Wiki

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
====== Systems - Media Server - Set Up the Docker Compose File for Socket Proxy ======

<WRAP alert>
**ALERT:**  When running Docker in production, you typically do not want to expose the Docker daemon socket to external networks.

  * This poses a challenge for tools and apps that need access to the Docker API.
  * One solution is to set up a proxy that controls and secures access to the Docker API.

  * The docker-socket-proxy will need to run as the root user to be able to proxy the docker socket to the services.

  * See https://docs.linuxserver.io/images/docker-socket-proxy/.
  * See https://tecnativa/docker-socket-proxy.

</WRAP>

----

===== Create Socket Proxy Docker Compose File =====

Create a file named **/home/peter/docker/compose/mediaserver/socket-proxy.yml**.

<file yaml /home/peter/docker/compose/mediaserver/socket-proxy.yml>
services:
  socket-proxy:
    image: lscr.io/linuxserver/socket-proxy:latest
    container_name: socket-proxy
    environment:
      - ALLOW_START=1 #optional
      - ALLOW_STOP=1 #optional
      - ALLOW_RESTARTS=1 #optional
      - AUTH=0 #optional
      - BUILD=0 #optional
      - COMMIT=0 #optional
      - CONFIGS=0 #optional
      - CONTAINERS=0 #optional
      - DISABLE_IPV6=0 #optional
      - DISTRIBUTION=0 #optional
      - EVENTS=1 #optional
      - EXEC=0 #optional
      - IMAGES=0 #optional
      - INFO=0 #optional
      - LOG_LEVEL=info #optional
      - NETWORKS=0 #optional
      - NODES=0 #optional
      - PING=1 #optional
      - PLUGINS=0 #optional
      - POST=0 #optional
      - SECRETS=0 #optional
      - SERVICES=0 #optional
      - SESSION=0 #optional
      - SWARM=0 #optional
      - SYSTEM=0 #optional
      - TASKS=0 #optional
      - VERSION=1 #optional
      - VOLUMES=0 #optional
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    restart: unless-stopped
    read_only: true
    tmpfs:
      - /run
</file>



----

===== Example Service using Socket Proxy =====

<file yaml example-service.yml>
version: "3.1"

services:
  my-service:
    image: my-service
    environment:
      - DOCKER_HOST=tcp://docker-socket-proxy:2375
    networks:
      - my-network
  docker-socket-proxy:
    image: tecnativa/docker-socket-proxy
    environment:
      - SERVICES=1
      - TASKS=1
      - NETWORKS=1
      - NODES=1
    volumes:
     - /var/run/docker.sock:/var/run/docker.sock
    networks:
      - my-network
    deploy:
      placement:
        constraints: [node.role == manager]

networks:
  my-network:
    driver: overlay
</file>


<WRAP info>
**NOTE:**  Proxy the docker socket to my-service.

  * The important line to add to each service is **<nowiki>DOCKER_HOST=tcp://docker-socket-proxy:2375</nowiki>**.

  * See: https://github.com/Tecnativa/docker-socket-proxy
</WRAP>

----

===== References =====

https://docs.linuxserver.io/images/docker-socket-proxy/

https://github.com/Tecnativa/docker-socket-proxy