search

wollomatic / socket-proxy

A secure-by-design and flexible unix socket proxy. No external dependencies. Needs no shell or interpreter in a container. Written in Go (memory safe). Can replace tecnativa/docker-socket-proxy or linuxserver/docker-socket-proxy. Most flexible configuration with regular expressions
https://hub.docker.com/r/wollomatic/socket-proxy
MIT License
63 stars 2 forks source link

[Idea] Expose the filtered UNIX socket as... a UNIX socket! #29

Open andrebrait opened 3 weeks ago

andrebrait commented 3 weeks ago

Is your feature request related to a problem? Please describe.

Some applications simply do not like having a remote host to listen to and would much rather have a UNIX socket to connect to. Plus, UNIX socket skip the whole TCP/IP stack, routing, etc. and may thus be faster.

Currently all socket proxies that may be used to control what and how something can access a UNIX socket expose the functionality through the network, usually plain TCP.

Describe the solution you'd like

Find a way to expose the filtered and controlled operations in a UNIX socket. The user should be able to set the path desired for such socket and make that available for mounting to e.g. another container (speaking specifically about Docker here).

Describe alternatives you've considered

None.

Additional context

I know some types of filtering, like allowed IPs and hosts, are impossible (and besides the point) if exposing it as a UNIX socket.

Given UNIX sockets require a system call and are a kernel feature, I'm not sure what it takes to make use of them from within a container, but hey, that's the point of opening the issue as well. I'm gonna do some investigation.

wollomatic commented 3 weeks ago

Hi Andre,

thanks for the suggestion. I also thought about this before and I think it will be implemented in a (not-so-)future release.