Can /var/run/docker.sock be mounted read-only? (:ro)

[FunctionDJ]

When using Docker to run Diun, is it necessary to bind docker.sock with defaults (read-write if i'm not mistaken) or can :ro be used for read-only which is safer?

[shalafi99]

I understand there is no need to mount the socket with defaults, :ro can be used with no downsides.
(One of the blog posts included in https://crazymax.dev/diun/user-guides/blog-posts/ has the example compose file like so)

I kind of do that too but with a slight twist - mount the docker socket as read-only inside a docker proxy container:

    environment:
      - DIUN_PROVIDERS_DOCKER_ENDPOINT=tcp://diun-proxy:2375

Exposing only a couple of APIs to the Diun container using http.

[FunctionDJ]

Thank you for the reply! I've used https://github.com/Tecnativa/docker-socket-proxy in the past and i think i should use it again for a bit of extra control.

[shalafi99]

Cool, that is exactly the one I use 😄
Allowing only these APIs below (version and info might not even be needed, figured they are harmless enough without POST):

      - VERSION=1
      - CONTAINERS=1
      - IMAGES=1
      - INFO=1

Cheers