Tecnativa/docker-socket-proxy

Health v2 · maintenance only

Adoption not part of the score

2729 stars · 206 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

A security-enhanced HAProxy-based proxy that sits in front of the Docker socket and restricts which Docker API requests are allowed. It returns HTTP 403 for API sections blocked via environment variables, limiting the blast radius of services that need partial Docker access.

Use cases

• let CI or monitoring containers react to Docker events without giving them root on the host
• expose a restricted Docker API to Traefik or Portainer over a private network
• block destructive Docker API endpoints like container exec or image push
• replace mounting /var/run/docker.sock directly into untrusted containers
• secure Docker socket access in a swarm cluster

When to choose

• you must give a container access to the Docker socket but want to whitelist only the API sections it needs
• you want a simple, battle-tested HAProxy-based socket guard with no TLS complexity

When to avoid

• you need TLS-encrypted Docker API access, since this proxy intentionally speaks plain HTTP
• you can avoid socket access entirely by using a less privileged integration
• you need fine-grained per-request authorization beyond API-section blocking

Facets

service · maturity active

proxy security api-gateway http-server security self-hosted self-hosted docker-socket haproxy container-security api-restriction containers devops docker linux

Member repositories

For agents

markdown · JSON · MCP: product_card(name="Tecnativa/docker-socket-proxy")