Skip to content

Commit f900970

Browse files
committed
recommend our docker socket proxy
1 parent 32aadbb commit f900970

File tree

1 file changed

+2
-2
lines changed

1 file changed

+2
-2
lines changed

README.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,12 +10,12 @@ If adding multiple mods, enter them in an array separated by `|`, such as `DOCKE
1010

1111
## Security consideration:
1212

13-
Mapping `docker.sock` is a potential security liability because docker has root access on the host and any process that has full access to `docker.sock` would also have root access on the host. Docker api has no built-in way to set limitations on access, however you can use a proxy for the `docker.sock` via a solution like [tecnativa/docker-socket-proxy](https://hub.docker.com/r/tecnativa/docker-socket-proxy), which adds the ability to limit access. Then you would just set `DOCKER_HOST=` environment variable to point to the proxy address.
13+
Mapping `docker.sock` is a potential security liability because docker has root access on the host and any process that has full access to `docker.sock` would also have root access on the host. Docker api has no built-in way to set limitations on access, however you can use a proxy for the `docker.sock` via a solution like [our docker socket proxy](https://github.com/linuxserver/docker-socket-proxy), which adds the ability to limit access. Then you would just set `DOCKER_HOST=` environment variable to point to the proxy address.
1414

1515
Here's a sample compose yaml snippet for tecnativa/docker-socket-proxy:
1616
```yaml
1717
dockerproxy:
18-
image: ghcr.io/tecnativa/docker-socket-proxy:latest
18+
image: lscr.io/linuxserver/socket-proxy:latest
1919
container_name: dockerproxy
2020
volumes:
2121
- /var/run/docker.sock:/var/run/docker.sock:ro

0 commit comments

Comments
 (0)