Put Docker Socket Proxy in front of every container that needs the Docker API instead of mounting docker.sock directly

content/en/3.serveex/4.monitoring/2.dozzle.md

@@ -43,10 +43,41 @@ services:
       - .env
     environment:
       - DOZZLE_HOSTNAME=${DOMAIN}
+      - DOCKER_HOST=tcp://docker-socket-proxy:2375
+    networks:
+      - dozzle-internal
+    depends_on:
+      - docker-socket-proxy
+
+  docker-socket-proxy:
+    image: lscr.io/linuxserver/socket-proxy:latest
+    container_name: docker-socket-proxy-dozzle
+    security_opt:
+      - no-new-privileges:true
+    networks:
+      - dozzle-internal
     volumes:
-      - /var/run/docker.sock:/var/run/docker.sock
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+    environment:
+      - CONTAINERS=1
+      - IMAGES=1
+      - INFO=1
+      - EVENTS=1
+      - ALLOW_LOGS=1
+    restart: unless-stopped
+    read_only: true
+    tmpfs:
+      - /run
+
+networks:
+  dozzle-internal:
+    name: dozzle-internal
 ```
 
+::note
+Dozzle only ever reads container logs, so this config sits **Docker Socket Proxy** in front of the Docker API instead of mounting `/var/run/docker.sock` directly, keeping `POST` disabled entirely: Dozzle can list containers and stream their logs, and nothing else.
+::
+
 ::tip{icon=""}
 ✨ __Tip:__ Add the watchtower label to each container to automate updates
 

content/en/3.serveex/4.monitoring/4.beszel.md

@@ -53,13 +53,35 @@ services:
     network_mode: host
     volumes:
       - ./socket:/beszel_socket
-      - /var/run/docker.sock:/var/run/docker.sock:ro
     environment:
       LISTEN: /beszel_socket/beszel.sock
+      DOCKER_HOST: tcp://127.0.0.1:2375
       # Do not remove quotes around the key
       KEY: ${KEY}
+    depends_on:
+      - docker-socket-proxy
+
+  docker-socket-proxy:
+    image: lscr.io/linuxserver/socket-proxy:latest
+    container_name: docker-socket-proxy-beszel
+    security_opt:
+      - no-new-privileges:true
+    ports:
+      - 127.0.0.1:2375:2375
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+    environment:
+      - CONTAINERS=1
+    restart: unless-stopped
+    read_only: true
+    tmpfs:
+      - /run
 ```
 
+::note
+`beszel-agent` runs with `network_mode: host`, so it can't join a dedicated internal network like the other proxied stacks on this site; instead, **Docker Socket Proxy** publishes its API on `127.0.0.1` only, reachable from the agent via the host's own loopback interface, with just `CONTAINERS=1` enabled since the agent only needs to read container stats.
+::
+
 ::tip{icon=""}
 ✨ __Tip:__ Add the Watchtower label to each container to automate updates.
 
@@ -122,11 +144,28 @@ services:
     container_name: beszel-agent
     restart: unless-stopped
     network_mode: host
-    volumes:
-      - /var/run/docker.sock:/var/run/docker.sock:ro
     environment:
       LISTEN: ${PORT}
       KEY: ${KEY}
+      DOCKER_HOST: tcp://127.0.0.1:2375
+    depends_on:
+      - docker-socket-proxy
+
+  docker-socket-proxy:
+    image: lscr.io/linuxserver/socket-proxy:latest
+    container_name: docker-socket-proxy-beszel
+    security_opt:
+      - no-new-privileges:true
+    ports:
+      - 127.0.0.1:2375:2375
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+    environment:
+      - CONTAINERS=1
+    restart: unless-stopped
+    read_only: true
+    tmpfs:
+      - /run
 ```
 
 And in `.env`: