11notes vs Sockguard
11notes takes the most opinionated approach to socket security: read-only, no config, no write risk, while still allowing most Docker API reads except a fixed set of sensitive endpoints. Sockguard takes a different approach: a configurable default-deny policy engine for reads and controlled writes, with per-client policies, signed bundles, and image trust verification.
Feature Comparison
Here's how we compare on the features that matter most.
| Feature | 11notes | Sockguard |
|---|---|---|
| Method filtering | Yes | Yes |
| Read-only focus | Yes (hardcoded, zero write risk) | Configurable (read + controlled write) |
| Zero-config | Yes (no file needed) | No (YAML required) |
| Attack surface | Minimal (read-only hardcoded) | Broader (configurable) |
| Request body inspection | No | Yes (12+ resource types) |
| Per-client policies | No | CIDR + labels + cert selectors + unix peer |
| Write API control | No (blocks all writes) | Yes (default-deny + granular rules) |
| Read-side redaction | Partial (7 risky GETs blocked) | Full (visibility rules + JSON field redaction) |
| Signed policy bundles | No | Yes (cosign keyed + keyless, Rekor) |
| Container image trust | No | Yes (cosign + enforce / warn modes) |
| Prometheus metrics | No | Yes (socket-proxy request metrics) |
| Rate limits | No | Yes (per-profile token-bucket) |
| Audit log schema | No | Yes (JSON schema + reason codes) |
Key Differentiators
What we built that 11notes doesn't cover.
Configurable Default-Deny
11notes is read-only by design — you cannot enable writes. Sockguard starts default-deny and lets you open exactly the operations you need with explicit rules, so CI can run containers while monitoring only reads metrics.
Full Read-Side Redaction
11notes blocks 7 risky GET endpoints. Sockguard goes further with visibility rules and JSON field redaction — callers only see the labels, environment variables, and mount paths their policy allows.
Per-Client Policies
11notes applies the same read-only stance to every caller. Sockguard assigns different policies per CIDR range, Docker label, TLS certificate selector, or Unix peer credential.
Container Image Trust
Sockguard enforces image signatures at deployment time — blocking container or swarm-service creates whose images aren't signed or don't match a trusted digest. 11notes has no image-trust layer.
Signed Policy Bundles
Sockguard verifies policy files with cosign keyed or keyless signatures and Rekor inclusion. Policy tampering is caught before any request is evaluated.
Prometheus Metrics
Sockguard exports socket-proxy request metrics, deny counts, and latency histograms. 11notes has no observability layer beyond container logs.
Coming from 11notes?
Start with Sockguard's read-only preset, explicitly allow only the reads your client needs, then open write operations with rules scoped to trusted profiles. Unlike 11notes' fixed allow-most-reads policy, Sockguard requires you to choose the permitted surface.
$ docker run -d \
--name sockguard \
-v /var/run/docker.sock:/var/run/docker.sock:ro \
-v /var/run/sockguard:/var/run/sockguard \
-e SOCKGUARD_LISTEN_SOCKET=/var/run/sockguard/sockguard.sock \
codeswhat/sockguardReady to try Sockguard?
Default-deny, Apache-2.0, no SaaS required. Drop it in front of your socket in minutes.