Add socketproxy.yaml

2026-07-14 10:39:10 -05:00
parent 0fa87219b1
commit f50aea9738
1 changed files with 63 additions and 0 deletions
@@ -0,0 +1,63 @@
+# A container should be run on the same docker network as the service(s) using it. 
+# Most containers that would normally connect to a mounted docker.sock can have their endpoint overridden using the DOCKER_HOST environment variable 
+# if they do not offer the option in their configuration; it should typically be pointed to tcp://socket-proxy:2375.
+# Never expose this container's port to a public network. It should be treated the same way you would treat the docker socket or TCP endpoint.
+
+# The container should be run on the same docker network as the service(s) using it. 
+# Most containers that would normally connect to a mounted docker.sock can have their endpoint overridden using the DOCKER_HOST environment variable 
+# if they do not offer the option in their configuration; it should typically be pointed to tcp://socket-proxy:2375.
+services:
+  socket-proxy:   # socket-proxy for Docker API
+    image: lscr.io/linuxserver/socket-proxy:latest
+    container_name: socket-proxy
+    restart: unless-stopped
+    read_only: true      # Make the container filesystem read-only
+    tmpfs:
+      - /run
+    ports:
+      - "2375:2375"
+    volumes:
+      # mount host docker socket, the :ro does not mean read-only for the socket, just for the actual file
+      - "/run/docker.sock:/run/docker.sock:ro"
+    environment:     
+      - TZ=America/Chicago
+      #- LOG_LEVEL=debug    #optional - function: Possible values are: debug, info, notice, warning, err, crit, alert and emerg. Defaults to info.
+      ### DOCKER FUNCTIONS ###
+      - ALLOW_START=0      #optional - function: /containers/{id}/start - This option will work even if POST=0 # needed for dockhand functionality
+      - ALLOW_STOP=0       #optional - function: /containers/{id}/stop - This option will work even if POST=0 # needed for dockhand functionality
+      - ALLOW_RESTARTS=1   #optional - function: /containers/{id}/stop, /containers/{id}/restart, and /containers/{id}/kill - This option will work even if POST=0 - Needed for docker volume backup and automated watchtower and 
+      #- CONFIGS=0          #optional - function: /configs
+      - CONTAINERS=1        #optional - Allow listing and managing containers
+      #- DISABLE_IPV6=0     #optional - function: Set to 1 to prevent binding to the IPv6 interface for legacy systems that cannot support IPv6.
+      - IMAGES=1            #optional - Allow listing images
+      - INFO=1              #optional - Allow info
+      - NETWORKS=1          #optional - Allow listing networks
+      - PING=1              #optional - Allow ping
+      - POST=1              #optional - function:  When set to 0, only GET and HEAD operations are allowed, making API access read-only.   <-- This is needed for "Check for updates" operations in dockpeek
+      - SERVICES=1          #optional - Allow listing and managing services
+      - VERSION=1           #optional - Allow listing version
+      - VOLUMES=1           #optional - Allow listing volumes
+      - EXEC=1              #optional - Disable exec command for security, enable for terminal access (dockhand)
+      - DF=1                # needed for dockhand functionality - disk space info
+      # Optional (safe to enable)
+      - EVENTS=1
+      - SYSTEM=1
+      # Keep these OFF
+      - AUTH=0
+      - SECRETS=0
+      #- POST=0 
+      #- BUILD=0
+       # Required for dockhand compose stack management
+      - DELETE=1
+      - BUILD=1
+      - TASKS=1
+      - DISTRIBUTION=1
+    labels:
+      - rackpeek.name=socket-proxy
+      - rackpeek.tags=database
+    networks:
+      - socket-net
+
+networks:
+  socket-net:
+    external: true