[READ-ONLY] Mirror of https://github.com/FoxxMD/blog.
blog.foxxmd.dev
put same stack proxy access in collapsible
+15
-15
+15
-15
_posts/2025-10-10-restricting-socket-proxy-by-container.md
+15
-15
_posts/2025-10-10-restricting-socket-proxy-by-container.md
···
118
118
119
119
While Service A may use the API as intended this won't stop an attacker from exploiting it or accessing your network from another vector. Anyone who can access the port of the socket proxy can read any data about any container. Not great!
120
120
121
-
#### Mitigating Socket Proxy Access
121
+
<details markdown=1>
122
+
123
+
<summary>Mitigating Socket Proxy Access by running in the same Stack</summary>
122
124
123
125
*Some* of the attack vectors mentioned above can be mitigated by restricting how a socket proxy is exposed. If the service that needs docker access is on the same host that needs to be accessed then the socket proxy can be created in the same stack as the service and communication can happen on the isolated stack network, rather than over the docker bridge.
124
126
···
172
174
</details>
173
175
174
176
This can be extended to remote hosts if you use [docker overlay networks](../migrating-to-traefik#swarm-and-overlay) with Docker Swarm. However, this isn't possible if you don't have Swarm setup or there are other network factors that prevent overlay networks from working across hosts.
177
+
178
+
</details>
175
179
176
180
## Restricting Docker API to Specific Containers
177
181
···
255
259
ports:
256
260
- 2375:2375
257
261
socket-proxy:
258
-
image: wollomatic/socket-proxy:1.10.0
259
-
restart: unless-stopped
260
-
user: 0:0
261
-
mem_limit: 64M
262
-
read_only: true
263
-
cap_drop:
264
-
- ALL
265
-
security_opt:
266
-
- no-new-privileges
267
-
command:
268
-
- '-loglevel=debug'
269
-
- '-listenip=0.0.0.0'
270
-
- '-allowfrom=proxy-container'
271
-
- '-allowGET=/(v1\..{1,2}/)?(containers).*'
262
+
image: lscr.io/linuxserver/socket-proxy:latest
263
+
environment:
264
+
- ALLOW_START=0
265
+
- ALLOW_STOP=0
266
+
- ALLOW_RESTARTS=0
267
+
- CONTAINERS=1
268
+
- INFO=0
269
+
- POST=0
272
270
volumes:
273
271
- /var/run/docker.sock:/var/run/docker.sock:ro
272
+
ports:
273
+
- 2375:2375
274
274
```
275
275
276
276
##### Configure Homepage