socket-proxy-1  | 2025/03/26 10:16:33 can’t access docker socket as GID 0 owned by GID 991
socket-proxy-1  | please change the user setting in your compose to the correct UID/GID pair like this:
socket-proxy-1  | services:
socket-proxy-1  |   socket-proxy:
socket-proxy-1  |     user: "0:991"

You find the list of all available Docker API endpoints here. The following paths are still blocked, even though they are accesses only via GET:

• GET /containers/{id}/attach/ws
• GET /containers/{id}/export
• GET /containers/{id}/archive
• GET /secrets
• GET /configs
• GET /swarm/unlockkey
• GET /images/{name}/get

UNIQUE VALUE PROPOSITION 💶

[!IMPORTANT]

* ... this image exposes the socket not as root but as 1000:1000

* ... this image has no shell since it is distroless

* ... this image is auto updated to the latest version via CI/CD

* ... this image has a health check

* ... this image runs read-only

* ... this image is automatically scanned for CVEs before and after publishing

* ... this image is created via a secure and pinned CI/CD process

* ... this image is very small

If you value security, simplicity and optimizations to the extreme, then this image might be for you.

COMPOSE ✂️

name: "reverse-proxy"
services:
  socket-proxy:
    image: "11notes/socket-proxy:2.2.0"
    read_only: true
    user: "0:0" 
    environment:
      TZ: "Europe/Zurich"
    volumes:
      - "/run/docker.sock:/run/docker.sock:ro" 
      - "socket-proxy.run:/run/proxy"
    restart: "always"
traefik:
    # for more information about this image checkout:
    # https://github.com/11notes/docker-traefik
    depends_on:
      socket-proxy:
        condition: "service_healthy"
        restart: true
    image: "11notes/traefik:3"
    read_only: true
    labels:
      - "traefik.enable=true"
# default errors middleware
      - "traefik.http.middlewares.default-errors.errors.status=402-599"
      - "traefik.http.middlewares.default-errors.errors.query=/{status}"
      - "traefik.http.middlewares.default-errors.errors.service=default-errors"
# default ratelimit
      - "traefik.http.middlewares.default-ratelimit.ratelimit.average=100"
      - "traefik.http.middlewares.default-ratelimit.ratelimit.burst=120"
      - "traefik.http.middlewares.default-ratelimit.ratelimit.period=1s"
# default CSP
      - "traefik.http.middlewares.default-csp.headers.contentSecurityPolicy=default-src 'self' blob: data: 'unsafe-inline'"
# default allowlist
      - "traefik.http.middlewares.default-ipallowlist-RFC1918.ipallowlist.sourcerange=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16"
# example on how to secure the traefik dashboard and api
      - "traefik.http.routers.dashboard.rule=Host(${TRAEFIK_FQDN})"
      - "traefik.http.routers.dashboard.service=api@internal"
      - "traefik.http.routers.dashboard.middlewares=dashboard-auth"
      - "traefik.http.routers.dashboard.entrypoints=https"
      # admin / traefik, please change!
      - "traefik.http.middlewares.dashboard-auth.basicauth.users=admin:$2a$12$ktgZsFQZ0S1FeQbI1JjS9u36fAJMHDQaY6LNi9EkEp8sKtP5BK43C"

# default catch-all router
      - "traefik.http.routers.default.rule=HostRegexp(.+)"
      - "traefik.http.routers.default.priority=1"
      - "traefik.http.routers.default.entrypoints=https"
      - "traefik.http.routers.default.service=default-errors"

# default http to https redirection
      - "traefik.http.middlewares.default-http.redirectscheme.permanent=true"
      - "traefik.http.middlewares.default-http.redirectscheme.scheme=https"
      - "traefik.http.routers.default-http.priority=1"
      - "traefik.http.routers.default-http.rule=HostRegexp(.+)"
      - "traefik.http.routers.default-http.entrypoints=http"
      - "traefik.http.routers.default-http.middlewares=default-http"
      - "traefik.http.routers.default-http.service=default-http"
      - "traefik.http.services.default-http.loadbalancer.passhostheader=true"
    environment:
      TZ: "Europe/Zurich"
    command:
      # ping is needed for the health check to work!
      - "--ping=true"
      - "--ping.terminatingStatusCode=204"
      - "--global.checkNewVersion=false"
      - "--global.sendAnonymousUsage=false"
      - "--accesslog=true"
      - "--api.dashboard=true"
      # disable insecure api and dashboard access
      - "--api.insecure=false"
      - "--log.level=INFO"
      - "--log.format=json"
      - "--providers.docker.exposedByDefault=false"
      - "--providers.file.directory=/traefik/var"
      - "--entrypoints.http.address=:80"
      - "--entrypoints.http.http.middlewares=default-errors,default-ratelimit,default-ipallowlist-RFC1918,default-csp"
      - "--entrypoints.https.address=:443"
      - "--entrypoints.https.http.tls=true"
      - "--entrypoints.https.http.middlewares=default-errors,default-ratelimit,default-ipallowlist-RFC1918,default-csp"
      # disable upstream HTTPS certificate checks (https > https)
      - "--serversTransport.insecureSkipVerify=true"
      - "--experimental.plugins.rewriteResponseHeaders.moduleName=github.com/jamesmcroft/traefik-plugin-rewrite-response-headers"
      - "--experimental.plugins.rewriteResponseHeaders.version=v1.1.2"
      - "--experimental.plugins.geoblock.moduleName=github.com/PascalMinder/geoblock"
      - "--experimental.plugins.geoblock.version=v0.3.3"
    ports:
      - "80:80/tcp"
      - "443:443/tcp"
    volumes:
      - "var:/traefik/var"
      - "plugins:/traefik/plugins"
      # access docker socket via proxy read-only
      - "socket-proxy.run:/var/run"
    networks:
      backend:
      frontend:
    sysctls:
      # allow rootless container to access ports < 1024
      net.ipv4.ip_unprivileged_port_start: 80
    restart: "always"

errors:
    # for more information about this image checkout:
    # https://github.com/11notes/docker-postgres
    image: "11notes/traefik:errors"
    read_only: true
    labels:
      - "traefik.enable=true"
      - "traefik.http.services.default-errors.loadbalancer.server.port=8080"
    environment:
      TZ: "Europe/Zurich"
    networks:
      backend:
    restart: "always"
# example container
  nginx:
    # for more information about this image checkout:
    # https://github.com/11notes/docker-nginx
    image: "11notes/nginx:stable"
    read_only: true
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.nginx-example.rule=Host(${NGINX_FQDN})"
      - "traefik.http.routers.nginx-example.entrypoints=https"
      - "traefik.http.routers.nginx-example.service=nginx-example"
    ports:
      - "3000:3000/tcp"
    tmpfs:
      # needed for read_only: true
      - "/nginx/cache:uid=1000,gid=1000"
      - "/nginx/run:uid=1000,gid=1000"
    networks:
      backend:
    restart: "always"

volumes:
  var:
  plugins:
  socket-proxy.run:
networks:
  frontend:
  backend:
    internal: true

ENVIRONMENT 📝

MAIN TAGS 🏷️

• 2.2.0

There is no latest tag, what am I supposed to do about updates?