socket-proxy docker socket proxy security traefik dozzle homepage allowlist wollomatic/socket-proxy:1 https://hub.docker.com/r/wollomatic/socket-proxy bridge false https://github.com/wollomatic/socket-proxy/issues https://github.com/wollomatic/socket-proxy https://github.com/wollomatic/socket-proxy#readme A lightweight, secure-by-default proxy for the Docker socket. Containers that need to read Docker (Traefik, Dozzle, Homepage, Telegraf, n8n) connect to this proxy over TCP instead of mounting /var/run/docker.sock themselves, and the proxy only passes through the exact API calls you allow. Everything is denied until you allow it: set "Allowed Clients" and at least the GET allowlist below, or no client will get through. Allowlists are Go regular expressions, one per HTTP method (a leading ^ and trailing $ are added for you). How other containers use it: put them on the same custom Docker network as this container (name lookup does not work on the default bridge), remove their docker.sock mount, and point them at http://socket-proxy:2375 (for example DOCKER_HOST=tcp://socket-proxy:2375). Do not publish the port to your LAN and never expose it to the internet. Traefik 2.11.31 / 3.6.1 and later also need HEAD /_ping allowed. Coming from the Tecnativa or LinuxServer docker-socket-proxy? The converter at https://socket-proxy-configurator.wollomatic.dev/ turns their environment variables into allowlists. This template runs the container as root (Extra Parameters: --user 0:0) because the image's default user (65534) cannot open the root-owned Docker socket on Unraid. It is also run read-only with all capabilities dropped. For least privilege, check the socket's group with ls -l /var/run/docker.sock and use --user 65534:<that group id> instead. Tools:Utilities Network:Management https://raw.githubusercontent.com/ccmpbll/unraid-docker-templates/refs/heads/master/templates/socket-proxy.xml https://raw.githubusercontent.com/ccmpbll/unraid-docker-templates/refs/heads/master/images/socket-proxy.png --user 0:0 --read-only --cap-drop=ALL --security-opt=no-new-privileges --memory=64m --restart=unless-stopped ###2026-10-22 - Allowed Clients: description now says no spaces, exact container names, and what the log shows when an entry is wrong ###2026-10-20 - Initial template for wollomatic/socket-proxy 1.x /var/run/docker.sock 0.0.0.0 2375 INFO 3600 true