A proxy for docker.sock that enforces access control and isolated privileges for untrusted containers.
Sockguard is a proxy that sits between containers and the Docker socket, enforcing access controls and privilege isolation. It solves the security problem of giving untrusted containers (like CI build agents) access to the Docker daemon, which by default grants root-level host access. The proxy restricts operations like host mounts, privileged mode, and network access while labeling resources to ensure isolation.
DevOps engineers and platform teams running CI/CD pipelines or multi-tenant container environments where build containers need controlled Docker access. It's also relevant for security-conscious developers managing Docker-in-Docker setups.
Developers choose Sockguard because it provides a simple, socket-level security layer without requiring Docker Enterprise or complex authorization plugins. It offers fine-grained control over container creation and resource management, making it safer to run untrusted workloads alongside the Docker daemon.
A proxy for docker.sock that enforces access control and isolated privileges
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Labels all created resources with a unique owner identifier, ensuring operations are restricted to the creating proxy instance, as detailed in the 'How it works' section.
Blocks privileged mode, host network mode, and non-whitelisted host bind mounts, preventing common attack vectors in untrusted containers like those in CI pipelines.
Supports setting a cgroup-parent to limit CPU and memory resources for spawned containers, useful for integrating with container schedulers as shown in the ECS example.
Operates at the socket level without modifying the Docker daemon, using simple filesystem permissions for access control instead of complex Docker Enterprise ACLs.
Explicitly marked as a discontinued experiment with a warning that better technology exists, making it unsuitable for production use and lacking ongoing support.
Many Docker API endpoints are missing or disabled, such as for images, Swarm, and plugins, limiting functionality for comprehensive Docker operations as listed in the 'Implementation status'.
The README recommends alternatives like sysbox, indicating Sockguard is outdated and less effective compared to current secure container isolation technologies.