Skip to content

Commit 14352ea

Browse files
wollomaticwollomatic
authored
Merge pull request #31 from wollomatic/develop
Expose the filtered UNIX socket as a UNIX socket (implements #29)
2 parents 35e6259 + 8520e78 commit 14352ea

File tree

6 files changed

+138
-63
lines changed

6 files changed

+138
-63
lines changed

‎Dockerfile

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
# syntax=docker/dockerfile:1
2-
FROM --platform=$BUILDPLATFORM golang:1.22.6-alpine3.20 AS build
2+
FROM --platform=$BUILDPLATFORM golang:1.22.7-alpine3.20 AS build
33
WORKDIR /application
44
COPY . ./
55
ARG TARGETOS
@@ -17,4 +17,4 @@ USER 65534:65534
1717
VOLUME /var/run/docker.sock
1818
EXPOSE 2375
1919
ENTRYPOINT ["/socket-proxy"]
20-
COPY --from=build ./healthcheck ./socket-proxy /
20+
COPY --from=build ./healthcheck ./socket-proxy /

‎README.md

Lines changed: 25 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,17 @@ This is meant to be an additional layer of security. It does not replace other s
4242

4343
Socket-proxy listens per default only on `127.0.0.1`. Depending on what you need, you may want to set another listener address with the `-listenip` parameter. In almost every use case, `-listenip=0.0.0.0` will be the correct configuration when using socket-proxy in a docker image.
4444

45+
#### Using a unix socket instead of a TCP listener
46+
47+
> [!CAUTION]
48+
> This is a new feature introduced in version 1.5.0. If you experience any issues, please feel free to open an GitHub issue.
49+
50+
If you want to proxy/filter the unix socket to a new unix socket instead to a TCP listener,
51+
you need to set the `-proxysocketendpoint` parameter or the `SP_PROXYSOCKETENDPOIN` env variable to the socket path of the new unix socket.
52+
This will also disable the TCP listener.
53+
54+
For example `-proxysocketendpoint=/tmp/filtered-socket.sock`
55+
4556
#### Setting up the IP address or hostname allowlist
4657

4758
Per default, only `127.0.0.1/32` is allowed to connect to socket-proxy. You may want to set another allowlist with the `-allowfrom` parameter, depending on your needs.
@@ -162,18 +173,20 @@ To log the API calls of the client application, set the log level to `DEBUG` and
162173

163174
socket-proxy can be configured via command line parameters or via environment variables. If both command line parameter and environment variables are set, the environment variable will be ignored.
164175

165-
| Parameter | Environment Variable | Default Value | Description |
166-
|----------------------|-------------------------|------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
167-
| `-allowfrom` | `SP_ALLOWFROM` | `127.0.0.1/32` | Specifies the IP addresses of the clients or the hostname of one specific client allowed to connect to the proxy. The default value is `127.0.0.1/32`, which means only localhost is allowed. This default configuration may not be useful in most cases, but it is because of a secure-by-default design. To allow all IPv4 addresses, set `-allowfrom=0.0.0.0/0`. Alternatively, hostnames (comma-separated) can be set, for example `-allowfrom=traefik`, or `-allowfrom=traefik,dozzle`. Please remember that socket-proxy should never be exposed to a public network, regardless of this extra security layer. |
168-
| `-allowhealthcheck` | `SP_ALLOWHEALTHCHECK` | (not set) | If set, it allows the included health check binary to check the socket connection via TCP port 55555 (socket-proxy then listens on `127.0.0.1:55555/health`) |
169-
| `-listenip` | `SP_LISTENIP` | `127.0.0.1` | Specifies the IP address the server will bind on. Default is only the internal network. |
170-
| `-logjson` | `SP_LOGJSON` | (not set) | If set, it enables logging in JSON format. If unset, docker-proxy logs in plain text format. |
171-
| `-loglevel` | `SP_LOGLEVEL` | `INFO` | Sets the log level. Accepted values are: `DEBUG`, `INFO`, `WARN`, `ERROR`. |
172-
| `-proxyport` | `SP_PROXYPORT` | `2375` | Defines the TCP port the proxy listens to. |
173-
| `-shutdowngracetime` | `SP_SHUTDOWNGRACETIME` | `10` | Defines the time in seconds to wait before forcing the shutdown after sigtern or sigint (socket-proxy first tries to graceful shut down the TCP server) |
174-
| `-socketpath` | `SP_SOCKETPATH` | `/var/run/docker.sock` | Specifies the UNIX socket path to connect to. By default, it connects to the Docker daemon socket. |
175-
| `-stoponwatchdog` | `SP_STOPONWATCHDOG` | (not set) | If set, socket-proxy will be stopped if the watchdog detects that the unix socket is not available. |
176-
| `-watchdoginterval` | `SP_WATCHDOGINTERVAL` | `0` | Check for socket availabibity every x seconds (disable checks, if not set or value is 0) |
176+
| Parameter | Environment Variable | Default Value | Description |
177+
|--------------------------------|----------------------------------|------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
178+
| `-allowfrom` | `SP_ALLOWFROM` | `127.0.0.1/32` | Specifies the IP addresses of the clients or the hostname of one specific client allowed to connect to the proxy. The default value is `127.0.0.1/32`, which means only localhost is allowed. This default configuration may not be useful in most cases, but it is because of a secure-by-default design. To allow all IPv4 addresses, set `-allowfrom=0.0.0.0/0`. Alternatively, hostnames (comma-separated) can be set, for example `-allowfrom=traefik`, or `-allowfrom=traefik,dozzle`. Please remember that socket-proxy should never be exposed to a public network, regardless of this extra security layer. |
179+
| `-allowhealthcheck` | `SP_ALLOWHEALTHCHECK` | (not set/false) | If set, it allows the included health check binary to check the socket connection via TCP port 55555 (socket-proxy then listens on `127.0.0.1:55555/health`) |
180+
| `-listenip` | `SP_LISTENIP` | `127.0.0.1` | Specifies the IP address the server will bind on. Default is only the internal network. |
181+
| `-logjson` | `SP_LOGJSON` | (not set/false) | If set, it enables logging in JSON format. If unset, docker-proxy logs in plain text format. |
182+
| `-loglevel` | `SP_LOGLEVEL` | `INFO` | Sets the log level. Accepted values are: `DEBUG`, `INFO`, `WARN`, `ERROR`. |
183+
| `-proxyport` | `SP_PROXYPORT` | `2375` | Defines the TCP port the proxy listens to. |
184+
| `-shutdowngracetime` | `SP_SHUTDOWNGRACETIME` | `10` | Defines the time in seconds to wait before forcing the shutdown after sigtern or sigint (socket-proxy first tries to graceful shut down the TCP server) |
185+
| `-socketpath` | `SP_SOCKETPATH` | `/var/run/docker.sock` | Specifies the UNIX socket path to connect to. By default, it connects to the Docker daemon socket. |
186+
| `-stoponwatchdog` | `SP_STOPONWATCHDOG` | (not set/false) | If set, socket-proxy will be stopped if the watchdog detects that the unix socket is not available. |
187+
| `-watchdoginterval` | `SP_WATCHDOGINTERVAL` | `0` | Check for socket availabibity every x seconds (disable checks, if not set or value is 0) |
188+
| `-proxysocketendpoint` | `SP_PROXYSOCKETENDPOINT` | (not set) | Proxy to the given unix socket instead of a TCP port |
189+
| `-proxysocketendpointfilemode` | `SP_PROXYSOCKETENDPOINTFILEMODE` | `0400` | Explicitly set the file mode for the filtered unix socket endpoint (only useful with `-proxysocketendpoint`) |
177190

178191
### Changelog
179192

0 commit comments

Comments
 (0)