional
      - LIBPOD_EVENTS=0 #optional
      - LIBPOD_EXEC=0 #optional
      - LIBPOD_GENERATE=0 #optional
      - LIBPOD_IMAGES=0 #optional
      - LIBPOD_INFO=0 #optional
      - LIBPOD_MANIFESTS=0 #optional
      - LIBPOD_NETWORKS=0 #optional
      - LIBPOD_PING=1 #optional
      - LIBPOD_PLAY=0 #optional
      - LIBPOD_PODS=0 #optional
      - LIBPOD_SECRETS=0 #optional
      - LIBPOD_SYSTEM=0 #optional
      - LIBPOD_VERSION=1 #optional
      - LIBPOD_VOLUMES=0 #optional
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    restart: unless-stopped
    read_only: true
    tmpfs:
      - /run

docker cli (click here for more info)

docker run -d \
  --name=socket-proxy \
  -e ALLOW_START=0 `#optional` \
  -e ALLOW_STOP=0 `#optional` \
  -e ALLOW_RESTARTS=0 `#optional` \
  -e ALLOW_PAUSE=0 `#optional` \
  -e ALLOW_UNPAUSE=0 `#optional` \
  -e AUTH=0 `#optional` \
  -e BUILD=0 `#optional` \
  -e COMMIT=0 `#optional` \
  -e CONFIGS=0 `#optional` \
  -e CONTAINERS=0 `#optional` \
  -e DISTRIBUTION=0 `#optional` \
  -e DISABLE_IPV6=0 `#optional` \
  -e EVENTS=1 `#optional` \
  -e EXEC=0 `#optional` \
  -e IMAGES=0 `#optional` \
  -e INFO=0 `#optional` \
  -e LOG_LEVEL=info `#optional` \
  -e NETWORKS=0 `#optional` \
  -e NODES=0 `#optional` \
  -e PING=1 `#optional` \
  -e PLUGINS=0 `#optional` \
  -e POST=0 `#optional` \
  -e SECRETS=0 `#optional` \
  -e SERVICES=0 `#optional` \
  -e SESSION=0 `#optional` \
  -e SWARM=0 `#optional` \
  -e SYSTEM=0 `#optional` \
  -e TASKS=0 `#optional` \
  -e TZ=Etc/UTC `#optional` \
  -e VERSION=1 `#optional` \
  -e VOLUMES=0 `#optional` \
  -e LIBPOD_ALLOW_PAUSE=0 `#optional` \
  -e LIBPOD_ALLOW_POD_PAUSE=0 `#optional` \
  -e LIBPOD_ALLOW_POD_RESTARTS=0 `#optional` \
  -e LIBPOD_ALLOW_POD_START=0 `#optional` \
  -e LIBPOD_ALLOW_POD_STOP=0 `#optional` \
  -e LIBPOD_ALLOW_POD_UNPAUSE=0 `#optional` \
  -e LIBPOD_ALLOW_RESTARTS=0 `#optional` \
  -e LIBPOD_ALLOW_START=0 `#optional` \
  -e LIBPOD_ALLOW_STOP=0 `#optional` \
  -e LIBPOD_ALLOW_UNPAUSE=0 `#optional` \
  -e LIBPOD_CONTAINERS=0 `#optional` \
  -e LIBPOD_EVENTS=0 `#optional` \
  -e LIBPOD_EXEC=0 `#optional` \
  -e LIBPOD_GENERATE=0 `#optional` \
  -e LIBPOD_IMAGES=0 `#optional` \
  -e LIBPOD_INFO=0 `#optional` \
  -e LIBPOD_MANIFESTS=0 `#optional` \
  -e LIBPOD_NETWORKS=0 `#optional` \
  -e LIBPOD_PING=1 `#optional` \
  -e LIBPOD_PLAY=0 `#optional` \
  -e LIBPOD_PODS=0 `#optional` \
  -e LIBPOD_SECRETS=0 `#optional` \
  -e LIBPOD_SYSTEM=0 `#optional` \
  -e LIBPOD_VERSION=1 `#optional` \
  -e LIBPOD_VOLUMES=0 `#optional` \
  -v /var/run/docker.sock:/var/run/docker.sock:ro \
  --restart unless-stopped \
  --read-only \
  --tmpfs /run \
  lscr.io/linuxserver/socket-proxy:latest

Parameters

Support Info

• Shell access whilst the container is running:

docker exec -it socket-proxy /bin/sh

• To monitor the logs of the container in realtime:

docker logs -f socket-proxy

• Container version number:

docker inspect -f '{{ index .Config.Labels "build_version" }}' socket-proxy

• Image version number:

docker inspect -f '{{ index .Config.Labels "build_version" }}' lscr.io/linuxserver/socket-proxy:latest

Updating Info

Via Docker Compose

• Update images:

• Update containers:

• You can also remove the old dangling images:

docker image prune

Via Docker Run

• Update the image:

docker pull lscr.io/linuxserver/socket-proxy:latest

• Stop the running container:

docker stop socket-proxy

• Delete the container:

docker rm socket-proxy

• You can also remove the old dangling images:

docker image prune

Image Update Notifications - Diun (Docker Image Update Notifier)

Building locally

git clone https://github.com/linuxserver/docker-socket-proxy.git
cd docker-socket-proxy
docker build \
  --no-cache \
  --pull \
  -t lscr.io/linuxserver/socket-proxy:latest .

docker run --rm --privileged lscr.io/linuxserver/docker-qemu-static --reset