socket-proxy

Overview ¶

Command socket-proxy is Redoubt's least-privilege Docker socket proxy (D-002, D-003).

It is the only process that holds /var/run/docker.sock. Every request from platformd is checked against internal/docker.Allowlist before it is forwarded; everything else gets 403.

Deployment note: the binary runs from a distroless static image as a non-root uid (65532). The socket must be reachable through the container's supplementary groups (compose `group_add: ["<docker gid>"]`); nothing here assumes root, and the daemon socket is the only file the process ever opens. Distroless ships no curl, so the compose healthcheck runs the binary itself: `["/app", "healthcheck"]`.