Skip to main content

One post tagged with "socket-proxy"

View All Tags

Never expose the Docker socket: Traefik up front, an SSH tunnel for all access

· 5 min read
BENE Maël
BENE Maël
System Administrator

The Docker socket grants de facto root access to whatever machine exposes it. This post describes the pattern I set up to let a reverse proxy discover the containers on a remote Docker host without ever exposing that socket on the network: a point-to-point SSH tunnel, paired with a proxy that filters the API itself.

Diagram: incoming traffic reaches Traefik in the DMZ zone, crosses a restricted SSH tunnel to a filtering socket-proxy in the backend zone, the only thing allowed to talk to the Docker socket