Put Docker Socket Proxy in front of every container that needs the Docker API instead of mounting docker.sock directly

content/en/3.serveex/91.advanced/1.authentik.md

@@ -19,7 +19,7 @@ Authentik also supports multi-factor authentication, including TOTP (a code gene
 
 It's a great alternative to VPNs for securely exposing services, especially ones that lack MFA or login protection (e.g., the SWAG dashboard).
 
-Authentik has [extensive documentation](https://docs.goauthentik.io/docs/installation/docker-compose) and [great tutorials from Cooptonian](https://www.youtube.com/@cooptonian). Here, we’ll cover the basics using Dockge as an example.
+Authentik has [extensive documentation](https://docs.goauthentik.io/install-config/install/docker-compose) and [great tutorials from Cooptonian](https://www.youtube.com/@cooptonian). Here, we’ll cover the basics using Dockge as an example.
 
 There are two main modes you should know:
 
@@ -156,24 +156,54 @@ services:
       AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik}
       AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik}
       AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
-    # `user: root` and the docker socket volume are optional.
-    # See more for the docker socket integration here:
+    # `user: root` and the Docker integration below are optional, only needed if you
+    # want Authentik to auto-manage embedded outposts on this host. See:
     # https://goauthentik.io/docs/outposts/integrations/docker
     # Removing `user: root` also prevents the worker from fixing the permissions
     # on the mounted folders, so when removing this make sure the folders have the correct UID/GID
     # (1000:1000 by default)
     user: root
     volumes:
-      - /var/run/docker.sock:/var/run/docker.sock
       - ./media:/media
       - ./certs:/certs
       - ./custom-templates:/templates
       - ./ssh:/authentik/.ssh
+    networks:
+      - default
+      - authentik-internal
     env_file:
       - .env
     depends_on:
       - postgresql
       - redis
+      - docker-socket-proxy
+
+  docker-socket-proxy:
+    image: lscr.io/linuxserver/socket-proxy:latest
+    container_name: docker-socket-proxy-authentik
+    security_opt:
+      - no-new-privileges:true
+    networks:
+      - authentik-internal
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+    environment:
+      - CONTAINERS=1
+      - IMAGES=1
+      - NETWORKS=1
+      - INFO=1
+      - POST=1
+      - ALLOW_START=1
+      - ALLOW_STOP=1
+      - ALLOW_RESTARTS=1
+    restart: unless-stopped
+    read_only: true
+    tmpfs:
+      - /run
+
+networks:
+  authentik-internal:
+    name: authentik-internal
 
 volumes:
   database:
@@ -182,6 +212,10 @@ volumes:
     driver: local
 ```
 
+::note
+This adds **Docker Socket Proxy** so the optional Docker integration never needs `/var/run/docker.sock` mounted directly into the worker. If you enable it, set the connection's Docker URL in the admin UI to `http://docker-socket-proxy:2375` instead of the local socket path, as [Authentik's own docs recommend](https://goauthentik.io/docs/outposts/integrations/docker) for socket-proxy setups.
+::
+
 ### Begin the initial setup
 
 In the `.env` file, the `PG_PASS` and `AUTHENTIK_SECRET_KEY` variables are already set.
@@ -322,7 +356,7 @@ Go to _Settings_, click the _MFA_ section, then _Register_. Choose a method like
 You’ll now be prompted to enter a one-time code at every login.
 
 ## Protecting a Native App
-Authentik is natively compatible with several applications. You can find the list and [support here](https://docs.goauthentik.io/integrations/services/).
+Authentik is natively compatible with several applications. You can find the list and [support here](https://integrations.goauthentik.io/).
 
 ## Protecting an App via Reverse Proxy
 SWAG lets you insert Authentik’s login page between a request and access to your service. To do this:
@@ -436,9 +470,9 @@ We assume you’ve already installed [Docker](/serveex/core/docker) and [SWAG](/
 
 ### Create the stack folder
 
-On your remote machine, use [Dockge](/serveex/core/docker/#installer-dockge-pour-gérer-et-déployer-les-conteneurs) to create a stack named `authentik-outpost`.
+On your remote machine, use [Dockge](/serveex/core/docker/#install-dockge-to-manage-and-deploy-containers) to create a stack named `authentik-outpost`.
 
-If you haven’t installed [Dockge](/serveex/core/docker/#installer-dockge-pour-gérer-et-déployer-les-conteneurs), create a folder `/srv/docker/authentik-outpost`, or directly via command line:
+If you haven’t installed [Dockge](/serveex/core/docker/#install-dockge-to-manage-and-deploy-containers), create a folder `/srv/docker/authentik-outpost`, or directly via command line:
 
 ```bash [Terminal]
 sudo mkdir -P /srv/docker/authentik-outpost
@@ -515,7 +549,7 @@ We assume the Dockge network name is `authentik-outpost_default`.
 
 ### Restart SWAG
 
-If using [Dockge](/serveex/core/docker/#installer-dockge-pour-gérer-et-déployer-les-conteneurs), restart SWAG.
+If using [Dockge](/serveex/core/docker/#install-dockge-to-manage-and-deploy-containers), restart SWAG.
 
 Otherwise, via terminal: