Tecnativa/docker-socket-proxy
Docker Socket Proxy
docker-socket-proxy is an HAProxy-based security proxy that filters and controls access to the Docker API. It acts as a security layer between containers and the Docker socket to restrict API operations based on specific paths and methods.
The proxy uses environment variables to enable or disable specific API endpoints and to grant or revoke permissions for various API sections. It can enforce read-only access by restricting the API to only allow GET and HEAD requests, returning a forbidden status for unauthorized actions.
The project provides capabilities for path-based request filtering, custom socket path configuration, and adjustable logging verbosity to control the amount of diagnostic information captured in logs.
Features
- API Proxies - Acts as an HAProxy-based API proxy that filters and routes requests to the Docker socket.
- Socket Security Layers - Adds a security layer between containers and the Docker socket to prevent container escape and host compromise.
- API Read-Only Modes - Enforces a read-only state for the API proxy to prevent destructive changes to the Docker daemon.
- API Request Filters - Filters and controls access to the Docker API by matching incoming request URIs.
- Path-Based Filters - Inspects the URI of incoming requests to match them against a list of permitted or forbidden API endpoints.
- Socket Access Controllers - Restricts Docker API operations to read-only or specific permitted paths using environment variables.
- Docker API Proxies - Acts as an HAProxy-based proxy that filters and controls traffic directed to the Docker API.
- API Access Scopes - Grants or revokes granular permissions for specific Docker API sections and methods.
- Access Control Lists - Implements access control lists to permit or deny specific Docker API paths based on configurable patterns.
- API Access Control - Blocks or permits specific Docker API sections and returns a forbidden status for restricted requests.
- Endpoint Controls - Enables or disables specific API endpoints to reduce the available attack surface.
- Request Access Restrictions - Restrict which API endpoints a container can access by proxying requests through configurable rules.
- HTTP Method Filtering - Enforces read-only access by blocking any request that does not use the GET or HEAD methods.
- Action-Based Access Restrictions - Filters requests to the socket based on defined action permissions to prevent unauthorized operations.
- Method-Based Filterings - Filters incoming requests by HTTP method to restrict API operations to read-only verbs.
- Secure API Proxies - Provides a secure proxy for the Docker API with granular access control.
- API Endpoint Toggles - Allows enabling or disabling specific Docker API endpoints using boolean environment variables.
- Socket Access Controls - Grants or denies access to specific Docker API sections using environment variables and HTTP status codes.
- Daemon Unix Socket Communication - Forwards validated HTTP traffic to the Unix domain socket where the Docker daemon listens.
- Socket Path Configurations - Connect to a socket at a non-default filesystem path by reading a specific environment variable.
- Containerized Environment Monitors - Provides a secure way for monitoring tools to access Docker system data by filtering API requests.
- Socket Path Configurations - Allows overriding the default Docker socket path via the SOCKET_PATH environment variable.
- API Gateway - Uses HAProxy as a gateway to inspect HTTP methods and paths for backend socket access control.
- Environment Variable-Based Configuration - Configures proxy behavior and access rules at startup using environment variables.
- Path-Based Routers - Routes incoming HTTP requests to the Docker socket backend based on URL path prefixes.
- Sicherheit und Härtung - Fine-grained filtering for the Docker API socket.
