Compare commits

4 Commits
v1.0 ... main

Author SHA1 Message Date
1f27f306a5 Fixed illustration 2025-09-26 15:35:35 +00:00
b93ff1d89f Illustration 2025-09-26 15:31:12 +00:00
3494e69c9f Better README.MD + clean up entrypoint.sh 2025-09-24 23:52:20 +02:00
4ac6cd0634 Mirror 2025-09-24 17:00:38 +02:00
4 changed files with 41 additions and 38 deletions

1
.env
View File

@@ -1,4 +1,3 @@
# Socat Proxy Configuration
TARGET_HOST= # Target hostname/IP to proxy to
TARGET_PORT= # Target port to proxy to
UNIX_SOCKET_NAME= # Name of the socket file

View File

@@ -2,17 +2,20 @@
A lightweight Docker container that creates a UNIX socket proxy to TCP connections using socat and Alpine Linux.
> [!NOTE]
>_Github repo is a mirror of https://git.djeex.fr/Djeex/socat-proxy. You'll find full package, history and release note there._
## 📑 Table of Contents
- [🚀 Features](#-features)
- [🔧 How It Works](#-how-it-works)
- [📋 Use Case](#-use-case)
- [🛠️ Configuration](#-configuration)
- [Environment Variables](#environment-variables)
- [🚢 Quick Start](#-quick-start)
- [Using Docker Compose (Recommended)](#using-docker-compose-recommended)
- [Using Docker Run](#using-docker-run)
- [🔧 How It Works](#-how-it-works)
- [💡 Example: Secure Docker Socket Access for Host-Mode Containers](#-example-secure-docker-socket-access-for-host-mode-containers)
- [💡 Deployment example for Beszel](#-example-secure-docker-socket-access-for-host-mode-containers)
## 🚀 Features
@@ -20,9 +23,22 @@ A lightweight Docker container that creates a UNIX socket proxy to TCP connectio
- **Socket Management**: Automatic UNIX socket creation and cleanup
- **Production Ready**: Includes proper error handling and logging
## 🔧 How It Works
1. **Socket Check**: Verifies if UNIX socket exists at startup
2. **Cleanup**: Removes existing socket file/folder if present
3. **Socket Creation**: Creates new UNIX socket using `nc -lU`
4. **Proxy Start**: Starts socat to proxy UNIX socket to TCP endpoint
## 📋 Use Case
- Proxy Docker socket from a docker proxy to a container in host mode without directly exposing socket to host
Proxy Docker socket from a docker proxy to a container in host mode without directly exposing socket to host. For example:
[Beszel](https://beszel.dev/) is a monitoring tool that requires `network_mode: host` to function properly. This creates a security challenge: Beszel needs access to the Docker socket, but it cannot reach a containerized docker-socket-proxy due to the network isolation. Running docker-socket-proxy in host mode or exposing port to host would also be highly insecure.
**Socat-proxy solves this problem** by creating a secure bridge between host-mode containers and containerized socket proxies. It exposes a UNIX socket file on the host filesystem that Beszel can access, while securely forwarding all Docker API requests to the socket-proxy running on the bridge network.
![](https://git.djeex.fr/Djeex/socat-proxy/raw/branch/main/illustration/socat-proxy.svg)
## 🛠️ Configuration
@@ -43,13 +59,12 @@ A lightweight Docker container that creates a UNIX socket proxy to TCP connectio
1. Create a `.env` file with your configuration:
```bash
# .env
TARGET_HOST=socket-proxy-beszel
TARGET_PORT=2375
UNIX_SOCKET_NAME=docker.sock
UNIX_SOCKET_PATH=/socket
HOST_SOCKET_PATH=/docker/beszel-agent/sock
DEBUG_LEVEL=0
TARGET_HOST= #your target host
TARGET_PORT= #your target host port
UNIX_SOCKET_NAME= #your socket file name
UNIX_SOCKET_PATH= #your socket folder path inside socat-proxy
HOST_SOCKET_PATH= #your socket folder path inside your host
DEBUG_LEVEL=1
```
2. Create a `compose.yml` file:
@@ -79,28 +94,18 @@ docker compose up -d
```bash
docker run -d \
--name socat-proxy \
-e TARGET_HOST=socket-proxy-beszel \
-e TARGET_PORT=2375 \
-e UNIX_SOCKET_NAME=docker.sock \
-e UNIX_SOCKET_PATH=/socket \
-e HOST_SOCKET_PATH=/docker/beszel-agent/sock \
-e TARGET_HOST= #your target host \
-e TARGET_PORT= #your target host port \
-e UNIX_SOCKET_NAME= #your socket file name \
-e UNIX_SOCKET_PATH= #your socket folder path inside socat-proxy \
-e HOST_SOCKET_PATH= #your socket folder path inside your host\
-e DEBUG_LEVEL=1 \
-v /docker/beszel-agent/sock:/socket \
-v ${HOST_SOCKET_PATH}:${UNIX_SOCKET_PATH}$ \
git.djeex.fr/djeex/socat-proxy:latest
```
## 🔧 How It Works
1. **Socket Check**: Verifies if UNIX socket exists at startup
2. **Cleanup**: Removes existing socket file/folder if present
3. **Socket Creation**: Creates new UNIX socket using `nc -lU`
4. **Proxy Start**: Starts socat to proxy UNIX socket to TCP endpoint
## 💡 Example: Secure Docker Socket Access for Host-Mode Containers
[Beszel](https://beszel.dev/) is a monitoring tool that requires `network_mode: host` to function properly. This creates a security challenge: Beszel needs access to the Docker socket, but it cannot reach a containerized docker-socket-proxy due to the network isolation. Running docker-socket-proxy in host mode would be highly insecure.
**Socat-proxy solves this problem** by creating a secure bridge between host-mode containers and containerized socket proxies. It exposes a UNIX socket file on the host filesystem that Beszel can access, while securely forwarding all Docker API requests to the socket-proxy running on the bridge network.
## 💡 Deployment example for Beszel
```yaml
services:
@@ -116,10 +121,12 @@ services:
volumes:
- ${HOST_SOCKET_PATH}:${UNIX_SOCKET_PATH}
restart: unless-stopped
depends_on:
- ${TARGET_HOST}
socket-proxy:
image: lscr.io/linuxserver/socket-proxy:latest
container_name: socket-proxy-beszel
container_name: ${TARGET_HOST}
security_opt:
- no-new-privileges:true
environment:
@@ -140,7 +147,7 @@ services:
security_opt:
- no-new-privileges:true
volumes:
- ${HOST_SOCKET_PATH}/docker.sock:/var/run/docker.sock:ro
- ${HOST_SOCKET_PATH}/${UNIX_SOCKET_NAME}:/var/run/docker.sock:ro
environment:
- #... your Beszel environment var
depends_on:

View File

@@ -4,14 +4,7 @@ set -e
CYAN="\033[1;36m"
NC="\033[0m"
TARGET_HOST=${TARGET_HOST}
TARGET_PORT=${TARGET_PORT}
UNIX_SOCKET_NAME=${UNIX_SOCKET_NAME}
UNIX_SOCKET_PATH=${UNIX_SOCKET_PATH}
HOST_SOCKET_PATH=${HOST_SOCKET_PATH}
DEBUG_LEVEL=${DEBUG_LEVEL:-1} # Default to basic logging
# Remove trailing slashes to avoid double slashes
DEBUG_LEVEL=${DEBUG_LEVEL:-1}
UNIX_SOCKET_PATH=${UNIX_SOCKET_PATH%/}
HOST_SOCKET_PATH=${HOST_SOCKET_PATH%/}

File diff suppressed because one or more lines are too long

After

Width:  |  Height:  |  Size: 436 KiB