It’s dangerous to expose the docker socket to a container, as malicious code could break out into the host. There are various ways to avoid this; a simple/popular approach is to use a proxy between the container and the docker daemon, which filters naughty requests. (The most widely used is Tecnativ…

Just as there could be malicious code inside Traefik/Portainer/whatever that would abuse the docker socket, there could be malicious code inside Tecnativa that would abuse the docker socket. That’s the wrong approach. Have you found any malicious code? Simply stating the possibility, based on u…

Furthermore, the docker socket proxy leverages haproxy and at its core just configures the haproxy.cfg and then starts haproxy to filter out resource endpoint paths that should not be allowed. The intention is to add an extra layer of security, by denying access to specific endpoints, so that in ca…

Thanks for your thoughts guys. The “docker socket problem” has a large number of blog articles and StackExchange questions devoted to it, and the most common advice is to use a docker socket proxy (I mentioned a specific one, but there are others). What concerns me is that it’s copy-paste advice a…

Does a docker socket proxy improve security?

General

lonix1 (lonix1) June 2, 2023, 11:33pm 2

Also posted at StackExchange and that proxy image’s repo.

Topic		Replies	Views
Tools like arcane/portainer/loggifly etc, started separately are not connecting through socket-proxy:2375 to docker-daemon Compose docker-compose	3	74	April 19, 2026
General questions about securing docker General security	3	1009	July 23, 2022
"Protect the Docker daemon socket" this article may be unsafe? General security	0	1089	August 2, 2016
Bind docker socket inside container fails with permission denied General docker	8	10556	July 25, 2022
OWASP Docker Security Cheat Sheet General security , tutorial , tips	1	3458	October 6, 2023

Does a docker socket proxy improve security?

Related topics