[READ-ONLY] Mirror of https://github.com/FoxxMD/docker-proxy-filter. Filter the contents of Docker API responses
docker
docker-socket-proxy
filter
Add readme and change package name
+125
-15
+8
-8
.vscode/launch.json
+8
-8
.vscode/launch.json
···
8
8
{
9
9
"type": "lldb",
10
10
"request": "launch",
11
-
"name": "Debug executable 'docker-container-proxy'",
11
+
"name": "Debug executable 'docker-proxy-filter'",
12
12
"cargo": {
13
13
"args": [
14
14
"build",
15
-
"--bin=docker-container-proxy",
16
-
"--package=docker-container-proxy"
15
+
"--bin=docker-proxy-filter",
16
+
"--package=docker-proxy-filter"
17
17
],
18
18
"filter": {
19
-
"name": "docker-container-proxy",
19
+
"name": "docker-proxy-filter",
20
20
"kind": "bin"
21
21
}
22
22
},
···
26
26
{
27
27
"type": "lldb",
28
28
"request": "launch",
29
-
"name": "Debug unit tests in executable 'docker-container-proxy'",
29
+
"name": "Debug unit tests in executable 'docker-proxy-filter'",
30
30
"cargo": {
31
31
"args": [
32
32
"test",
33
33
"--no-run",
34
-
"--bin=docker-container-proxy",
35
-
"--package=docker-container-proxy"
34
+
"--bin=docker-proxy-filter",
35
+
"--package=docker-proxy-filter"
36
36
],
37
37
"filter": {
38
-
"name": "docker-container-proxy",
38
+
"name": "docker-proxy-filter",
39
39
"kind": "bin"
40
40
}
41
41
},
+1
-1
Cargo.lock
+1
-1
Cargo.lock
+1
-1
Cargo.toml
+1
-1
Cargo.toml
+110
README.md
+110
README.md
···
1
+
# Docker Proxy Filter
2
+
3
+
[](https://opensource.org/licenses/MIT)
4
+
[](https://hub.docker.com/r/foxxmd/docker-proxy-filter)
5
+
6
+
Docker Proxy Filter (DPF) is a smol, forward proxy for **filtering the _content_ and _responses_** of Docker API responses to only those you want to expose.
7
+
8
+
Unlike the OG [docker-socket-proxy](https://github.com/Tecnativa/docker-socket-proxy) and its variants, DPF provides filtering of the _response content_ from the Docker API, rather than disabling/enabling of API endpoints.
9
+
10
+
It does not connect directly to the Docker socket: it designed to be used with another Docker "Socket Proxy" container.
11
+
12
+
Combined with a socket-proxy container that provides granular endpoint access it's possible to expose only information about specific containers in a read-only context.
13
+
14
+
## Example
15
+
16
+
```yaml
17
+
services:
18
+
proxy-filter:
19
+
image: foxxmd/docker-proxy-filter
20
+
environment:
21
+
- PROXY_URL=http://socket-proxy:2375
22
+
- CONTAINER_NAME=foo,bar
23
+
- SCRUB_ENVS=true
24
+
ports:
25
+
- 2375:2375
26
+
socket-proxy:
27
+
image: wollomatic/socket-proxy:1.10.0
28
+
restart: unless-stopped
29
+
user: 0:0
30
+
mem_limit: 64M
31
+
read_only: true
32
+
cap_drop:
33
+
- ALL
34
+
security_opt:
35
+
- no-new-privileges
36
+
command:
37
+
- '-loglevel=debug'
38
+
- '-allowGET=/_ping|v1\..{1,2}/(info|containers.*)'
39
+
- '-listenip=0.0.0.0'
40
+
- '-allowfrom=proxy-filter'
41
+
- '-stoponwatchdog'
42
+
- '-shutdowngracetime=5'
43
+
volumes:
44
+
- /var/run/docker.sock:/var/run/docker.sock:ro
45
+
```
46
+
47
+
On your machine you are running these containers:
48
+
49
+
50
+
| Id | Name |
51
+
|------|--------------|
52
+
| 1234 | foo |
53
+
| abcd | bar |
54
+
| 6969 | cool-program |
55
+
| 0444 | fun-program |
56
+
57
+
```shell
58
+
$ curl -i http://localhost:2375/v1.47/containers
59
+
HTTP/1.1 200 OK
60
+
content-length: 1234
61
+
content-type: application/json
62
+
date: Wed, 08 Oct 2025 00:33:02 GMT
63
+
64
+
[{"Id": 1234, "Names": ["/foo"] ...},{"Id": "abcd": "Names": ["/bar"]}]
65
+
# cool-program and fun-program have been filtered out of array
66
+
```
67
+
68
+
```shell
69
+
$ curl -i http://localhost:2375/v1.47/containers/6969/json
70
+
HTTP/1.1 404 Not Found
71
+
transfer-encoding: chunked
72
+
content-type: application/json
73
+
date: Wed, 08 Oct 2025 00:30:54 GMT
74
+
75
+
{"message":"No such container: 6969"}
76
+
# returns 404 as if no container is running
77
+
```
78
+
79
+
```shell
80
+
$ curl -i http://localhost:2375/v1.47/containers/1234/json
81
+
HTTP/1.1 404 Not Found
82
+
transfer-encoding: chunked
83
+
content-type: application/json
84
+
date: Wed, 08 Oct 2025 00:30:54 GMT
85
+
86
+
{"Id": 1234, "Name": "/foo" ...}
87
+
# returns container because Name is substring of CONTAINER_NAME values
88
+
```
89
+
90
+
```shell
91
+
$ curl -i http://localhost:2375/v1.47/volumes
92
+
HTTP/1.1 403 Forbidden
93
+
transfer-encoding: chunked
94
+
content-type: text/plain
95
+
date: Wed, 08 Oct 2025 00:39:59 GMT
96
+
97
+
Forbidden
98
+
# not allowed by wollomatic/socket-proxy config
99
+
```
100
+
101
+
## Configuration
102
+
103
+
All configuration is done through environmental variables.
104
+
105
+
106
+
| Key | Required | Default | Description |
107
+
|-------------------|----------|---------|---------------------------------------------------------------------------------------------------------------------------------------------------------------|
108
+
| `PROXY_URL` | yes | | The fully-qualified URL to proxy API requests EX `http://socket-proxy:2375` |
109
+
| `CONTAINER_NAMES` | yes | | A comma-delimited list of values. Any container that contains any value as a substring will be allowed. |
110
+
| `SCRUB_ENVS` | no | false | Remove `Env` list from [container inspect API](https://docs.docker.com/reference/api/engine/version/v1.48/#tag/Container/operation/ContainerInspect) response |
+3
-3
docker/Dockerfile
+3
-3
docker/Dockerfile
···
1
1
FROM rust:1.90-bookworm as Builder
2
2
3
-
WORKDIR /usr/src/myapp
3
+
WORKDIR /usr/src/app
4
4
COPY . .
5
5
6
6
···
8
8
9
9
FROM debian:bookworm-slim
10
10
RUN apt-get update && apt-get upgrade -y && apt-get install openssl -y && apt clean && rm -rf /var/lib/apt/lists/*
11
-
COPY --from=builder /usr/src/myapp/target/x86_64-unknown-linux-gnu/release/docker-container-proxy /usr/local/bin/myapp
12
-
CMD ["myapp"]
11
+
COPY --from=builder /usr/src/app/target/x86_64-unknown-linux-gnu/release/docker-proxy-filter /usr/local/bin/docker-proxy-filter
12
+
CMD ["docker-proxy-filter"]
+2
-2
src/main.rs
+2
-2
src/main.rs
···
270
270
271
271
let container_names: Vec<String>;
272
272
273
-
match env::var("CONTAINER_NAME") {
273
+
match env::var("CONTAINER_NAMES") {
274
274
Ok(val) => {
275
275
container_names = val.split(',').map(|x| x.trim().to_string()).collect();
276
276
info!("CONTAINER_NAMES: {}", container_names.join(" | "));
277
277
},
278
278
Err(_) => {
279
-
error!("Missing CONTAINER_NAME");
279
+
error!("Missing CONTAINER_NAMES");
280
280
panic!();
281
281
},
282
282
}