Never expose the Docker socket: Traefik up front, an SSH tunnel for all access
BENE Maël5 min read
The Docker socket grants de facto root access to whatever machine exposes it. This post describes the pattern I set up to let a reverse proxy discover the containers on a remote Docker host without ever exposing that socket on the network: a point-to-point SSH tunnel, paired with a proxy that filters the API itself.