You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
I'd like to introduce the CONTAINER_ID parameter as filter. This parameter needs to enable/disable the /containers/{id}/ endpoint.
Reason for change
This suggestion has been discussed in the past see #12 and #13 in 2024, however the treat landscape keeps changing and as adoption of this solution is picking up its becoming more relevant.
Today this container is being used often with solutions such as Traefik resulting in near public exposure of the socket-proxy. The /containers/{id}/ endpoint allows access to sensitive endpoint such as the ENV variables of a container. Therefore I'd like to ask you to reconsider earlier position as stated in the issues #12 and #13 and add this feature.
Apologies for my poor phrasing. The case I'm trying to make is that generally speaking Traefik is exposed to the internet. This exposure leads to risks, one of these is compromise of Traefik, which has access to the Docker socket with the docker-socket-proxy container.
In order to mitigate, or at least reduce, the risk we could decrease the access Traefik has to the Docker socket by removing its access to sensitive information. As such I'd suggest (but perhaps you've got a better suggestion to mitigate this) to introduce an additional parameter that enables/disables the /containers/{id}/ API endpoint of Docker.
This issue has been automatically marked as stale because it has not had recent activity. This might be due to missing feedback from OP. It will be closed if no further activity occurs. Thank you for your contributions.
Activity
github-actions commentedon Jun 22, 2026
Thanks for opening your first issue here! Be sure to follow the relevant issue templates, or risk having this issue marked as invalid.
aptalca commentedon Jun 22, 2026
I don't follow the part about
Traefik resulting in near public exposure of the socket-proxy. What exactly do you mean? Are you reverse proxying it?deathlef commentedon Jun 23, 2026
Apologies for my poor phrasing. The case I'm trying to make is that generally speaking Traefik is exposed to the internet. This exposure leads to risks, one of these is compromise of Traefik, which has access to the Docker socket with the docker-socket-proxy container.
In order to mitigate, or at least reduce, the risk we could decrease the access Traefik has to the Docker socket by removing its access to sensitive information. As such I'd suggest (but perhaps you've got a better suggestion to mitigate this) to introduce an additional parameter that enables/disables the /containers/{id}/ API endpoint of Docker.
LinuxServer-CI commentedon Aug 1, 2026
This issue has been automatically marked as stale because it has not had recent activity. This might be due to missing feedback from OP. It will be closed if no further activity occurs. Thank you for your contributions.