Skip to content
CodesWhat?
← All specimens

Plate 01 · Server tool

Sockguard

Canis custos

A default-deny proxy for the Docker socket. You pick exactly which requests reach the daemon.

  • Apache-2.0
  • Go
  • Server tool
Visit the site (opens in a new tab)RepositoryDocs

Field notes

What to look for.

Habitat
In front of /var/run/docker.sock, wherever that is
Diet
Docker API requests. Refuses most of them.
Temperament
Says no first. Has never been talked out of it.
Marks
Brown and orange, white muzzle, studded collar. Looks friendly until you ask for a port.
Handling
Sits in front of the Docker socket. You list the requests allowed through and everything else is refused.
UpkeepRunning costs aren't measured yet, so there's no number here. It draws on the shared pool.Support