Docker Socket
Proxy
Control what gets through. Filter Docker API requests by method and path with default-deny posture, structured audit logging, and drop-in Tecnativa compatibility.
Features
Security-first Docker socket proxy with zero external dependencies
Default-Deny Posture
SecurityEverything blocked unless explicitly allowed. No match means deny.
Request Body Inspection
SecurityPOST /containers/create bodies are parsed to block privileged containers, host networking, and non-allowlisted bind mounts before Docker ever sees the request.
mTLS for Remote TCP
SecurityNon-loopback TCP listeners require mutual TLS 1.3 by default. Plaintext remote TCP is explicit legacy opt-in only.
Owner Label Isolation
ControlStamp containers, networks, volumes, and build images with an owner label. List and prune calls are auto-filtered, and cross-owner access is denied.
Client ACL Primitives
ControlGate callers by source CIDR and enforce per-client allowlists resolved from the calling container's labels over the bridge network.
Granular Control
ControlAllow start/stop while blocking create/exec. Per-operation POST controls with glob matching.
Structured Logging
OperationsJSON access logs with method, path, decision, matched rule index, latency, and client info.
YAML Configuration
ControlDeclarative rules in YAML. Glob patterns for paths, first-match-wins evaluation, 10 bundled presets.
Tecnativa Compatible
OperationsDrop-in replacement using the same env vars. CONTAINERS=1, POST=0, ALLOW_START=1 all work.
Minimal Attack Surface
SecurityWolfi-based image, ~12MB. Cosign-signed with SBOM and build provenance.
Quick Start
Add to your docker-compose.yml and you're done
services:
sockguard:
image: codeswhat/sockguard:latest
volumes:
- /var/run/docker.sock:/var/run/docker.sock:ro
- sockguard-socket:/var/run/sockguard
environment:
- SOCKGUARD_LISTEN_SOCKET=/var/run/sockguard/sockguard.sock
- CONTAINERS=1
- EVENTS=1
your-app:
depends_on:
- sockguard
volumes:
- sockguard-socket:/var/run/sockguard:ro
environment:
- DOCKER_HOST=unix:///var/run/sockguard/sockguard.sock
volumes:
sockguard-socket:Comparison
How Sockguard stacks up against other Docker socket proxies
| Feature | Tecnativa | LinuxServer | wollomatic | Sockguard |
|---|---|---|---|---|
| Method + path filtering | Yes | Yes | Yes | Yes |
| Granular POST ops | No | Partial | Via regex | Yes |
| Request body inspection | No | No | No | Yes (/containers/create) |
| Per-client policies | No | No | CIDR + labels | CIDR + labels |
| Resource owner labels | No | No | No | Yes |
| Remote TCP mTLS | No | No | No | Yes (TLS 1.3) |
| Response filtering | No | No | No | Planned |
| Structured audit log | No | No | No | Yes |
| YAML config | No | No | No | Yes |