Skip to content

Instantly share code, notes, and snippets.

@smgoller
Last active July 4, 2024 21:58
Show Gist options
  • Save smgoller/23dcaf430e762e580cde18cd5b874fc5 to your computer and use it in GitHub Desktop.
Save smgoller/23dcaf430e762e580cde18cd5b874fc5 to your computer and use it in GitHub Desktop.
Docker compose file that deploys dockge along with a socket proxy service for security
version: "3.8"
networks:
default:
driver: bridge
socket_proxy:
name: socket_proxy
driver: bridge
services:
# Docker Socket Proxy - Security Enchanced Proxy for Docker Socket
socket-proxy:
container_name: socket-proxy
image: tecnativa/docker-socket-proxy
restart: always
# profiles:
# - core
networks:
socket_proxy:
privileged: true
#ports:
# - "127.0.0.1:2375:2375" # Port 2375 should only ever get exposed to the internal network. When possible use this line.
# I use the next line instead, as I want portainer to manage multiple docker endpoints within my home network.
# - "2375:2375"
volumes:
- "/var/run/docker.sock:/var/run/docker.sock"
environment:
- LOG_LEVEL=info # debug,info,notice,warning,err,crit,alert,emerg
## Variables match the URL prefix (i.e. AUTH blocks access to /auth/* parts of the API, etc.).
# 0 to revoke access.
# 1 to grant access.
## Granted by Default
- EVENTS=1
- PING=1
- VERSION=1
## Revoked by Default
# Security critical
- AUTH=0
- SECRETS=0
- POST=1 # Ouroboros
# Not always needed
- BUILD=0
- COMMIT=0
- CONFIGS=0
- CONTAINERS=1 # Traefik, portainer, etc.
- DISTRIBUTION=0
- EXEC=0
- IMAGES=1 # Portainer
- INFO=1 # Portainer
- NETWORKS=1 # Portainer
- NODES=0
- PLUGINS=0
- SERVICES=1 # Portainer
- SESSION=0
- SWARM=0
- SYSTEM=0
- TASKS=1 # Portaienr
- VOLUMES=1 # Portainer
dockge:
image: louislam/dockge:1
restart: unless-stopped
networks:
default:
socket_proxy:
ports:
# Host Port : Container Port
- 5001:5001
volumes:
# - /var/run/docker.sock:/var/run/docker.sock
- ./data:/app/data
# If you want to use private registries, you need to share the auth file with Dockge:
# - /root/.docker/:/root/.docker
# Stacks Directory
# ⚠️ READ IT CAREFULLY. If you did it wrong, your data could end up writing into a WRONG PATH.
# ⚠️ 1. FULL path only. No relative path (MUST)
# ⚠️ 2. Left Stacks Path === Right Stacks Path (MUST)
- /opt/stacks:/opt/stacks
environment:
# Tell Dockge where is your stacks directory
- DOCKGE_STACKS_DIR=/opt/stacks
- DOCKER_HOST=tcp://socket-proxy:2375
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment