From 667a8f6ba423513e73b12831cce499928a33b320 Mon Sep 17 00:00:00 2001 From: Yajat Kapur Failsafe Date: Thu, 24 Sep 2026 15:18:13 -0700 Subject: [PATCH] fix(security): replace direct Docker socket mount with restricted proxy Traefik mounted /var/run/docker.sock directly (even :ro), which grants root-level access to the Docker daemon. Any compromise of the Traefik container gives full control over the host's containers, images, volumes, and networks. Replace the direct mount with a tecnativa/docker-socket-proxy that only exposes read-only container/service/task endpoints (POST=0). Traefik points to the proxy via --providers.docker.endpoint. Signed-off-by: Yajat Kapur Failsafe --- compose.yml | 22 +++++++++++++++++++--- 1 file changed, 19 insertions(+), 3 deletions(-) diff --git a/compose.yml b/compose.yml index 110eb5c3e0..120addc754 100644 --- a/compose.yml +++ b/compose.yml @@ -1,13 +1,29 @@ services: - proxy: - image: traefik:v3.7 + # Docker socket proxy — limits Docker API access to read-only endpoints. + # Traefik only needs to list containers and read their labels; it does not + # need full Docker daemon access. Mounting /var/run/docker.sock directly + # (even :ro) grants root-level control over the Docker daemon. + docker-socket-proxy: + image: tecnativa/docker-socket-proxy:0.1 volumes: - # Add Docker as a mounted volume, so that Traefik can read the labels of other services - /var/run/docker.sock:/var/run/docker.sock:ro + environment: + - CONTAINERS=1 + - SERVICES=1 + - TASKS=1 + - POST=0 + restart: unless-stopped + + proxy: + image: traefik:v3.7 + depends_on: + - docker-socket-proxy command: # Enable Docker in Traefik, so that it reads labels from Docker services - --providers.docker + # Use the restricted Docker socket proxy instead of the raw Docker socket + - --providers.docker.endpoint=tcp://docker-socket-proxy:2375 # Do not expose all Docker services, only the ones explicitly exposed - --providers.docker.exposedbydefault=false # Create an entrypoint "http" listening on port 80