Skip to content

Commit e329ca4

Browse files
wollomaticwollomatic
authored
Merge pull request #60 from wollomatic/develop
v1.9.0
2 parents 133c411 + 9f85bb1 commit e329ca4

File tree

6 files changed

+44
-15
lines changed

6 files changed

+44
-15
lines changed

‎.github/workflows/docker-image-release.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,7 @@
11
name: Build and Publish Release
2+
permissions:
3+
contents: read
4+
packages: write
25

36
on:
47
push:

‎.github/workflows/docker-image-testing.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,7 @@
11
name: Build and Publish Testing
2+
permissions:
3+
contents: read
4+
packages: write
25

36
on:
47
push:

‎Dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
# syntax=docker/dockerfile:1
2-
FROM --platform=$BUILDPLATFORM golang:1.24.5-alpine3.22 AS build
2+
FROM --platform=$BUILDPLATFORM golang:1.25.0-alpine3.22 AS build
33
WORKDIR /application
44
COPY . ./
55
ARG TARGETOS

‎README.md‎

Lines changed: 13 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
# socket-proxy
22

33
## Latest image
4-
- `wollomatic/socket-proxy:1.8.1` / `ghcr.io/wollomatic/socket-proxy:1.8.1`
4+
- `wollomatic/socket-proxy:1.9.0` / `ghcr.io/wollomatic/socket-proxy:1.9.0`
55
- `wollomatic/socket-proxy:1` / `ghcr.io/wollomatic/socket-proxy:1`
66

77
## About
@@ -33,7 +33,7 @@ You should know what you are doing. Never expose socket-proxy to a public networ
3333
The container image is available on [Docker Hub (wollomatic/socket-proxy)](https://hub.docker.com/r/wollomatic/socket-proxy)
3434
and on the [GitHub Container Registry (ghcr.io/wollomatic/socket-proxy)](https://github.com/wollomatic/socket-proxy/pkgs/container/socket-proxy).
3535

36-
To pin one specific version, use the version tag (for example, `wollomatic/socket-proxy:1.6.0` or `ghcr.io/wollomatic/socket-proxy:1.6.0`).
36+
To pin one specific version, use the version tag (for example, `wollomatic/socket-proxy:1.9.0` or `ghcr.io/wollomatic/socket-proxy:1.9.0`).
3737
To always use the most recent version, use the `1` tag (`wollomatic/socket-proxy:1` or `ghcr.io/wollomatic/socket-proxy:1`). This tag will be valid as long as there is no breaking change in the deployment.
3838

3939
There may be an additional docker image with the `testing`-tag. This image is only for testing. Likely, documentation for the `testing` image could only be found in the GitHub commit messages. It is not recommended to use the `testing` image in production.
@@ -75,7 +75,7 @@ The name of a parameter should be "-allow", followed by the HTTP method name (fo
7575

7676
It is also possible to configure the allowlist via environment variables. The variables are called "SP_ALLOW_", followed by the HTTP method (for example, `SP_ALLLOW_GET`).
7777

78-
If both commandline parameter and environment variable is configured for a particular HTTP method, the environment variable is ignored.
78+
If both commandline parameter and environment variable are configured for a particular HTTP method, the environment variable is ignored.
7979

8080
Use Go's regexp syntax to create the patterns for these parameters. To avoid insecure configurations, the characters ^ at the beginning and $ at the end of the string are automatically added. Note: invalid regexp results in program termination.
8181

@@ -159,7 +159,7 @@ services:
159159
# it is not the same as the traefik-servicenet
160160
161161
traefik:
162-
# [...] see github.com/wollomatic/traefik2-hardened for a full example
162+
# [...] see github.com/wollomatic/traefik-hardened for a full example
163163
depends_on:
164164
- dockerproxy
165165
networks:
@@ -197,7 +197,7 @@ socket-proxy can be configured via command line parameters or via environment va
197197
| Parameter | Environment Variable | Default Value | Description |
198198
|--------------------------------|----------------------------------|------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
199199
| `-allowfrom` | `SP_ALLOWFROM` | `127.0.0.1/32` | Specifies the IP addresses or hostnames (comma-separated) of the clients or the hostname of one specific client allowed to connect to the proxy. The default value is `127.0.0.1/32`, which means only localhost is allowed. This default configuration may not be useful in most cases, but it is because of a secure-by-default design. To allow all IPv4 addresses, set `-allowfrom=0.0.0.0/0`. Alternatively, hostnames can be set, for example `-allowfrom=traefik`, or `-allowfrom=traefik,dozzle`. Please remember that socket-proxy should never be exposed to a public network, regardless of this extra security layer. |
200-
| `-allowbindmountfrom` | `SP_ALLOWBINDMOUNTFROM` | (not set) | Specifies the directories (comma-separated) that are allowed as bind mount sources. If not set, no bind mount restrictions are applied. When set, only bind mounts from the specified directories or their subdirectories are allowed. Each directory must start with `/`. For example, `-allowbindmountfrom=/home,/var/log` allows bind mounts from `/home`, `/var/log`, and any subdirectories. |
200+
| `-allowbindmountfrom` | `SP_ALLOWBINDMOUNTFROM` | (not set) | Specifies the directories (comma-separated) that are allowed as bind mount sources. If not set, no bind mount restrictions are applied. When set, only bind mounts from the specified directories or their subdirectories are allowed. Each directory must start with `/`. For example, `-allowbindmountfrom=/home,/var/log` allows bind mounts from `/home`, `/var/log`, and any subdirectories. |
201201
| `-allowhealthcheck` | `SP_ALLOWHEALTHCHECK` | (not set/false) | If set, it allows the included health check binary to check the socket connection via TCP port 55555 (socket-proxy then listens on `127.0.0.1:55555/health`) |
202202
| `-listenip` | `SP_LISTENIP` | `127.0.0.1` | Specifies the IP address the server will bind on. Default is only the internal network. |
203203
| `-logjson` | `SP_LOGJSON` | (not set/false) | If set, it enables logging in JSON format. If unset, docker-proxy logs in plain text format. |
@@ -228,7 +228,9 @@ socket-proxy can be configured via command line parameters or via environment va
228228

229229
1.7 - also allow comma-separated CIDRs in `-allowfrom` (not only hostnames as in versions > 1.3)
230230

231-
1.8 - add optional bind mount restrictions (thanks [@powerman](https://github.com/powerman))
231+
1.8 - add optional bind mount restrictions (thanks [@powerman](https://github.com/powerman), [@C4tWithShell](https://github.com/C4tWithShell))
232+
233+
1.9 - add IPv6 support to `-listenip` (thanks [@op3](https://github.com/op3))
232234

233235
## License
234236
This project is licensed under the MIT License – see the [LICENSE](LICENSE) file for details.
@@ -241,3 +243,8 @@ See the comments in this file and the LICENSE file for more information.
241243
+ [Chris Wiegman: Protecting Your Docker Socket With Traefik 2](https://chriswiegman.com/2019/11/protecting-your-docker-socket-with-traefik-2/) [@ChrisWiegman](https://github.com/ChrisWiegman)
242244
+ [tecnativa/docker-socket-proxy](https://github.com/Tecnativa/docker-socket-proxy)
243245
+ [@justsomescripts](https://github.com/justsomescripts) fix parsing environment variable to configure unix socket
246+
247+
## Alternatives
248+
249+
+ [hectorm/cetusguard](https://github.com/hectorm/cetusguard)
250+
+ [11notes/docker-socket-proxy](https://github.com/11notes/docker-socket-proxy)

‎cmd/socket-proxy/main.go‎

Lines changed: 12 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@ import (
1212
"os"
1313
"os/signal"
1414
"runtime"
15+
"strings"
1516
"syscall"
1617
"time"
1718

@@ -58,18 +59,26 @@ func main() {
5859
// print configuration
5960
slog.Info("starting socket-proxy", "version", version, "os", runtime.GOOS, "arch", runtime.GOARCH, "runtime", runtime.Version(), "URL", programURL)
6061
if cfg.ProxySocketEndpoint == "" {
61-
slog.Info("configuration info", "socketpath", cfg.SocketPath, "listenaddress", cfg.ListenAddress, "loglevel", cfg.LogLevel, "logjson", cfg.LogJSON, "allowfrom", cfg.AllowFrom, "shutdowngracetime", cfg.ShutdownGraceTime, "allowbindmountfrom", cfg.AllowBindMountFrom)
62+
// join the cfg.AllowFrom slice to a string to avoid the brackets in the logging (avoid confusion with IPv6 addresses)
63+
allowFromString := strings.Join(cfg.AllowFrom, ",")
64+
slog.Info("configuration info", "socketpath", cfg.SocketPath, "listenaddress", cfg.ListenAddress, "loglevel", cfg.LogLevel, "logjson", cfg.LogJSON, "allowfrom", allowFromString, "shutdowngracetime", cfg.ShutdownGraceTime)
6265
} else {
63-
slog.Info("configuration info", "socketpath", cfg.SocketPath, "proxysocketendpoint", cfg.ProxySocketEndpoint, "proxysocketendpointfilemode", cfg.ProxySocketEndpointFileMode, "loglevel", cfg.LogLevel, "logjson", cfg.LogJSON, "allowfrom", cfg.AllowFrom, "shutdowngracetime", cfg.ShutdownGraceTime, "allowbindmountfrom", cfg.AllowBindMountFrom)
66+
slog.Info("configuration info", "socketpath", cfg.SocketPath, "proxysocketendpoint", cfg.ProxySocketEndpoint, "proxysocketendpointfilemode", cfg.ProxySocketEndpointFileMode, "loglevel", cfg.LogLevel, "logjson", cfg.LogJSON, "shutdowngracetime", cfg.ShutdownGraceTime)
6467
slog.Info("proxysocketendpoint is set, so the TCP listener is deactivated")
6568
}
6669
if cfg.WatchdogInterval > 0 {
6770
slog.Info("watchdog enabled", "interval", cfg.WatchdogInterval, "stoponwatchdog", cfg.StopOnWatchdog)
6871
} else {
6972
slog.Info("watchdog disabled")
7073
}
74+
if len(cfg.AllowBindMountFrom) > 0 {
75+
slog.Info("Docker bind mount restrictions enabled", "allowbindmountfrom", cfg.AllowBindMountFrom)
76+
} else {
77+
// we only log this on DEBUG level because bind mount restrictions are a very special use case
78+
slog.Debug("no Docker bind mount restrictions")
79+
}
7180

72-
// print request allow list
81+
// print request allowlist
7382
if cfg.LogJSON {
7483
for method, regex := range cfg.AllowedRequests {
7584
slog.Info("configured allowed request", "method", method, "regex", regex)

‎internal/config/config.go‎

Lines changed: 12 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -180,13 +180,20 @@ func InitConfig() (*Config, error) {
180180
}
181181

182182
// check listenIP and proxyPort
183-
if net.ParseIP(listenIP) == nil {
184-
return nil, fmt.Errorf("invalid IP \"%s\" for listenip", listenIP)
185-
}
186183
if proxyPort < 1 || proxyPort > 65535 {
187-
return nil, errors.New("port number has to be between 1 and 65535")
184+
return nil, errors.New("port number has to be between 1 and 65535")
185+
}
186+
ip := net.ParseIP(listenIP)
187+
if ip == nil {
188+
return nil, fmt.Errorf("invalid IP \"%s\" for listenip", listenIP)
189+
}
190+
191+
// Properly format address for both IPv4 and IPv6
192+
if ip.To4() == nil {
193+
cfg.ListenAddress = fmt.Sprintf("[%s]:%d", listenIP, proxyPort)
194+
} else {
195+
cfg.ListenAddress = fmt.Sprintf("%s:%d", listenIP, proxyPort)
188196
}
189-
cfg.ListenAddress = fmt.Sprintf("%s:%d", listenIP, proxyPort)
190197

191198
// parse defaultLogLevel and setup logging handler depending on defaultLogJSON
192199
switch strings.ToUpper(logLevel) {

0 commit comments

Comments
 (0)