sockguard
A proxy for docker.sock that enforces access control and isolated privileges for untrusted containers.
What is sockguard?
Sockguard is a proxy that sits between containers and the Docker socket, enforcing access controls and privilege isolation. It solves the security problem of giving untrusted containers (like CI build agents) access to the Docker daemon, which by default grants root-level host access. The proxy restricts operations like host mounts, privileged mode, and network access while labeling resources to ensure isolation.
DevOps engineers and platform teams running CI/CD pipelines or multi-tenant container environments where build containers need controlled Docker access. It's also relevant for security-conscious developers managing Docker-in-Docker setups.
Developers choose Sockguard because it provides a simple, socket-level security layer without requiring Docker Enterprise or complex authorization plugins. It offers fine-grained control over container creation and resource management, making it safer to run untrusted workloads alongside the Docker daemon.
Overview
A proxy for docker.sock that enforces access control and isolated privileges
Use Cases
Best For
- Securing Docker socket access in CI/CD pipelines
Related Projects
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
