Add Dockersocket connection

[zichichi]

Would it be possible to connect the bot to dockersocket to increase its security?

[dgongut]

Yes, this is possible today without any code change. The bot connects via docker.from_env(), which automatically reads the DOCKER_HOST environment variable. So instead of bind-mounting /var/run/docker.sock into the bot, you can put a socket proxy (e.g. tecnativa/docker-socket-proxy) in front and point the bot to it with DOCKER_HOST=tcp://socket-proxy:2375.

I actually tested it end-to-end and it works:

The bot starts and talks to Docker only through the proxy (verified in the proxy's access logs: GET /version, GET /containers/json, etc.).
Read and write operations work: listing, start/ stop/ restart, create/ remove, image pull, and exec.
Containers created after the bot started are detected correctly.
Endpoints not enabled in the proxy are blocked (e.g. /volumes returns 403 Forbidden), which is exactly the hardening benefit.
That said, I'm not convinced it's strictly necessary in this case. Because the bot's whole purpose is to manage containers, it needs a pretty broad set of permissions to work properly: write access (POST=1) plus CONTAINERS, IMAGES, NETWORKS, EXEC, INFO, VERSION and EVENTS. With POST and EXEC enabled, a compromised bot can still do almost anything (create privileged containers, mount the host filesystem, run arbitrary commands...), so the proxy doesn't really close the main attack surface — it's not a silver bullet.

What you do get is some defense-in-depth: the raw socket isn't mounted inside the bot, the proxy can run read_only on an isolated network, and the handful of endpoints the bot never uses get blocked. It's a nice-to-have hardening layer, but given how many permissions the bot legitimately needs, I wouldn't consider it essential.

That's why I didn't considered as an option at first.

Example docker-compose.yml:

services:
  socket-proxy:
    image: tecnativa/docker-socket-proxy
    environment:
      CONTAINERS: 1
      IMAGES: 1
      NETWORKS: 1
      EXEC: 1
      INFO: 1
      VERSION: 1
      EVENTS: 1
      POST: 1
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    read_only: true
    tmpfs:
      - /run
      - /tmp
    networks: [dcb-net]

  docker-controller-bot:
    image: dgongut/docker-controller-bot:latest
    environment:
      DOCKER_HOST: "tcp://socket-proxy:2375"
      # ...your usual TELEGRAM_TOKEN / TELEGRAM_ADMIN / CONTAINER_NAME...
    depends_on: [socket-proxy]
    networks: [dcb-net]

networks:
  dcb-net:
    driver: bridge

Note: read_only: true requires tmpfs: [/run, /tmp] for the proxy, otherwise it crash-loops. If EXEC=1 ever causes issues, only the /exec command would be affected; everything else keeps working.

Let me know what you think! Should I put something like this in the readme? I think it’s a bit overwhelming for beginners.