# Tecnativa/docker-socket-proxy

Proxy over your Docker socket to restrict which requests it accepts

Repository: https://github.com/Tecnativa/docker-socket-proxy
Canonical: https://ross.abutalabs.com/products/docker-socket-proxy
Language: Python
License: Apache-2.0
License Family: permissive
Topics: docker, hacktoberfest
Last push: 2026-07-27T09:28:09+00:00

## Health v2 (maintenance only)
Score: 87/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 94, release rhythm 71, longevity 100
- inputs: {"age_days": 3444, "days_push": 37, "days_rel": 37, "gap_med": 162.5, "n_releases_24m": 5}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 2729, forks 206 (observed 2026-08-28T04:07:15.986896+00:00)

## What it is
A security-enhanced HAProxy-based proxy that sits in front of the Docker socket and restricts which Docker API requests are allowed. It returns HTTP 403 for API sections blocked via environment variables, limiting the blast radius of services that need partial Docker access.

## Use cases
- let CI or monitoring containers react to Docker events without giving them root on the host
- expose a restricted Docker API to Traefik or Portainer over a private network
- block destructive Docker API endpoints like container exec or image push
- replace mounting /var/run/docker.sock directly into untrusted containers
- secure Docker socket access in a swarm cluster

## When to choose
- you must give a container access to the Docker socket but want to whitelist only the API sections it needs
- you want a simple, battle-tested HAProxy-based socket guard with no TLS complexity

## When to avoid
- you need TLS-encrypted Docker API access, since this proxy intentionally speaks plain HTTP
- you can avoid socket access entirely by using a less privileged integration
- you need fine-grained per-request authorization beyond API-section blocking

## Facets
- artifact type: service
- maturity: active
- function: proxy, security, api-gateway, http-server
- domain: security, self-hosted
- platform: self-hosted
- tags: docker-socket, haproxy, container-security, api-restriction, containers, devops, docker, linux

## Member repositories
- Tecnativa/docker-socket-proxy (main) score 87

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:07:15.986896+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T02:14:41.894955+00:00, confidence not recorded.
  - readme: https://github.com/Tecnativa/docker-socket-proxy (fetched 2026-08-28T04:07:15.986896+00:00, sha bbec5e83274d)
- Data as of 2026-08-30T08:39:29.467469+00:00.