{"id":13581802,"url":"https://github.com/qdm12/docker-proxy-acl-alpine","last_synced_at":"2025-05-07T18:23:07.534Z","repository":{"id":108548797,"uuid":"151446436","full_name":"qdm12/docker-proxy-acl-alpine","owner":"qdm12","description":" A lightweight docker Unix socket proxy which restricts endpoint usage to allowed sections","archived":false,"fork":false,"pushed_at":"2019-07-16T04:52:59.000Z","size":38,"stargazers_count":9,"open_issues_count":0,"forks_count":2,"subscribers_count":2,"default_branch":"master","last_synced_at":"2025-03-31T12:58:02.890Z","etag":null,"topics":["acl","docker","socket","unix-socket"],"latest_commit_sha":null,"homepage":null,"language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/qdm12.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2018-10-03T16:43:09.000Z","updated_at":"2022-10-09T08:46:09.000Z","dependencies_parsed_at":"2023-07-25T17:31:30.613Z","dependency_job_id":null,"html_url":"https://github.com/qdm12/docker-proxy-acl-alpine","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/qdm12%2Fdocker-proxy-acl-alpine","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/qdm12%2Fdocker-proxy-acl-alpine/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/qdm12%2Fdocker-proxy-acl-alpine/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/qdm12%2Fdocker-proxy-acl-alpine/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/qdm12","download_url":"https://codeload.github.com/qdm12/docker-proxy-acl-alpine/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":252932144,"owners_count":21827232,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["acl","docker","socket","unix-socket"],"created_at":"2024-08-01T15:02:15.073Z","updated_at":"2025-05-07T18:23:07.511Z","avatar_url":"https://github.com/qdm12.png","language":"Go","funding_links":[],"categories":["Go"],"sub_categories":[],"readme":"# Docker-proxy-ACL-Alpine\n\n*Lightweight container running a restricted Docker unix socket proxy*\n\n[![Docker Build Status](https://img.shields.io/docker/build/qmcgaw/docker-proxy-acl-alpine.svg)](https://hub.docker.com/r/qmcgaw/docker-proxy-acl-alpine)\n\n[![GitHub last commit](https://img.shields.io/github/last-commit/qdm12/docker-proxy-acl-alpine.svg)](https://github.com/qdm12/docker-proxy-acl-alpine/commits)\n[![GitHub commit activity](https://img.shields.io/github/commit-activity/y/qdm12/docker-proxy-acl-alpine.svg)](https://github.com/qdm12/docker-proxy-acl-alpine/commits)\n[![GitHub issues](https://img.shields.io/github/issues/qdm12/docker-proxy-acl-alpine.svg)](https://github.com/qdm12/docker-proxy-acl-alpine/issues)\n\n[![Docker Pulls](https://img.shields.io/docker/pulls/qmcgaw/docker-proxy-acl-alpine.svg)](https://hub.docker.com/r/qmcgaw/docker-proxy-acl-alpine)\n[![Docker Stars](https://img.shields.io/docker/stars/qmcgaw/docker-proxy-acl-alpine.svg)](https://hub.docker.com/r/qmcgaw/docker-proxy-acl-alpine)\n[![Docker Automated](https://img.shields.io/docker/automated/qmcgaw/docker-proxy-acl-alpine.svg)](https://hub.docker.com/r/qmcgaw/docker-proxy-acl-alpine)\n\n[![Image size](https://images.microbadger.com/badges/image/qmcgaw/docker-proxy-acl-alpine.svg)](https://microbadger.com/images/qmcgaw/docker-proxy-acl-alpine)\n[![Image version](https://images.microbadger.com/badges/version/qmcgaw/docker-proxy-acl-alpine.svg)](https://microbadger.com/images/qmcgaw/docker-proxy-acl-alpine)\n\n| Image size | RAM usage | CPU usage |\n| --- | --- | --- |\n| 5.82MB | 10MB | Low |\n\n## Why\n\n- A better version than [titpetric/docker-proxy-acl](https://github.com/titpetric/docker-proxy-acl)\n  - 6MB instead of 450MB Docker image\n  - Options can be changed with the command line argument\n  - Emojis\n  - More checks\n- No need to run with `--privileged` although you bind mount the docker socket\n- No networking, just unix socket files\n\nExposing `/var/run/docker.sock` to a Docker container requiring it (such as [netdata](https://github.com/firehol/netdata)) involves\nsecurity concerns and the container should be limited in what it can do with `docker.sock`.\n\nYou can enable an endpoint with the `-a` argument. Currently supported endpoints are:\n\n- containers: opens access to `/containers/json` and `/containers/{name}/json`\n- images: opens access to `/images/json` , `/images/{name}/json` and `/images/{name}/history`\n- networks: opens access to `/networks` and `/networks/{name}`\n- volumes: opens access to `/volumes` and `/volumes/{name}`\n- services: opens access to `/services` and `/services/{id}`\n- tasks: opens access to `/tasks` and `/tasks/{name}`\n- events: opens access to `/events`\n- info: opens access to `/info`\n- version: opens access to `/version`\n- ping: opens access to `/_ping`\n- Untested endpoints:\n    - events\n    - auth\n    - secrets\n    - build\n    - commit\n    - configs\n    - distribution\n    - exec\n    - nodes\n    - plugins\n    - session\n    - swarm\n    - system\n\nTo combine arguments, repeat them like this: `-a info -a version`\n\n## Setup\n\nThe following is in example for [**netdata**](https://github.com/firehol/netdata), such that it can resolve\nthe container names found in the `cgroups` filesystem.\n\n```bash\ndocker run -d --net=none \\\n-v /var/run/docker.sock:/var/run/docker.sock \\\n-v /yourpath:/tmp/docker-proxy-acl \\\nqmcgaw/docker-proxy-acl-alpine -a containers\n```\n\nA new socket file is hence created at `/yourpath/docker.sock` with only the\n`/containers/json` and `/containers/{name}/json` endpoints allowed.\n\nThis socket file can then be passed to the **netdata** container, with an additional option like this:\n\n```bash\n-v /yourpath/docker.sock:/var/run/docker.sock\n```\n\nYou can also use docker-compose:\n\n```yml\nversion: '3'\nservices:\n  docker-proxy:\n    build: .\n    image: qmcgaw/docker-proxy-acl-alpine\n    container_name: docker-proxy\n    volumes:\n      - /yourpath/docker-proxy-acl:/tmp/docker-proxy-acl\n      - /var/run/docker.sock:/var/run/docker.sock\n    command: -a containers\n    network_mode: none\n    restart: always\n```\n\n## TODOs\n\n- [ ] Change to another router\n- [ ] Healthcheck\n- [ ] Non root user\n- [ ] Title icon","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fqdm12%2Fdocker-proxy-acl-alpine","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fqdm12%2Fdocker-proxy-acl-alpine","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fqdm12%2Fdocker-proxy-acl-alpine/lists"}