Djeex/socat-proxy
1
1
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases 4 Activity

Compare commits

base: Djeex/socat-proxy:1.0.1
Branches Tags
Djeex/socat-proxy:main
Djeex/socat-proxy:1.1.1 Djeex/socat-proxy:1.1.0 Djeex/socat-proxy:1.0.1 Djeex/socat-proxy:v1.0
..
compare: Djeex/socat-proxy:5de286e2331576d18bc8956d058757cc90968b0d
Branches Tags
Djeex/socat-proxy:main
Djeex/socat-proxy:1.1.1 Djeex/socat-proxy:1.1.0 Djeex/socat-proxy:1.0.1 Djeex/socat-proxy:v1.0
1 Commits
1.0.1 .. 5de286e233
Author SHA1 Message Date
Djeex 5de286e233 Fixed variable and log order + listen path 2025-09-24 12:43:45 +02:00
11 changed files with 103 additions and 649 deletions
Expand all files Collapse all files
.dockerignore
+2
View File
@@ -3,7 +3,9 @@
.gitignore
README.md
LICENSE
VERSION
*.log
*.tmp
.env
docker-compose.yaml
Dockerfile.minimal
.env
+4 -5
View File
@@ -1,5 +1,4 @@
TARGET_HOST= # Target hostname/IP to proxy to
TARGET_PORT= # Target port to proxy to
UNIX_SOCKET_NAME= # Name of the socket file
UNIX_SOCKET_PATH= # Path to UNIX socket inside container
HOST_SOCKET_PATH= # Host path for socket mounting
# Socat Proxy Configuration
TARGET_HOST=
TARGET_PORT=
SOCKET_PATH=
.gitea/workflows/ci.yml
-163
View File
@@ -1,163 +0,0 @@
name: CI
on:
push:
branches: [main]
pull_request:
branches: [main]
schedule:
- cron: "0 6 * * 1"
jobs:
build-and-scan:
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v7
with:
fetch-depth: 0
persist-credentials: false
- name: Build Docker image
run: docker build -t socat-proxy:ci .
- name: Smoke test (syntax check)
run: docker run --rm --entrypoint sh socat-proxy:ci -n /entrypoint.sh
- name: Run unit tests
run: |
docker build --target test -t socat-proxy:test .
docker run --rm socat-proxy:test bats /app/tests/entrypoint.bats
- name: Lint entrypoint.sh with shellcheck
run: docker build --target lint -t socat-proxy:lint .
- name: Scan with Trivy (critical - blocking)
run: |
docker run --rm \
-e DOCKER_HOST=tcp://dockerhost:2375 \
--add-host=dockerhost:host-gateway \
aquasec/trivy:0.74.0 image --exit-code 1 --severity CRITICAL socat-proxy:ci
- name: Scan with Trivy (high - informative)
run: |
docker run --rm \
-e DOCKER_HOST=tcp://dockerhost:2375 \
--add-host=dockerhost:host-gateway \
aquasec/trivy:0.74.0 image --exit-code 0 --severity HIGH socat-proxy:ci
- name: Publish tagged image
if: github.event_name == 'push' && github.ref == 'refs/heads/main'
run: |
BEFORE="${{ github.event.before }}"
if [ -n "$BEFORE" ] && [ "$BEFORE" != "0000000000000000000000000000000000000000" ] && git cat-file -e "$BEFORE" 2>/dev/null; then
CHANGED=$(git diff --name-only "$BEFORE" "${{ github.sha }}")
else
CHANGED=$(git diff --name-only HEAD~1 HEAD)
fi
echo "Changed files:"
echo "$CHANGED"
if ! echo "$CHANGED" | grep -qE '^(Dockerfile|entrypoint\.sh|VERSION)$'; then
echo "No container-relevant file changed, skipping publish."
exit 0
fi
if echo "$CHANGED" | grep -qE '^VERSION$'; then
echo "VERSION was manually edited in this push, using it as-is."
else
echo "VERSION untouched but container files changed, auto-bumping the build number (Z)."
OLD_VERSION=$(tr -d '[:space:]' < VERSION)
IFS='.' read -r MAJOR MINOR PATCH <<< "$OLD_VERSION"
NEW_VERSION="${MAJOR}.${MINOR}.$((PATCH + 1))"
echo "$NEW_VERSION" > VERSION
git config user.name "socat-proxy-ci"
git config user.email "[email protected]"
git add VERSION
git commit -m "Bump build version to $NEW_VERSION [skip ci]"
# Belt and suspenders: actions/checkout can leave its own ephemeral
# credential injected as an extraheader, which would silently override
# the URL-embedded token below. persist-credentials:false on checkout
# should already prevent this, but strip it here too just in case.
git config --unset-all http.https://git.djeex.fr/.extraheader || true
git push "https://Djeex:${{ secrets.CI_PUSH_TOKEN }}@git.djeex.fr/Djeex/socat-proxy.git" HEAD:main
fi
VERSION=$(tr -d '[:space:]' < VERSION)
IFS='.' read -r MAJOR MINOR PATCH <<< "$VERSION"
MINOR_TAG="${MAJOR}.${MINOR}"
IMAGE=git.djeex.fr/djeex/socat-proxy
echo "${{ secrets.REGISTRY_TOKEN }}" | docker login git.djeex.fr -u Djeex --password-stdin
# Retag the already-built, already-scanned image — never rebuild for publish,
# so what ships is byte-for-byte what Trivy just scanned.
docker tag socat-proxy:ci "$IMAGE:latest"
docker tag socat-proxy:ci "$IMAGE:$MINOR_TAG"
docker tag socat-proxy:ci "$IMAGE:$VERSION"
docker push "$IMAGE:latest"
docker push "$IMAGE:$MINOR_TAG"
docker push "$IMAGE:$VERSION"
TRIGGER_MSG=$(git log -1 --format=%s "${{ github.sha }}")
PR_NUM=$(echo "$TRIGGER_MSG" | grep -oE '#[0-9]+' | head -1 | tr -d '#' || true)
CATEGORY="🔧 Maintenance"
CHANGE_TITLE="$TRIGGER_MSG"
if [ -n "$PR_NUM" ]; then
PR_JSON=$(curl -s -H "Authorization: token ${{ secrets.CI_PUSH_TOKEN }}" \
"https://git.djeex.fr/api/v1/repos/Djeex/socat-proxy/pulls/$PR_NUM")
PR_TITLE=$(echo "$PR_JSON" | jq -r '.title // empty' 2>/dev/null || true)
LABELS=$(echo "$PR_JSON" | jq -r '.labels[]?.name' 2>/dev/null || true)
if [ -n "$PR_TITLE" ]; then
CHANGE_TITLE="$PR_TITLE"
fi
if echo "$LABELS" | grep -qx 'bug'; then
CATEGORY="⚠️ Hotfix"
elif echo "$LABELS" | grep -qx 'major'; then
CATEGORY="💥 Breaking change"
elif echo "$LABELS" | grep -qx 'minor'; then
CATEGORY="✨ Update"
fi
fi
CHANGED_LIST=$(echo "$CHANGED" | sed 's/^/- /')
REPO_URL="https://git.djeex.fr/Djeex/socat-proxy"
SHORT_SHA=$(echo "${{ github.sha }}" | cut -c1-7)
SOURCE_LINE="[${SHORT_SHA}](${REPO_URL}/commit/${{ github.sha }})"
if [ -n "$PR_NUM" ]; then
SOURCE_LINE="[#${PR_NUM}](${REPO_URL}/pulls/${PR_NUM}) · ${SOURCE_LINE}"
fi
BODY=$(cat <<EOF
## Changelog
### ${CATEGORY}
${CHANGE_TITLE}
**Source:** ${SOURCE_LINE}
**Image:** \`${IMAGE}:${VERSION}\`
**Changed files:**
${CHANGED_LIST}
EOF
)
JSON_PAYLOAD=$(jq -n \
--arg tag "$VERSION" \
--arg name "$VERSION" \
--arg body "$BODY" \
'{tag_name: $tag, name: $name, target_commitish: "main", body: $body}')
curl -s -o /dev/null -w "Release API response: %{http_code}\n" -X POST \
-H "Authorization: token ${{ secrets.CI_PUSH_TOKEN }}" \
-H "Content-Type: application/json" \
-d "$JSON_PAYLOAD" \
"https://git.djeex.fr/api/v1/repos/Djeex/socat-proxy/releases"
Dockerfile
+4 -18
View File
@@ -1,26 +1,12 @@
FROM alpine:3.24.1 AS base
FROM alpine:latest
# Install socat and netcat in a single RUN command and clean up cache
RUN apk add --no-cache socat netcat-openbsd \
&& rm -rf /var/cache/apk/* /tmp/*
COPY entrypoint.sh VERSION /
# Create socket directory and copy/set permissions in single layers
COPY entrypoint.sh /entrypoint.sh
RUN mkdir -p /socket \
&& chmod +x /entrypoint.sh
FROM base AS test
RUN apk add --no-cache bats bash procps
WORKDIR /app
COPY entrypoint.sh VERSION /app/
COPY tests/ /app/tests/
FROM base AS lint
RUN apk add --no-cache shellcheck
RUN shellcheck --severity=error -s sh /entrypoint.sh
# Kept as the last stage so `docker build .` (no --target) still produces
# the lean prod image, not the `test`/`lint` stages above.
FROM base
ENTRYPOINT ["/entrypoint.sh"]
README.MD
+29 -114
View File
@@ -2,43 +2,17 @@
A lightweight Docker container that creates a UNIX socket proxy to TCP connections using socat and Alpine Linux.
> [!NOTE]
>_Github repo is a mirror of https://git.djeex.fr/Djeex/socat-proxy. You'll find full package, history and release note there._
## 📑 Table of Contents
- [🚀 Features](#-features)
- [🔧 How It Works](#-how-it-works)
- [📋 Use Case](#-use-case)
- [🛠️ Configuration](#️-configuration)
- [Environment Variables](#environment-variables)
- [🚢 Quick Start](#-quick-start)
- [Using Docker Compose (Recommended)](#using-docker-compose-recommended)
- [Using Docker Run](#using-docker-run)
- [💡 Deployment example for Beszel](#-example-secure-docker-socket-access-for-host-mode-containers)
## 🚀 Features
- **Lightweight**: Based on Alpine Linux (~10-15MB image)
- **Configurable**: Environment variable driven configuration
- **Socket Management**: Automatic UNIX socket creation and cleanup
- **Production Ready**: Includes proper error handling and logging
- **Multi-variant**: Standard and minimal Docker images available
## 🔧 How It Works
## 📋 Use Cases example
1. **Socket Check**: Verifies if UNIX socket exists at startup
2. **Cleanup**: Removes existing socket file/folder if present
3. **Socket Creation**: Creates new UNIX socket using `nc -lU`
4. **Proxy Start**: Starts socat to proxy UNIX socket to TCP endpoint
## 📋 Use Case
Proxy Docker socket from a docker proxy to a container in host mode without directly exposing socket to host. For example:
[Beszel](https://beszel.dev/) is a monitoring tool that requires `network_mode: host` to function properly. This creates a security challenge: Beszel needs access to the Docker socket, but it cannot reach a containerized docker-socket-proxy due to the network isolation. Running docker-socket-proxy in host mode or exposing port to host would also be highly insecure.
**Socat-proxy solves this problem** by creating a secure bridge between host-mode containers and containerized socket proxies. It exposes a UNIX socket file on the host filesystem that Beszel can access, while securely forwarding all Docker API requests to the socket-proxy running on the bridge network.
![](https://git.djeex.fr/Djeex/socat-proxy/raw/branch/main/illustration/socat-proxy.svg)
- Proxy Docker socket from a docker proxy to a container in host mode
## 🛠️ Configuration
@@ -48,109 +22,50 @@ Proxy Docker socket from a docker proxy to a container in host mode without dire
|----------|---------|-------------|---------|
| `TARGET_HOST` | - | Target hostname/IP to proxy to | `socket-proxy-beszel` |
| `TARGET_PORT` | - | Target port to proxy to | `2375` |
| `UNIX_SOCKET_NAME` | - | Name of the socket file | `docker.sock` |
| `UNIX_SOCKET_PATH` | - | Path to UNIX socket inside container | `/socket` |
| `HOST_SOCKET_PATH` | - | Host path for socket mounting | `/docker/beszel-agent/sock` |
| `DEBUG_LEVEL` | - | Level of logs verbose | `0`,`1`,`2`,`3` |
| `UNIX_SOCKET_PATH` | - | Path to UNIX socket inside container | `/socket/docker.sock` |
| `SOCKET_PATH` | - | Host path for socket mounting | `/your/container/sock/` |
## 🚢 Quick Start
### Using Docker Compose (Recommended)
1. Create a `.env` file with your configuration:
1. Clone the repository:
```bash
TARGET_HOST= #your target host
TARGET_PORT= #your target host port
UNIX_SOCKET_NAME= #your socket file name
UNIX_SOCKET_PATH= #your socket folder path inside socat-proxy
HOST_SOCKET_PATH= #your socket folder path inside your host
DEBUG_LEVEL=1
git clone https://git.djeex.fr/Djeex/socat-proxy
cd socat-proxy
```
2. Create a `compose.yml` file:
```yaml
services:
socat-proxy:
image: git.djeex.fr/djeex/socat-proxy:latest
environment:
- TARGET_HOST=${TARGET_HOST}
- TARGET_PORT=${TARGET_PORT}
- UNIX_SOCKET_NAME=${UNIX_SOCKET_NAME}
- UNIX_SOCKET_PATH=${UNIX_SOCKET_PATH}
- HOST_SOCKET_PATH=${HOST_SOCKET_PATH}
- DEBUG_LEVEL=${DEBUG_LEVEL}
volumes:
- ${HOST_SOCKET_PATH}:${UNIX_SOCKET_PATH}
restart: unless-stopped
2. Configure environment variables in `.env` file:
```bash
TARGET_HOST= # Target hostname/IP to proxy to
TARGET_PORT= # Target port to proxy to
UNIX_SOCKET_PATH= # Path to UNIX socket inside container
HOST_SOCKET_PATH= # Host path for socket mounting
```
3. Start the service:
```bash
docker compose up -d
docker-compose up -d
```
### Using Docker Run
```bash
docker build -t socat-proxy .
docker run -d \
--name socat-proxy \
-e TARGET_HOST= #your target host \
-e TARGET_PORT= #your target host port \
-e UNIX_SOCKET_NAME= #your socket file name \
-e UNIX_SOCKET_PATH= #your socket folder path inside socat-proxy \
-e HOST_SOCKET_PATH= #your socket folder path inside your host\
-e DEBUG_LEVEL=1 \
-v ${HOST_SOCKET_PATH}:${UNIX_SOCKET_PATH}$ \
git.djeex.fr/djeex/socat-proxy:latest
-e TARGET_HOST=your-target-host \
-e TARGET_PORT=your-target-port \
-e UNIX_SOCKET_PATH=your-unix-socket-path \
-e HOST_SOCKET_PATH=your-socket-host-path \
-v /your-origin-socket-path:/socket \
socat-proxy
```
## 🔧 How It Works
## 💡 Deployment example for Beszel
```yaml
services:
socat-proxy:
image: git.djeex.fr/djeex/socat-proxy:latest
container_name: socat-proxy-beszel
environment:
- TARGET_HOST=${TARGET_HOST}
- TARGET_PORT=${TARGET_PORT}
- UNIX_SOCKET_PATH=${UNIX_SOCKET_PATH}
- HOST_SOCKET_PATH=${HOST_SOCKET_PATH}
- UNIX_SOCKET_NAME=${UNIX_SOCKET_NAME}
volumes:
- ${HOST_SOCKET_PATH}:${UNIX_SOCKET_PATH}
restart: unless-stopped
depends_on:
- ${TARGET_HOST}
socket-proxy:
image: lscr.io/linuxserver/socket-proxy:latest
container_name: ${TARGET_HOST}
security_opt:
- no-new-privileges:true
environment:
- CONTAINERS=1
- INFO=1
volumes:
- /var/run/docker.sock:/var/run/docker.sock:ro
restart: unless-stopped
read_only: true
tmpfs:
- /run
beszel-agent:
image: henrygd/beszel-agent:latest
container_name: beszel-agent
restart: unless-stopped
network_mode: host
security_opt:
- no-new-privileges:true
volumes:
- ${HOST_SOCKET_PATH}/${UNIX_SOCKET_NAME}:/var/run/docker.sock:ro
environment:
- #... your Beszel environment var
depends_on:
- socat-proxy
```
1. **Socket Check**: Verifies if UNIX socket exists at startup
2. **Cleanup**: Removes existing socket file/folder if present
3. **Socket Creation**: Creates new UNIX socket using `nc -lU`
4. **Proxy Start**: Starts socat to proxy UNIX socket to TCP endpoint
VERSION
+1 -1
View File
@@ -1 +1 @@
1.0.1
0.1
docker-compose.yaml
+14 -6
View File
@@ -1,13 +1,21 @@
---
version: '3.8'
services:
socat-proxy:
build: .
environment:
- TARGET_HOST=${TARGET_HOST}
- TARGET_PORT=${TARGET_PORT}
- UNIX_SOCKET_NAME=${UNIX_SOCKET_NAME}
- TARGET_HOST=${TARGET_HOST:}
- TARGET_PORT=${TARGET_PORT:}
- UNIX_SOCKET_PATH=${UNIX_SOCKET_PATH}
- HOST_SOCKET_PATH=${HOST_SOCKET_PATH}
volumes:
- ${HOST_SOCKET_PATH}:${UNIX_SOCKET_PATH}
- ${HOST_SOCKET_PATH:-/tmp/docker-proxy}:/socket
networks:
- proxy-network
restart: unless-stopped
volumes:
socket_volume:
networks:
proxy-network:
external: false
entrypoint.sh
+47 -88
View File
@@ -1,145 +1,103 @@
#!/bin/sh
set -e
CYAN="\033[1;36m"
NC="\033[0m"
DEBUG_LEVEL=${DEBUG_LEVEL:-1}
UNIX_SOCKET_PATH=${UNIX_SOCKET_PATH%/}
HOST_SOCKET_PATH=${HOST_SOCKET_PATH%/}
FULL_HOST_SOCKET_PATH="$HOST_SOCKET_PATH/$UNIX_SOCKET_NAME"
FULL_UNIX_SOCKET_PATH="$UNIX_SOCKET_PATH/$UNIX_SOCKET_NAME"
VERSION=$(cat VERSION)
echo -e "${CYAN}╭────────────────────────────────────────────────╮${NC}"
echo -e "${CYAN}│${NC} Socat-proxy - Version ${VERSION}${NC} ${CYAN}│${NC}"
echo -e "${CYAN}├────────────────────────────────────────────────┤${NC}"
echo -e "${CYAN}│${NC} Source: https://git.djeex.fr/Djeex/socat-proxy ${CYAN}│${NC}"
echo -e "${CYAN}│${NC} Mirror: https://github.com/Djeex/socat-proxy ${CYAN}│${NC}"
echo -e "${CYAN}╰────────────────────────────────────────────────╯${NC}"
# Set default values if not provided
TARGET_HOST=${TARGET_HOST}
TARGET_PORT=${TARGET_PORT}
UNIX_SOCKET_PATH=${UNIX_SOCKET_PATH}
UNIX_SOCKET_NAME=$(basename "$UNIX_SOCKET_PATH")
HOST_SOCKET_PATH=${HOST_SOCKET_PATH}
# Validate required environment variables
if [ -z "$TARGET_HOST" ]; then
echo "[✗] TARGET_HOST environment variable is required"
echo "ERROR: TARGET_HOST environment variable is required"
exit 1
fi
if [ -z "$TARGET_PORT" ]; then
echo "[✗] TARGET_PORT environment variable is required"
exit 1
fi
if [ -z "$UNIX_SOCKET_NAME" ]; then
echo "[✗] UNIX_SOCKET_NAME environment variable is required"
echo "ERROR: TARGET_PORT environment variable is required"
exit 1
fi
if [ -z "$UNIX_SOCKET_PATH" ]; then
echo "[✗] UNIX_SOCKET_PATH environment variable is required"
echo "ERROR: UNIX_SOCKET_PATH environment variable is required"
exit 1
fi
if [ -z "$HOST_SOCKET_PATH" ]; then
echo "[✗] HOST_SOCKET_PATH environment variable is required"
echo "ERROR: HOST_SOCKET_PATH environment variable is required"
exit 1
fi
echo "[~] Starting socat proxy..."
echo "[i] TCP target: $TARGET_HOST:$TARGET_PORT"
echo "[i] HOST path: $HOST_SOCKET_PATH"
echo "[i] Full host socket path: $FULL_HOST_SOCKET_PATH"
echo "[i] Full socket path: $FULL_UNIX_SOCKET_PATH"
echo "Starting socat proxy..."
echo "UNIX socket: $UNIX_SOCKET_PATH"
echo "TCP target: $TARGET_HOST:$TARGET_PORT"
echo "HOST path: $HOST_SOCKET_PATH"
echo "Socket name: $UNIX_SOCKET_NAME"
# Calculate full socket path
FULL_SOCKET_PATH="$HOST_SOCKET_PATH/$UNIX_SOCKET_NAME"
echo "Full socket path: $FULL_SOCKET_PATH"
# Check if socket file/folder exists and handle it
if [ -e "$FULL_UNIX_SOCKET_PATH" ]; then
echo "[~] Socket file/folder $FULL_UNIX_SOCKET_PATH exists, removing it..."
if rm -rf "$FULL_UNIX_SOCKET_PATH"; then
echo "[✓] Removed existing socket $FULL_UNIX_SOCKET_PATH"
if [ -e "$FULL_SOCKET_PATH" ]; then
echo "Socket file/folder $FULL_SOCKET_PATH exists, removing it..."
if rm -rf "$FULL_SOCKET_PATH"; then
echo "SUCCESS: Removed existing socket $FULL_SOCKET_PATH"
else
echo "[✗] Failed to remove existing socket $FULL_UNIX_SOCKET_PATH"
echo "ERROR: Failed to remove existing socket $FULL_SOCKET_PATH"
exit 1
fi
fi
echo "[~] Creating socket directory structure..."
echo "Creating socket directory structure..."
# Create directory if needed
if mkdir -p "$UNIX_SOCKET_PATH"; then
echo "[✓] Created directory $UNIX_SOCKET_PATH"
if mkdir -p "$HOST_SOCKET_PATH"; then
echo "SUCCESS: Created directory $HOST_SOCKET_PATH"
else
echo "[✗] Failed to create directory $UNIX_SOCKET_PATH"
echo "ERROR: Failed to create directory $HOST_SOCKET_PATH"
exit 1
fi
echo "[~] Creating socket with netcat..."
# Create socket file by touching it, then remove it (this creates the path but leaves it clean for socat)
touch "$FULL_UNIX_SOCKET_PATH"
rm "$FULL_UNIX_SOCKET_PATH"
echo "[✓] Socket path prepared at $FULL_UNIX_SOCKET_PATH"
# Debug: Check if socket file exists and its permissions
if [ -S "$FULL_UNIX_SOCKET_PATH" ]; then
echo "[✓] Socket file exists and is a socket"
ls -la "$FULL_UNIX_SOCKET_PATH"
echo "Creating socket with netcat..."
# Create socket with nc -lU in background and then kill it to create the socket file
if timeout 1 nc -lU "$FULL_SOCKET_PATH" 2>/dev/null || true; then
echo "SUCCESS: Socket created at $FULL_SOCKET_PATH"
else
echo "[!] Socket file does not exist or is not a socket"
ls -la "$UNIX_SOCKET_PATH"
echo "WARNING: Socket creation with netcat had issues, but continuing..."
fi
echo "[~] Testing connection to target..."
echo "Testing connection to target..."
# Test if we can reach the target before starting socat
if ! nc -z "$TARGET_HOST" "$TARGET_PORT" 2>/dev/null; then
echo "[!] Cannot connect to $TARGET_HOST:$TARGET_PORT - socat will retry automatically"
echo "WARNING: Cannot connect to $TARGET_HOST:$TARGET_PORT - socat will retry automatically"
else
echo "[✓] Connection to $TARGET_HOST:$TARGET_PORT is working"
echo "SUCCESS: Connection to $TARGET_HOST:$TARGET_PORT is working"
fi
# Signal handler for graceful shutdown
cleanup() {
echo "[!] Received SIGTERM, shutting down gracefully..."
echo "Received SIGTERM, shutting down gracefully..."
if [ ! -z "$SOCAT_PID" ]; then
echo "[~] Stopping socat process (PID: $SOCAT_PID)..."
echo "Stopping socat process (PID: $SOCAT_PID)..."
kill "$SOCAT_PID" 2>/dev/null || true
wait "$SOCAT_PID" 2>/dev/null || true
fi
echo "[~] Cleanup completed, exiting..."
echo "Cleanup completed, exiting..."
exit 0
}
# Set up signal trap
trap cleanup SIGTERM SIGINT
echo "[~] Starting socat proxy..."
# Start socat with configurable verbosity
DEBUG_FLAGS=""
if [ "$DEBUG_LEVEL" -eq 1 ]; then
DEBUG_FLAGS="-d"
elif [ "$DEBUG_LEVEL" -eq 2 ]; then
DEBUG_FLAGS="-d -d"
elif [ "$DEBUG_LEVEL" -eq 3 ]; then
DEBUG_FLAGS="-d -d -d"
fi
echo "[i] Using debug level: $DEBUG_LEVEL ($DEBUG_FLAGS)"
if socat $DEBUG_FLAGS UNIX-LISTEN:$FULL_UNIX_SOCKET_PATH,fork,unlink-early TCP:$TARGET_HOST:$TARGET_PORT & then
echo "Starting socat proxy..."
# Start socat with verbose logging and redirect to stdout/stderr
if socat -d -d UNIX-LISTEN:$FULL_SOCKET_PATH,fork,unlink-early TCP:$TARGET_HOST:$TARGET_PORT & then
SOCAT_PID=$!
echo "[✓] Socat started with PID: $SOCAT_PID"
echo "[i] Socat command: socat -d -d UNIX-LISTEN:$FULL_UNIX_SOCKET_PATH,fork,unlink-early TCP:$TARGET_HOST:$TARGET_PORT"
echo "[~] Container is ready and running..."
# Debug: Check socket after socat starts
sleep 2
if [ -S "$FULL_UNIX_SOCKET_PATH" ]; then
echo "[✓] Socat socket is active"
ls -la "$FULL_UNIX_SOCKET_PATH"
else
echo "[!] Socat socket not found"
fi
echo "SUCCESS: Socat started with PID: $SOCAT_PID"
echo "Container is ready and running..."
else
echo "[✗] Failed to start socat proxy"
echo "ERROR: Failed to start socat proxy"
exit 1
fi
@@ -148,5 +106,6 @@ while kill -0 "$SOCAT_PID" 2>/dev/null; do
sleep 1
done
echo "[✗] Socat process has stopped"
echo "Socat process has stopped"
exit 1
illustration/socat-proxy.svg
-4
View File
File diff suppressed because one or more lines are too long
Side by Side

Before

Width:  |  Height:  |  Size: 436 KiB

renovate.json
-25
View File
@@ -1,25 +0,0 @@
{
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
"extends": ["config:recommended"],
"timezone": "Europe/Paris",
"labels": ["bot"],
"packageRules": [
{
"matchManagers": ["dockerfile"],
"matchUpdateTypes": ["patch"],
"automerge": true
},
{
"matchUpdateTypes": ["major"],
"addLabels": ["major"]
},
{
"matchUpdateTypes": ["minor"],
"addLabels": ["minor"]
}
],
"vulnerabilityAlerts": {
"enabled": true,
"addLabels": ["bug"]
}
}
tests/entrypoint.bats
-223
View File
@@ -1,223 +0,0 @@
#!/usr/bin/env bats
#
# Behavioral tests for entrypoint.sh.
#
# Strategy: run the real entrypoint.sh (real socat/nc, no mocks) against a
# throwaway TCP target and a scratch socket directory, so what's exercised
# matches production exactly. UNIX-LISTEN binds immediately without the TCP
# target being reachable, so TARGET_HOST/TARGET_PORT can safely point at
# nothing for most tests.
#
# Process PIDs are looked up on demand via `pgrep -f` against a unique,
# per-test path/name rather than captured with `$!` — under bats-core's own
# subshell/job-control plumbing, `$!` does not reliably resolve to the
# process actually started here.
setup() {
TEST_DIR="$(mktemp -d)"
cp "$BATS_TEST_DIRNAME/../entrypoint.sh" "$TEST_DIR/"
cp "$BATS_TEST_DIRNAME/../VERSION" "$TEST_DIR/"
chmod +x "$TEST_DIR/entrypoint.sh"
export TARGET_HOST=127.0.0.1
export TARGET_PORT=1
export UNIX_SOCKET_NAME="test-$BATS_TEST_NUMBER.sock"
export UNIX_SOCKET_PATH="$TEST_DIR/socket"
export HOST_SOCKET_PATH="$TEST_DIR/host"
unset DEBUG_LEVEL
}
teardown() {
pkill -9 -f "$TEST_DIR/entrypoint.sh" 2>/dev/null
pkill -9 -f "UNIX-LISTEN:.*$UNIX_SOCKET_NAME" 2>/dev/null
pkill -9 -f "nc .*34599" 2>/dev/null
rm -rf "$TEST_DIR"
}
run_entrypoint_bg() {
LOG="$TEST_DIR/out.log"
( cd "$TEST_DIR" && exec ./entrypoint.sh >"$LOG" 2>&1 ) &
disown 2>/dev/null || true
}
entrypoint_pid() {
pgrep -f "$TEST_DIR/entrypoint.sh" | head -n1
}
socat_pid() {
pgrep -f "UNIX-LISTEN:.*$UNIX_SOCKET_NAME" | head -n1
}
wait_for_log() {
pattern="$1"
tries=0
while [ "$tries" -lt 20 ]; do
grep -qE "$pattern" "$LOG" 2>/dev/null && return 0
tries=$((tries + 1))
sleep 0.25
done
return 1
}
wait_for_pid_gone() {
pid="$1"
tries=0
while kill -0 "$pid" 2>/dev/null && [ "$tries" -lt 20 ]; do
tries=$((tries + 1))
sleep 0.25
done
! kill -0 "$pid" 2>/dev/null
}
# ---- Environment variable validation -------------------------------------
@test "fails when TARGET_HOST is missing" {
unset TARGET_HOST
run "$TEST_DIR/entrypoint.sh"
[ "$status" -eq 1 ]
[[ "$output" == *"TARGET_HOST environment variable is required"* ]]
}
@test "fails when TARGET_PORT is missing" {
unset TARGET_PORT
run "$TEST_DIR/entrypoint.sh"
[ "$status" -eq 1 ]
[[ "$output" == *"TARGET_PORT environment variable is required"* ]]
}
@test "fails when UNIX_SOCKET_NAME is missing" {
unset UNIX_SOCKET_NAME
run "$TEST_DIR/entrypoint.sh"
[ "$status" -eq 1 ]
[[ "$output" == *"UNIX_SOCKET_NAME environment variable is required"* ]]
}
@test "fails when UNIX_SOCKET_PATH is missing" {
unset UNIX_SOCKET_PATH
run "$TEST_DIR/entrypoint.sh"
[ "$status" -eq 1 ]
[[ "$output" == *"UNIX_SOCKET_PATH environment variable is required"* ]]
}
@test "fails when HOST_SOCKET_PATH is missing" {
unset HOST_SOCKET_PATH
run "$TEST_DIR/entrypoint.sh"
[ "$status" -eq 1 ]
[[ "$output" == *"HOST_SOCKET_PATH environment variable is required"* ]]
}
@test "prints the version banner from the VERSION file" {
echo "9.9.9" > "$TEST_DIR/VERSION"
run_entrypoint_bg
wait_for_log "Socat socket is active|Socat socket not found"
grep -q "Version 9.9.9" "$LOG"
}
# ---- Socket path preparation ----------------------------------------------
@test "removes a pre-existing file at the socket path before starting" {
mkdir -p "$UNIX_SOCKET_PATH"
touch "$UNIX_SOCKET_PATH/$UNIX_SOCKET_NAME"
run_entrypoint_bg
wait_for_log "Socat socket is active|Socat socket not found"
grep -q "exists, removing it" "$LOG"
grep -q "Removed existing socket" "$LOG"
}
@test "creates the socket directory when it does not exist" {
[ ! -d "$UNIX_SOCKET_PATH" ]
run_entrypoint_bg
wait_for_log "Socat socket is active|Socat socket not found"
grep -q "Created directory $UNIX_SOCKET_PATH" "$LOG"
[ -d "$UNIX_SOCKET_PATH" ]
}
@test "reports the socat-created socket as active once it is listening" {
run_entrypoint_bg
wait_for_log "Socat socket is active|Socat socket not found"
grep -q "Socat socket is active" "$LOG"
[ -S "$UNIX_SOCKET_PATH/$UNIX_SOCKET_NAME" ]
}
# ---- Target connectivity check (informational, non-fatal) -----------------
@test "warns but continues when the TCP target is unreachable" {
export TARGET_PORT=1
run_entrypoint_bg
wait_for_log "Socat socket is active|Socat socket not found"
grep -q "Cannot connect to $TARGET_HOST:$TARGET_PORT" "$LOG"
grep -q "Container is ready and running" "$LOG"
}
@test "reports success when the TCP target is reachable" {
( nc -l 127.0.0.1 34599 >/dev/null 2>&1 & )
disown 2>/dev/null || true
sleep 0.3
export TARGET_PORT=34599
run_entrypoint_bg
wait_for_log "Socat socket is active|Socat socket not found"
grep -q "Connection to $TARGET_HOST:$TARGET_PORT is working" "$LOG"
}
# ---- Debug level -> socat flags mapping -----------------------------------
@test "maps an unset DEBUG_LEVEL default of 1 to a single -d flag" {
run_entrypoint_bg
wait_for_log "Using debug level"
grep -q "Using debug level: 1 (-d)" "$LOG"
}
@test "maps DEBUG_LEVEL=2 to two -d flags" {
export DEBUG_LEVEL=2
run_entrypoint_bg
wait_for_log "Using debug level"
grep -q "Using debug level: 2 (-d -d)" "$LOG"
}
@test "maps DEBUG_LEVEL=3 to three -d flags" {
export DEBUG_LEVEL=3
run_entrypoint_bg
wait_for_log "Using debug level"
grep -q "Using debug level: 3 (-d -d -d)" "$LOG"
}
@test "maps an unrecognized DEBUG_LEVEL to no debug flags" {
export DEBUG_LEVEL=0
run_entrypoint_bg
wait_for_log "Using debug level"
grep -q "Using debug level: 0 ()" "$LOG"
}
# ---- Shutdown behavior ------------------------------------------------------
@test "shuts down gracefully and stops socat on SIGTERM" {
run_entrypoint_bg
wait_for_log "Socat socket is active|Socat socket not found"
ep_pid="$(entrypoint_pid)"
sc_pid="$(socat_pid)"
[ -n "$ep_pid" ]
[ -n "$sc_pid" ]
kill -TERM "$ep_pid"
wait_for_pid_gone "$ep_pid"
grep -q "Received SIGTERM, shutting down gracefully" "$LOG"
grep -q "Cleanup completed, exiting" "$LOG"
! kill -0 "$sc_pid" 2>/dev/null
}
@test "exits 1 once socat's process dies unexpectedly" {
run_entrypoint_bg
wait_for_log "Socat socket is active|Socat socket not found"
ep_pid="$(entrypoint_pid)"
sc_pid="$(socat_pid)"
[ -n "$ep_pid" ]
[ -n "$sc_pid" ]
kill -9 "$sc_pid"
wait_for_pid_gone "$ep_pid"
grep -q "Socat process has stopped" "$LOG"
}