Create docker-compose.socket-proxy.yml

[SheepReaper]

Adds an example using a docker socket proxy.

Implements #131

[SheepReaper]

I missed the autoclean process. That one requires IMAGES and CONTAINER. Added them.
The only genuinely optional one is the AUTH api.

[SheepReaper]

The docker cli always interfaces with the API, whether on a local socket or remote. Each command has a corresponding API. This particular socket proxy disables all but the version, ping, and events API, and you have to selectively enable each one you need. (also, the POST method on every endpoint is disabled unless you add POST: 1)

Because this script uses a variety of CLI commands, a bunch of APIs are required. I'm not sure which commands require distribution and nodes, but that's probably some CLI command that needs more than one API to complete. My guess is one of the inspect commands.

[SheepReaper]

But yes, just set everything to 0 for verification, and start the stack. Watch the socket-proxy log. as the script runs, you'll see NOSRV errors on every API that is accessed that you have not enabled. Also, the shepherd container may fail to stay running if certain commands fail to execute. I did not identify which ones. I just kept enabling the blocked api's until it was happy. That's how I missed the autoclean process needing 2 more. mine's also set up to authenticate to dockerhub, but based on the code, I don't see that interfering.

[SheepReaper]

My best guess is that docker manifest inspect might use distribution, and docker service update, since it's a swarm, makes requests to nodes and tasks.

[djmaze]

So.. If I understand correctly, Shepherd uses almost all important and dangerous APIs, leaving the socket proxy to not really protect any important API anymore. Right?

[SheepReaper]

Right

…

On Thu, Feb 27, 2025, 4:52 PM Martin Honermeyer ***@***.***> wrote: So.. If I understand correctly, Shepherd uses almost all important and dangerous APIs, leaving the socket proxy to not really protect any important API anymore. Right? — Reply to this email directly, view it on GitHub <#132 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABLQ6JOZ5HTWY3URS4L4WVT2R6CLBAVCNFSM6AAAAABX3SVXIKVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDMOBZGE4TAOBZHE> . You are receiving this because you authored the thread.Message ID: ***@***.***> [image: djmaze]*djmaze* left a comment (containrrr/shepherd#132) <#132 (comment)> So.. If I understand correctly, Shepherd uses almost all important and dangerous APIs, leaving the socket proxy to not really protect any important API anymore. Right? — Reply to this email directly, view it on GitHub <#132 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABLQ6JOZ5HTWY3URS4L4WVT2R6CLBAVCNFSM6AAAAABX3SVXIKVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDMOBZGE4TAOBZHE> . You are receiving this because you authored the thread.Message ID: ***@***.***>