Bump build version to 1.0.1 [skip ci]

Reviewed-on: #2

.env

@@ -1,4 +1,3 @@
-# Socat Proxy Configuration
 TARGET_HOST= # Target hostname/IP to proxy to
 TARGET_PORT= # Target port to proxy to
 UNIX_SOCKET_NAME= # Name of the socket file

.gitea/workflows/ci.yml

@@ -0,0 +1,163 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: "0 6 * * 1"
+
+jobs:
+  build-and-scan:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Build Docker image
+        run: docker build -t socat-proxy:ci .
+
+      - name: Smoke test (syntax check)
+        run: docker run --rm --entrypoint sh socat-proxy:ci -n /entrypoint.sh
+
+      - name: Run unit tests
+        run: |
+          docker build --target test -t socat-proxy:test .
+          docker run --rm socat-proxy:test bats /app/tests/entrypoint.bats
+
+      - name: Lint entrypoint.sh with shellcheck
+        run: docker build --target lint -t socat-proxy:lint .
+
+      - name: Scan with Trivy (critical - blocking)
+        run: |
+          docker run --rm \
+            -e DOCKER_HOST=tcp://dockerhost:2375 \
+            --add-host=dockerhost:host-gateway \
+            aquasec/trivy:0.74.0 image --exit-code 1 --severity CRITICAL socat-proxy:ci
+
+      - name: Scan with Trivy (high - informative)
+        run: |
+          docker run --rm \
+            -e DOCKER_HOST=tcp://dockerhost:2375 \
+            --add-host=dockerhost:host-gateway \
+            aquasec/trivy:0.74.0 image --exit-code 0 --severity HIGH socat-proxy:ci
+
+      - name: Publish tagged image
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+        run: |
+          BEFORE="${{ github.event.before }}"
+          if [ -n "$BEFORE" ] && [ "$BEFORE" != "0000000000000000000000000000000000000000" ] && git cat-file -e "$BEFORE" 2>/dev/null; then
+            CHANGED=$(git diff --name-only "$BEFORE" "${{ github.sha }}")
+          else
+            CHANGED=$(git diff --name-only HEAD~1 HEAD)
+          fi
+          echo "Changed files:"
+          echo "$CHANGED"
+
+          if ! echo "$CHANGED" | grep -qE '^(Dockerfile|entrypoint\.sh|VERSION)$'; then
+            echo "No container-relevant file changed, skipping publish."
+            exit 0
+          fi
+
+          if echo "$CHANGED" | grep -qE '^VERSION$'; then
+            echo "VERSION was manually edited in this push, using it as-is."
+          else
+            echo "VERSION untouched but container files changed, auto-bumping the build number (Z)."
+            OLD_VERSION=$(tr -d '[:space:]' < VERSION)
+            IFS='.' read -r MAJOR MINOR PATCH <<< "$OLD_VERSION"
+            NEW_VERSION="${MAJOR}.${MINOR}.$((PATCH + 1))"
+            echo "$NEW_VERSION" > VERSION
+
+            git config user.name "socat-proxy-ci"
+            git config user.email "[email protected]"
+            git add VERSION
+            git commit -m "Bump build version to $NEW_VERSION [skip ci]"
+
+            # Belt and suspenders: actions/checkout can leave its own ephemeral
+            # credential injected as an extraheader, which would silently override
+            # the URL-embedded token below. persist-credentials:false on checkout
+            # should already prevent this, but strip it here too just in case.
+            git config --unset-all http.https://git.djeex.fr/.extraheader || true
+
+            git push "https://Djeex:${{ secrets.CI_PUSH_TOKEN }}@git.djeex.fr/Djeex/socat-proxy.git" HEAD:main
+          fi
+
+          VERSION=$(tr -d '[:space:]' < VERSION)
+          IFS='.' read -r MAJOR MINOR PATCH <<< "$VERSION"
+          MINOR_TAG="${MAJOR}.${MINOR}"
+
+          IMAGE=git.djeex.fr/djeex/socat-proxy
+          echo "${{ secrets.REGISTRY_TOKEN }}" | docker login git.djeex.fr -u Djeex --password-stdin
+
+          # Retag the already-built, already-scanned image — never rebuild for publish,
+          # so what ships is byte-for-byte what Trivy just scanned.
+          docker tag socat-proxy:ci "$IMAGE:latest"
+          docker tag socat-proxy:ci "$IMAGE:$MINOR_TAG"
+          docker tag socat-proxy:ci "$IMAGE:$VERSION"
+          docker push "$IMAGE:latest"
+          docker push "$IMAGE:$MINOR_TAG"
+          docker push "$IMAGE:$VERSION"
+
+          TRIGGER_MSG=$(git log -1 --format=%s "${{ github.sha }}")
+          PR_NUM=$(echo "$TRIGGER_MSG" | grep -oE '#[0-9]+' | head -1 | tr -d '#' || true)
+
+          CATEGORY="🔧 Maintenance"
+          CHANGE_TITLE="$TRIGGER_MSG"
+
+          if [ -n "$PR_NUM" ]; then
+            PR_JSON=$(curl -s -H "Authorization: token ${{ secrets.CI_PUSH_TOKEN }}" \
+              "https://git.djeex.fr/api/v1/repos/Djeex/socat-proxy/pulls/$PR_NUM")
+            PR_TITLE=$(echo "$PR_JSON" | jq -r '.title // empty' 2>/dev/null || true)
+            LABELS=$(echo "$PR_JSON" | jq -r '.labels[]?.name' 2>/dev/null || true)
+
+            if [ -n "$PR_TITLE" ]; then
+              CHANGE_TITLE="$PR_TITLE"
+            fi
+
+            if echo "$LABELS" | grep -qx 'bug'; then
+              CATEGORY="⚠️ Hotfix"
+            elif echo "$LABELS" | grep -qx 'major'; then
+              CATEGORY="💥 Breaking change"
+            elif echo "$LABELS" | grep -qx 'minor'; then
+              CATEGORY="✨ Update"
+            fi
+          fi
+
+          CHANGED_LIST=$(echo "$CHANGED" | sed 's/^/- /')
+
+          REPO_URL="https://git.djeex.fr/Djeex/socat-proxy"
+          SHORT_SHA=$(echo "${{ github.sha }}" | cut -c1-7)
+          SOURCE_LINE="[${SHORT_SHA}](${REPO_URL}/commit/${{ github.sha }})"
+          if [ -n "$PR_NUM" ]; then
+            SOURCE_LINE="[#${PR_NUM}](${REPO_URL}/pulls/${PR_NUM}) · ${SOURCE_LINE}"
+          fi
+
+          BODY=$(cat <<EOF
+          ## Changelog
+
+          ### ${CATEGORY}
+          ${CHANGE_TITLE}
+
+          **Source:** ${SOURCE_LINE}
+          **Image:** \`${IMAGE}:${VERSION}\`
+
+          **Changed files:**
+          ${CHANGED_LIST}
+          EOF
+          )
+
+          JSON_PAYLOAD=$(jq -n \
+            --arg tag "$VERSION" \
+            --arg name "$VERSION" \
+            --arg body "$BODY" \
+            '{tag_name: $tag, name: $name, target_commitish: "main", body: $body}')
+
+          curl -s -o /dev/null -w "Release API response: %{http_code}\n" -X POST \
+            -H "Authorization: token ${{ secrets.CI_PUSH_TOKEN }}" \
+            -H "Content-Type: application/json" \
+            -d "$JSON_PAYLOAD" \
+            "https://git.djeex.fr/api/v1/repos/Djeex/socat-proxy/releases"

Dockerfile

@@ -1,4 +1,4 @@
-FROM alpine:latest
+FROM alpine:3.24.1 AS base
 
 RUN apk add --no-cache socat netcat-openbsd \
     && rm -rf /var/cache/apk/* /tmp/*
@@ -7,4 +7,20 @@ COPY entrypoint.sh VERSION /
 RUN mkdir -p /socket \
     && chmod +x /entrypoint.sh
 
-ENTRYPOINT ["/entrypoint.sh"]
+FROM base AS test
+
+RUN apk add --no-cache bats bash procps
+
+WORKDIR /app
+COPY entrypoint.sh VERSION /app/
+COPY tests/ /app/tests/
+
+FROM base AS lint
+
+RUN apk add --no-cache shellcheck
+RUN shellcheck --severity=error -s sh /entrypoint.sh
+
+# Kept as the last stage so `docker build .` (no --target) still produces
+# the lean prod image, not the `test`/`lint` stages above.
+FROM base
+ENTRYPOINT ["/entrypoint.sh"]

README.MD

@@ -2,17 +2,20 @@
 
 A lightweight Docker container that creates a UNIX socket proxy to TCP connections using socat and Alpine Linux.
 
+> [!NOTE]
+>_Github repo is a mirror of https://git.djeex.fr/Djeex/socat-proxy. You'll find full package, history and release note there._
+
 ## 📑 Table of Contents
 
 - [🚀 Features](#-features)
+- [🔧 How It Works](#-how-it-works)
 - [📋 Use Case](#-use-case)
 - [🛠️ Configuration](#️-configuration)
   - [Environment Variables](#environment-variables)
 - [🚢 Quick Start](#-quick-start)
   - [Using Docker Compose (Recommended)](#using-docker-compose-recommended)
   - [Using Docker Run](#using-docker-run)
-- [🔧 How It Works](#-how-it-works)
-- [💡 Example: Secure Docker Socket Access for Host-Mode Containers](#-example-secure-docker-socket-access-for-host-mode-containers)
+- [💡 Deployment example for Beszel](#-example-secure-docker-socket-access-for-host-mode-containers)
 
 ## 🚀 Features
 
@@ -20,9 +23,22 @@ A lightweight Docker container that creates a UNIX socket proxy to TCP connectio
 - **Socket Management**: Automatic UNIX socket creation and cleanup
 - **Production Ready**: Includes proper error handling and logging
 
+## 🔧 How It Works
+
+1. **Socket Check**: Verifies if UNIX socket exists at startup
+2. **Cleanup**: Removes existing socket file/folder if present
+3. **Socket Creation**: Creates new UNIX socket using `nc -lU`
+4. **Proxy Start**: Starts socat to proxy UNIX socket to TCP endpoint
+
 ## 📋 Use Case
 
-- Proxy Docker socket from a docker proxy to a container in host mode without directly exposing socket to host
+Proxy Docker socket from a docker proxy to a container in host mode without directly exposing socket to host. For example:
+
+[Beszel](https://beszel.dev/) is a monitoring tool that requires `network_mode: host` to function properly. This creates a security challenge: Beszel needs access to the Docker socket, but it cannot reach a containerized docker-socket-proxy due to the network isolation. Running docker-socket-proxy in host mode or exposing port to host would also be highly insecure.
+
+**Socat-proxy solves this problem** by creating a secure bridge between host-mode containers and containerized socket proxies. It exposes a UNIX socket file on the host filesystem that Beszel can access, while securely forwarding all Docker API requests to the socket-proxy running on the bridge network.
+
+![](https://git.djeex.fr/Djeex/socat-proxy/raw/branch/main/illustration/socat-proxy.svg)
 
 ## 🛠️ Configuration
 
@@ -43,13 +59,12 @@ A lightweight Docker container that creates a UNIX socket proxy to TCP connectio
 
 1. Create a `.env` file with your configuration:
 ```bash
-# .env
-TARGET_HOST=socket-proxy-beszel
-TARGET_PORT=2375
-UNIX_SOCKET_NAME=docker.sock
-UNIX_SOCKET_PATH=/socket
-HOST_SOCKET_PATH=/docker/beszel-agent/sock
-DEBUG_LEVEL=0
+TARGET_HOST= #your target host
+TARGET_PORT= #your target host port
+UNIX_SOCKET_NAME= #your socket file name
+UNIX_SOCKET_PATH= #your socket folder path inside socat-proxy
+HOST_SOCKET_PATH= #your socket folder path inside your host
+DEBUG_LEVEL=1
 ```
 
 2. Create a `compose.yml` file:
@@ -79,28 +94,18 @@ docker compose up -d
 ```bash
 docker run -d \
   --name socat-proxy \
-  -e TARGET_HOST=socket-proxy-beszel \
-  -e TARGET_PORT=2375 \
-  -e UNIX_SOCKET_NAME=docker.sock \
-  -e UNIX_SOCKET_PATH=/socket \
-  -e HOST_SOCKET_PATH=/docker/beszel-agent/sock \
+  -e TARGET_HOST= #your target host \
+  -e TARGET_PORT= #your target host port \
+  -e UNIX_SOCKET_NAME= #your socket file name \
+  -e UNIX_SOCKET_PATH= #your socket folder path inside socat-proxy \
+  -e HOST_SOCKET_PATH= #your socket folder path inside your host\
   -e DEBUG_LEVEL=1 \
-  -v /docker/beszel-agent/sock:/socket \
+  -v ${HOST_SOCKET_PATH}:${UNIX_SOCKET_PATH}$ \
   git.djeex.fr/djeex/socat-proxy:latest
 ```
 
-## 🔧 How It Works
 
-1. **Socket Check**: Verifies if UNIX socket exists at startup
-2. **Cleanup**: Removes existing socket file/folder if present
-3. **Socket Creation**: Creates new UNIX socket using `nc -lU`
-4. **Proxy Start**: Starts socat to proxy UNIX socket to TCP endpoint
-
-## 💡 Example: Secure Docker Socket Access for Host-Mode Containers
-
-[Beszel](https://beszel.dev/) is a monitoring tool that requires `network_mode: host` to function properly. This creates a security challenge: Beszel needs access to the Docker socket, but it cannot reach a containerized docker-socket-proxy due to the network isolation. Running docker-socket-proxy in host mode would be highly insecure.
-
-**Socat-proxy solves this problem** by creating a secure bridge between host-mode containers and containerized socket proxies. It exposes a UNIX socket file on the host filesystem that Beszel can access, while securely forwarding all Docker API requests to the socket-proxy running on the bridge network.
+## 💡 Deployment example for Beszel
 
 ```yaml
 services:
@@ -116,10 +121,12 @@ services:
     volumes:
       - ${HOST_SOCKET_PATH}:${UNIX_SOCKET_PATH}
     restart: unless-stopped
+    depends_on:
+      - ${TARGET_HOST}
 
   socket-proxy:
     image: lscr.io/linuxserver/socket-proxy:latest
-    container_name: socket-proxy-beszel
+    container_name: ${TARGET_HOST}
     security_opt:
       - no-new-privileges:true
     environment:
@@ -140,7 +147,7 @@ services:
     security_opt:
       - no-new-privileges:true
     volumes:
-      - ${HOST_SOCKET_PATH}/docker.sock:/var/run/docker.sock:ro
+      - ${HOST_SOCKET_PATH}/${UNIX_SOCKET_NAME}:/var/run/docker.sock:ro
     environment:
       - #... your Beszel environment var 
     depends_on:

VERSION

@@ -1 +1 @@
-1.0.0
+1.0.1

entrypoint.sh

@@ -4,14 +4,7 @@ set -e
 CYAN="\033[1;36m"
 NC="\033[0m"
 
-TARGET_HOST=${TARGET_HOST}
-TARGET_PORT=${TARGET_PORT}
-UNIX_SOCKET_NAME=${UNIX_SOCKET_NAME}
-UNIX_SOCKET_PATH=${UNIX_SOCKET_PATH}
-HOST_SOCKET_PATH=${HOST_SOCKET_PATH}
-DEBUG_LEVEL=${DEBUG_LEVEL:-1}  # Default to basic logging
-
-# Remove trailing slashes to avoid double slashes
+DEBUG_LEVEL=${DEBUG_LEVEL:-1}
 UNIX_SOCKET_PATH=${UNIX_SOCKET_PATH%/}
 HOST_SOCKET_PATH=${HOST_SOCKET_PATH%/}
 

renovate.json

@@ -0,0 +1,25 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": ["config:recommended"],
+  "timezone": "Europe/Paris",
+  "labels": ["bot"],
+  "packageRules": [
+    {
+      "matchManagers": ["dockerfile"],
+      "matchUpdateTypes": ["patch"],
+      "automerge": true
+    },
+    {
+      "matchUpdateTypes": ["major"],
+      "addLabels": ["major"]
+    },
+    {
+      "matchUpdateTypes": ["minor"],
+      "addLabels": ["minor"]
+    }
+  ],
+  "vulnerabilityAlerts": {
+    "enabled": true,
+    "addLabels": ["bug"]
+  }
+}

tests/entrypoint.bats

@@ -0,0 +1,223 @@
+#!/usr/bin/env bats
+#
+# Behavioral tests for entrypoint.sh.
+#
+# Strategy: run the real entrypoint.sh (real socat/nc, no mocks) against a
+# throwaway TCP target and a scratch socket directory, so what's exercised
+# matches production exactly. UNIX-LISTEN binds immediately without the TCP
+# target being reachable, so TARGET_HOST/TARGET_PORT can safely point at
+# nothing for most tests.
+#
+# Process PIDs are looked up on demand via `pgrep -f` against a unique,
+# per-test path/name rather than captured with `$!` — under bats-core's own
+# subshell/job-control plumbing, `$!` does not reliably resolve to the
+# process actually started here.
+
+setup() {
+    TEST_DIR="$(mktemp -d)"
+    cp "$BATS_TEST_DIRNAME/../entrypoint.sh" "$TEST_DIR/"
+    cp "$BATS_TEST_DIRNAME/../VERSION" "$TEST_DIR/"
+    chmod +x "$TEST_DIR/entrypoint.sh"
+
+    export TARGET_HOST=127.0.0.1
+    export TARGET_PORT=1
+    export UNIX_SOCKET_NAME="test-$BATS_TEST_NUMBER.sock"
+    export UNIX_SOCKET_PATH="$TEST_DIR/socket"
+    export HOST_SOCKET_PATH="$TEST_DIR/host"
+    unset DEBUG_LEVEL
+}
+
+teardown() {
+    pkill -9 -f "$TEST_DIR/entrypoint.sh" 2>/dev/null
+    pkill -9 -f "UNIX-LISTEN:.*$UNIX_SOCKET_NAME" 2>/dev/null
+    pkill -9 -f "nc .*34599" 2>/dev/null
+    rm -rf "$TEST_DIR"
+}
+
+run_entrypoint_bg() {
+    LOG="$TEST_DIR/out.log"
+    ( cd "$TEST_DIR" && exec ./entrypoint.sh >"$LOG" 2>&1 ) &
+    disown 2>/dev/null || true
+}
+
+entrypoint_pid() {
+    pgrep -f "$TEST_DIR/entrypoint.sh" | head -n1
+}
+
+socat_pid() {
+    pgrep -f "UNIX-LISTEN:.*$UNIX_SOCKET_NAME" | head -n1
+}
+
+wait_for_log() {
+    pattern="$1"
+    tries=0
+    while [ "$tries" -lt 20 ]; do
+        grep -qE "$pattern" "$LOG" 2>/dev/null && return 0
+        tries=$((tries + 1))
+        sleep 0.25
+    done
+    return 1
+}
+
+wait_for_pid_gone() {
+    pid="$1"
+    tries=0
+    while kill -0 "$pid" 2>/dev/null && [ "$tries" -lt 20 ]; do
+        tries=$((tries + 1))
+        sleep 0.25
+    done
+    ! kill -0 "$pid" 2>/dev/null
+}
+
+# ---- Environment variable validation -------------------------------------
+
+@test "fails when TARGET_HOST is missing" {
+    unset TARGET_HOST
+    run "$TEST_DIR/entrypoint.sh"
+    [ "$status" -eq 1 ]
+    [[ "$output" == *"TARGET_HOST environment variable is required"* ]]
+}
+
+@test "fails when TARGET_PORT is missing" {
+    unset TARGET_PORT
+    run "$TEST_DIR/entrypoint.sh"
+    [ "$status" -eq 1 ]
+    [[ "$output" == *"TARGET_PORT environment variable is required"* ]]
+}
+
+@test "fails when UNIX_SOCKET_NAME is missing" {
+    unset UNIX_SOCKET_NAME
+    run "$TEST_DIR/entrypoint.sh"
+    [ "$status" -eq 1 ]
+    [[ "$output" == *"UNIX_SOCKET_NAME environment variable is required"* ]]
+}
+
+@test "fails when UNIX_SOCKET_PATH is missing" {
+    unset UNIX_SOCKET_PATH
+    run "$TEST_DIR/entrypoint.sh"
+    [ "$status" -eq 1 ]
+    [[ "$output" == *"UNIX_SOCKET_PATH environment variable is required"* ]]
+}
+
+@test "fails when HOST_SOCKET_PATH is missing" {
+    unset HOST_SOCKET_PATH
+    run "$TEST_DIR/entrypoint.sh"
+    [ "$status" -eq 1 ]
+    [[ "$output" == *"HOST_SOCKET_PATH environment variable is required"* ]]
+}
+
+@test "prints the version banner from the VERSION file" {
+    echo "9.9.9" > "$TEST_DIR/VERSION"
+    run_entrypoint_bg
+    wait_for_log "Socat socket is active|Socat socket not found"
+    grep -q "Version 9.9.9" "$LOG"
+}
+
+# ---- Socket path preparation ----------------------------------------------
+
+@test "removes a pre-existing file at the socket path before starting" {
+    mkdir -p "$UNIX_SOCKET_PATH"
+    touch "$UNIX_SOCKET_PATH/$UNIX_SOCKET_NAME"
+    run_entrypoint_bg
+    wait_for_log "Socat socket is active|Socat socket not found"
+    grep -q "exists, removing it" "$LOG"
+    grep -q "Removed existing socket" "$LOG"
+}
+
+@test "creates the socket directory when it does not exist" {
+    [ ! -d "$UNIX_SOCKET_PATH" ]
+    run_entrypoint_bg
+    wait_for_log "Socat socket is active|Socat socket not found"
+    grep -q "Created directory $UNIX_SOCKET_PATH" "$LOG"
+    [ -d "$UNIX_SOCKET_PATH" ]
+}
+
+@test "reports the socat-created socket as active once it is listening" {
+    run_entrypoint_bg
+    wait_for_log "Socat socket is active|Socat socket not found"
+    grep -q "Socat socket is active" "$LOG"
+    [ -S "$UNIX_SOCKET_PATH/$UNIX_SOCKET_NAME" ]
+}
+
+# ---- Target connectivity check (informational, non-fatal) -----------------
+
+@test "warns but continues when the TCP target is unreachable" {
+    export TARGET_PORT=1
+    run_entrypoint_bg
+    wait_for_log "Socat socket is active|Socat socket not found"
+    grep -q "Cannot connect to $TARGET_HOST:$TARGET_PORT" "$LOG"
+    grep -q "Container is ready and running" "$LOG"
+}
+
+@test "reports success when the TCP target is reachable" {
+    ( nc -l 127.0.0.1 34599 >/dev/null 2>&1 & )
+    disown 2>/dev/null || true
+    sleep 0.3
+    export TARGET_PORT=34599
+    run_entrypoint_bg
+    wait_for_log "Socat socket is active|Socat socket not found"
+    grep -q "Connection to $TARGET_HOST:$TARGET_PORT is working" "$LOG"
+}
+
+# ---- Debug level -> socat flags mapping -----------------------------------
+
+@test "maps an unset DEBUG_LEVEL default of 1 to a single -d flag" {
+    run_entrypoint_bg
+    wait_for_log "Using debug level"
+    grep -q "Using debug level: 1 (-d)" "$LOG"
+}
+
+@test "maps DEBUG_LEVEL=2 to two -d flags" {
+    export DEBUG_LEVEL=2
+    run_entrypoint_bg
+    wait_for_log "Using debug level"
+    grep -q "Using debug level: 2 (-d -d)" "$LOG"
+}
+
+@test "maps DEBUG_LEVEL=3 to three -d flags" {
+    export DEBUG_LEVEL=3
+    run_entrypoint_bg
+    wait_for_log "Using debug level"
+    grep -q "Using debug level: 3 (-d -d -d)" "$LOG"
+}
+
+@test "maps an unrecognized DEBUG_LEVEL to no debug flags" {
+    export DEBUG_LEVEL=0
+    run_entrypoint_bg
+    wait_for_log "Using debug level"
+    grep -q "Using debug level: 0 ()" "$LOG"
+}
+
+# ---- Shutdown behavior ------------------------------------------------------
+
+@test "shuts down gracefully and stops socat on SIGTERM" {
+    run_entrypoint_bg
+    wait_for_log "Socat socket is active|Socat socket not found"
+
+    ep_pid="$(entrypoint_pid)"
+    sc_pid="$(socat_pid)"
+    [ -n "$ep_pid" ]
+    [ -n "$sc_pid" ]
+
+    kill -TERM "$ep_pid"
+    wait_for_pid_gone "$ep_pid"
+
+    grep -q "Received SIGTERM, shutting down gracefully" "$LOG"
+    grep -q "Cleanup completed, exiting" "$LOG"
+    ! kill -0 "$sc_pid" 2>/dev/null
+}
+
+@test "exits 1 once socat's process dies unexpectedly" {
+    run_entrypoint_bg
+    wait_for_log "Socat socket is active|Socat socket not found"
+
+    ep_pid="$(entrypoint_pid)"
+    sc_pid="$(socat_pid)"
+    [ -n "$ep_pid" ]
+    [ -n "$sc_pid" ]
+
+    kill -9 "$sc_pid"
+    wait_for_pid_gone "$ep_pid"
+
+    grep -q "Socat process has stopped" "$LOG"
+}