Skip to content

Commit e31a7c4

Browse files
thespadthespad
authored
Merge pull request #4 from linuxserver/ipv6
Allow disabling IPv6
2 parents 4a743f0 + 22f7fde commit e31a7c4

File tree

5 files changed

+155
-21
lines changed

5 files changed

+155
-21
lines changed

‎README.md‎

Lines changed: 14 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,7 @@ The architectures supported by this image are:
5252

5353
## Application Setup
5454

55-
This container is based on [https://github.com/Tecnativa/docker-socket-proxy](https://github.com/Tecnativa/docker-socket-proxy) and as such does not follow our usual container conventions. It *does not* support mods or custom scripts/services, or running as a user other than root (or the docker user in a rootless environment).
55+
This container is based on [https://github.com/Tecnativa/docker-socket-proxy](https://github.com/Tecnativa/docker-socket-proxy) and as such does not follow our usual container conventions. It *does not* support mods or custom scripts/services, or running as a user other than root (or the docker user in a rootless environment). It is designed to act as a drop-in replacement for the Tecnativa container.
5656

5757
The container should be run on the same docker network as the service(s) using it. Most containers that would normally connect to a mounted docker.sock can have their endpoint overridden using the `DOCKER_HOST` environment variable if they do not offer the option in their configuration; it should typically be pointed to `tcp://socket-proxy:2375`.
5858

@@ -63,9 +63,9 @@ The container should be run on the same docker network as the service(s) using i
6363

6464
## Usage
6565

66-
To help you get started creating a container from this image you can either use docker-compose or the docker cli.
66+
To help you get started creating a container from this image you can either use docker compose or the docker cli.
6767

68-
### docker-compose (recommended, [click here for more info](https://docs.linuxserver.io/general/docker-compose))
68+
### docker compose (recommended, [click here for more info](https://docs.linuxserver.io/general/docker compose))
6969

7070
```yaml
7171
---
@@ -82,6 +82,7 @@ services:
8282
- COMMIT=0 #optional
8383
- CONFIGS=0 #optional
8484
- CONTAINERS=0 #optional
85+
- DISABLE_IPV6=0 #optional
8586
- DISTRIBUTION=0 #optional
8687
- EVENTS=1 #optional
8788
- EXEC=0 #optional
@@ -122,6 +123,7 @@ docker run -d \
122123
-e CONFIGS=0 `#optional` \
123124
-e CONTAINERS=0 `#optional` \
124125
-e DISTRIBUTION=0 `#optional` \
126+
-e DISABLE_IPV6=0 `#optional` \
125127
-e EVENTS=1 `#optional` \
126128
-e EXEC=0 `#optional` \
127129
-e IMAGES=0 `#optional` \
@@ -152,15 +154,16 @@ Containers are configured using parameters passed at runtime (such as those abov
152154

153155
| Parameter | Function |
154156
| :----: | --- |
155-
| `-e ALLOW_START=0` | `/containers/id/start` |
156-
| `-e ALLOW_STOP=0` | `/containers/id/stop` |
157-
| `-e ALLOW_RESTARTS=0` | `/containers/id/stop`, `/containers/id/restart`, and `/containers/id/kill` |
157+
| `-e ALLOW_START=0` | `/containers/{id}/start` |
158+
| `-e ALLOW_STOP=0` | `/containers/{id}/stop` |
159+
| `-e ALLOW_RESTARTS=0` | `/containers/{id}/stop`, `/containers/{id}/restart`, and `/containers/{id}/kill` |
158160
| `-e AUTH=0` | `/auth` |
159161
| `-e BUILD=0` | `/build` |
160162
| `-e COMMIT=0` | `/commit` |
161163
| `-e CONFIGS=0` | `/configs` |
162164
| `-e CONTAINERS=0` | `/containers` |
163165
| `-e DISTRIBUTION=0` | `/distribution` |
166+
| `-e DISABLE_IPV6=0` | Set to `1` to prevent nginx binding to the IPv6 interface for legacy system that cannot support IPv6. |
164167
| `-e EVENTS=1` | `/events` |
165168
| `-e EXEC=0` | `/exec` & `/containers/{id}/exec` |
166169
| `-e IMAGES=0` | `/images` |
@@ -220,26 +223,26 @@ Below are the instructions for updating containers:
220223
* All images:
221224

222225
```bash
223-
docker-compose pull
226+
docker compose pull
224227
```
225228

226229
* Single image:
227230

228231
```bash
229-
docker-compose pull socket-proxy
232+
docker compose pull socket-proxy
230233
```
231234

232235
* Update containers:
233236
* All containers:
234237

235238
```bash
236-
docker-compose up -d
239+
docker compose up -d
237240
```
238241

239242
* Single container:
240243

241244
```bash
242-
docker-compose up -d socket-proxy
245+
docker compose up -d socket-proxy
243246
```
244247

245248
* You can also remove the old dangling images:
@@ -301,5 +304,6 @@ Once registered you can define the dockerfile to use with `-f Dockerfile.aarch64
301304

302305
## Versions
303306

307+
* **15.04.24:** - Allow disabling IPv6 support for legacy devices.
304308
* **08.04.24:** - Use nginx due to haproxy's wonky websockets handling.
305309
* **07.04.24:** - Initial Release.

‎readme-vars.yml‎

Lines changed: 14 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,7 @@ full_custom_readme: |
5656
5757
## Application Setup
5858
59-
This container is based on [https://github.com/Tecnativa/docker-socket-proxy](https://github.com/Tecnativa/docker-socket-proxy) and as such does not follow our usual container conventions. It *does not* support mods or custom scripts/services, or running as a user other than root (or the docker user in a rootless environment).
59+
This container is based on [https://github.com/Tecnativa/docker-socket-proxy](https://github.com/Tecnativa/docker-socket-proxy) and as such does not follow our usual container conventions. It *does not* support mods or custom scripts/services, or running as a user other than root (or the docker user in a rootless environment). It is designed to act as a drop-in replacement for the Tecnativa container.
6060
6161
The container should be run on the same docker network as the service(s) using it. Most containers that would normally connect to a mounted docker.sock can have their endpoint overridden using the `DOCKER_HOST` environment variable if they do not offer the option in their configuration; it should typically be pointed to `tcp://socket-proxy:2375`.
6262
@@ -67,9 +67,9 @@ full_custom_readme: |
6767
6868
## Usage
6969
70-
To help you get started creating a container from this image you can either use docker-compose or the docker cli.
70+
To help you get started creating a container from this image you can either use docker compose or the docker cli.
7171
72-
### docker-compose (recommended, [click here for more info](https://docs.linuxserver.io/general/docker-compose))
72+
### docker compose (recommended, [click here for more info](https://docs.linuxserver.io/general/docker compose))
7373
7474
```yaml
7575
---
@@ -86,6 +86,7 @@ full_custom_readme: |
8686
- COMMIT=0 #optional
8787
- CONFIGS=0 #optional
8888
- CONTAINERS=0 #optional
89+
- DISABLE_IPV6=0 #optional
8990
- DISTRIBUTION=0 #optional
9091
- EVENTS=1 #optional
9192
- EXEC=0 #optional
@@ -126,6 +127,7 @@ full_custom_readme: |
126127
-e CONFIGS=0 `#optional` \
127128
-e CONTAINERS=0 `#optional` \
128129
-e DISTRIBUTION=0 `#optional` \
130+
-e DISABLE_IPV6=0 `#optional` \
129131
-e EVENTS=1 `#optional` \
130132
-e EXEC=0 `#optional` \
131133
-e IMAGES=0 `#optional` \
@@ -156,15 +158,16 @@ full_custom_readme: |
156158
157159
| Parameter | Function |
158160
| :----: | --- |
159-
| `-e ALLOW_START=0` | `/containers/id/start` |
160-
| `-e ALLOW_STOP=0` | `/containers/id/stop` |
161-
| `-e ALLOW_RESTARTS=0` | `/containers/id/stop`, `/containers/id/restart`, and `/containers/id/kill` |
161+
| `-e ALLOW_START=0` | `/containers/{id}/start` |
162+
| `-e ALLOW_STOP=0` | `/containers/{id}/stop` |
163+
| `-e ALLOW_RESTARTS=0` | `/containers/{id}/stop`, `/containers/{id}/restart`, and `/containers/{id}/kill` |
162164
| `-e AUTH=0` | `/auth` |
163165
| `-e BUILD=0` | `/build` |
164166
| `-e COMMIT=0` | `/commit` |
165167
| `-e CONFIGS=0` | `/configs` |
166168
| `-e CONTAINERS=0` | `/containers` |
167169
| `-e DISTRIBUTION=0` | `/distribution` |
170+
| `-e DISABLE_IPV6=0` | Set to `1` to prevent nginx binding to the IPv6 interface for legacy system that cannot support IPv6. |
168171
| `-e EVENTS=1` | `/events` |
169172
| `-e EXEC=0` | `/exec` & `/containers/{id}/exec` |
170173
| `-e IMAGES=0` | `/images` |
@@ -224,26 +227,26 @@ full_custom_readme: |
224227
* All images:
225228
226229
```bash
227-
docker-compose pull
230+
docker compose pull
228231
```
229232
230233
* Single image:
231234
232235
```bash
233-
docker-compose pull socket-proxy
236+
docker compose pull socket-proxy
234237
```
235238
236239
* Update containers:
237240
* All containers:
238241
239242
```bash
240-
docker-compose up -d
243+
docker compose up -d
241244
```
242245
243246
* Single container:
244247
245248
```bash
246-
docker-compose up -d socket-proxy
249+
docker compose up -d socket-proxy
247250
```
248251
249252
* You can also remove the old dangling images:
@@ -305,6 +308,7 @@ full_custom_readme: |
305308
306309
## Versions
307310
311+
* **15.04.24:** - Allow disabling IPv6 support for legacy devices.
308312
* **08.04.24:** - Use nginx due to haproxy's wonky websockets handling.
309313
* **07.04.24:** - Initial Release.
310314

‎root/docker-entrypoint.sh‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,10 @@
11
#!/bin/bash
22

3-
if [[ $POST == 1 ]]; then
3+
if [[ $POST == 1 ]] && [[ $DISABLE_IPV6 == 1 ]]; then
4+
envsubst "$(printf '${%s} ' $(bash -c "compgen -A variable"))" < /templates/default_post_ipv4.template > /run/default.conf
5+
elif [[ $POST == 0 ]] && [[ $DISABLE_IPV6 == 1 ]]; then
6+
envsubst "$(printf '${%s} ' $(bash -c "compgen -A variable"))" < /templates/default_nopost_ipv4.template > /run/default.conf
7+
elif [[ $POST == 1 ]]; then
48
envsubst "$(printf '${%s} ' $(bash -c "compgen -A variable"))" < /templates/default_post.template > /run/default.conf
59
else
610
envsubst "$(printf '${%s} ' $(bash -c "compgen -A variable"))" < /templates/default_nopost.template > /run/default.conf

‎root/templates/default_nopost_ipv4.template‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
server {
2+
listen 2375 default_server;
3+
4+
server_name _;
5+
6+
set $dockersocket $SOCKET_PATH;
7+
set $path_restarts $ALLOW_RESTARTS;
8+
set $path_stop $ALLOW_STOP;
9+
set $path_start $ALLOW_START;
10+
set $path_auth $AUTH;
11+
set $path_build $BUILD;
12+
set $path_commit $COMMIT;
13+
set $path_configs $CONFIGS;
14+
set $path_containers $CONTAINERS;
15+
set $path_distribution $DISTRIBUTION;
16+
set $path_events $EVENTS;
17+
set $path_exec $EXEC;
18+
set $path_images $IMAGES;
19+
set $path_info $INFO;
20+
set $path_networks $NETWORKS;
21+
set $path_nodes $NODES;
22+
set $path_ping $PING;
23+
set $path_plugins $PLUGINS;
24+
set $path_secrets $SECRETS;
25+
set $path_services $SERVICES;
26+
set $path_session $SESSION;
27+
set $path_swarm $SWARM;
28+
set $path_system $SYSTEM;
29+
set $path_tasks $TASKS;
30+
set $path_version $VERSION;
31+
set $path_volumes $VOLUMES;
32+
33+
include /etc/nginx/proxy.conf;
34+
35+
location ~* ^(/v[\d\.]+)?/containers/[a-zA-Z0-9_.-]+/((stop)|(restart)|(kill)) {limit_except GET HEAD {deny all;}if ($path_restarts = 0){return 403;}proxy_pass http://unix:$dockersocket;}
36+
location ~* ^(/v[\d\.]+)?/containers/[a-zA-Z0-9_.-]+/start {limit_except GET HEAD {deny all;}if ($path_start = 0){return 403;}proxy_pass http://unix:$dockersocket;}
37+
location ~* ^(/v[\d\.]+)?/containers/[a-zA-Z0-9_.-]+/stop {limit_except GET HEAD {deny all;}if ($path_stop = 0){return 403;}proxy_pass http://unix:$dockersocket;}
38+
location ~* ^(/v[\d\.]+)?/auth {limit_except GET HEAD {deny all;}if ($path_auth = 0){return 403;}proxy_pass http://unix:$dockersocket;}
39+
location ~* ^(/v[\d\.]+)?/build {limit_except GET HEAD {deny all;}if ($path_build = 0){return 403;}proxy_pass http://unix:$dockersocket;}
40+
location ~* ^(/v[\d\.]+)?/commit {limit_except GET HEAD {deny all;}if ($path_commit = 0){return 403;}proxy_pass http://unix:$dockersocket;}
41+
location ~* ^(/v[\d\.]+)?/configs {limit_except GET HEAD {deny all;}if ($path_configs = 0){return 403;}proxy_pass http://unix:$dockersocket;}
42+
location ~* ^(/v[\d\.]+)?/containers {limit_except GET HEAD {deny all;}if ($path_containers = 0){return 403;}proxy_pass http://unix:$dockersocket;}
43+
location ~* ^(/v[\d\.]+)?/distribution {limit_except GET HEAD {deny all;}if ($path_distribution = 0){return 403;}proxy_pass http://unix:$dockersocket;}
44+
location ~* ^(/v[\d\.]+)?/events {limit_except GET HEAD {deny all;}if ($path_events = 0){return 403;}proxy_pass http://unix:$dockersocket;}
45+
location ~* ^(/v[\d\.]+)?/exec {limit_except GET HEAD {deny all;}if ($path_exec = 0){return 403;}proxy_pass http://unix:$dockersocket;}
46+
location ~* ^(/v[\d\.]+)?/images {limit_except GET HEAD {deny all;}if ($path_images = 0){return 403;}proxy_pass http://unix:$dockersocket;}
47+
location ~* ^(/v[\d\.]+)?/info {limit_except GET HEAD {deny all;}if ($path_info = 0){return 403;}proxy_pass http://unix:$dockersocket;}
48+
location ~* ^(/v[\d\.]+)?/networks {limit_except GET HEAD {deny all;}if ($path_networks = 0){return 403;}proxy_pass http://unix:$dockersocket;}
49+
location ~* ^(/v[\d\.]+)?/nodes {limit_except GET HEAD {deny all;}if ($path_nodes = 0){return 403;}proxy_pass http://unix:$dockersocket;}
50+
location ~* ^(/v[\d\.]+)?/_ping {limit_except GET HEAD {deny all;}if ($path_ping = 0){return 403;}proxy_pass http://unix:$dockersocket;}
51+
location ~* ^(/v[\d\.]+)?/plugins {limit_except GET HEAD {deny all;}if ($path_plugins = 0){return 403;}proxy_pass http://unix:$dockersocket;}
52+
location ~* ^(/v[\d\.]+)?/secrets {limit_except GET HEAD {deny all;}if ($path_secrets = 0){return 403;}proxy_pass http://unix:$dockersocket;}
53+
location ~* ^(/v[\d\.]+)?/services {limit_except GET HEAD {deny all;}if ($path_services = 0){return 403;}proxy_pass http://unix:$dockersocket;}
54+
location ~* ^(/v[\d\.]+)?/session {limit_except GET HEAD {deny all;}if ($path_session = 0){return 403;}proxy_pass http://unix:$dockersocket;}
55+
location ~* ^(/v[\d\.]+)?/swarm {limit_except GET HEAD {deny all;}if ($path_swarm = 0){return 403;}proxy_pass http://unix:$dockersocket;}
56+
location ~* ^(/v[\d\.]+)?/system {limit_except GET HEAD {deny all;}if ($path_system = 0){return 403;}proxy_pass http://unix:$dockersocket;}
57+
location ~* ^(/v[\d\.]+)?/tasks {limit_except GET HEAD {deny all;}if ($path_tasks = 0){return 403;}proxy_pass http://unix:$dockersocket;}
58+
location ~* ^(/v[\d\.]+)?/version {limit_except GET HEAD {deny all;}if ($path_version = 0){return 403;}proxy_pass http://unix:$dockersocket;}
59+
location ~* ^(/v[\d\.]+)?/volumes {limit_except GET HEAD {deny all;}if ($path_volumes = 0){return 403;}proxy_pass http://unix:$dockersocket;}
60+
61+
}

‎root/templates/default_post_ipv4.template‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
server {
2+
listen 2375 default_server;
3+
4+
server_name _;
5+
6+
set $dockersocket $SOCKET_PATH;
7+
set $path_restarts $ALLOW_RESTARTS;
8+
set $path_stop $ALLOW_STOP;
9+
set $path_start $ALLOW_START;
10+
set $path_auth $AUTH;
11+
set $path_build $BUILD;
12+
set $path_commit $COMMIT;
13+
set $path_configs $CONFIGS;
14+
set $path_containers $CONTAINERS;
15+
set $path_distribution $DISTRIBUTION;
16+
set $path_events $EVENTS;
17+
set $path_exec $EXEC;
18+
set $path_images $IMAGES;
19+
set $path_info $INFO;
20+
set $path_networks $NETWORKS;
21+
set $path_nodes $NODES;
22+
set $path_ping $PING;
23+
set $path_plugins $PLUGINS;
24+
set $path_secrets $SECRETS;
25+
set $path_services $SERVICES;
26+
set $path_session $SESSION;
27+
set $path_swarm $SWARM;
28+
set $path_system $SYSTEM;
29+
set $path_tasks $TASKS;
30+
set $path_version $VERSION;
31+
set $path_volumes $VOLUMES;
32+
33+
include /etc/nginx/proxy.conf;
34+
35+
location ~* ^(/v[\d\.]+)?/containers/[a-zA-Z0-9_.-]+/((stop)|(restart)|(kill)) {if ($path_restarts = 0){return 403;}proxy_pass http://unix:$dockersocket;}
36+
location ~* ^(/v[\d\.]+)?/containers/[a-zA-Z0-9_.-]+/start {if ($path_start = 0){return 403;}proxy_pass http://unix:$dockersocket;}
37+
location ~* ^(/v[\d\.]+)?/containers/[a-zA-Z0-9_.-]+/stop {if ($path_stop = 0){return 403;}proxy_pass http://unix:$dockersocket;}
38+
location ~* ^(/v[\d\.]+)?/auth {if ($path_auth = 0){return 403;}proxy_pass http://unix:$dockersocket;}
39+
location ~* ^(/v[\d\.]+)?/build {if ($path_build = 0){return 403;}proxy_pass http://unix:$dockersocket;}
40+
location ~* ^(/v[\d\.]+)?/commit {if ($path_commit = 0){return 403;}proxy_pass http://unix:$dockersocket;}
41+
location ~* ^(/v[\d\.]+)?/configs {if ($path_configs = 0){return 403;}proxy_pass http://unix:$dockersocket;}
42+
location ~* ^(/v[\d\.]+)?/containers {if ($path_containers = 0){return 403;}proxy_pass http://unix:$dockersocket;}
43+
location ~* ^(/v[\d\.]+)?/distribution {if ($path_distribution = 0){return 403;}proxy_pass http://unix:$dockersocket;}
44+
location ~* ^(/v[\d\.]+)?/events {if ($path_events = 0){return 403;}proxy_pass http://unix:$dockersocket;}
45+
location ~* ^(/v[\d\.]+)?/exec {if ($path_exec = 0){return 403;}proxy_pass http://unix:$dockersocket;}
46+
location ~* ^(/v[\d\.]+)?/images {if ($path_images = 0){return 403;}proxy_pass http://unix:$dockersocket;}
47+
location ~* ^(/v[\d\.]+)?/info {if ($path_info = 0){return 403;}proxy_pass http://unix:$dockersocket;}
48+
location ~* ^(/v[\d\.]+)?/networks {if ($path_networks = 0){return 403;}proxy_pass http://unix:$dockersocket;}
49+
location ~* ^(/v[\d\.]+)?/nodes {if ($path_nodes = 0){return 403;}proxy_pass http://unix:$dockersocket;}
50+
location ~* ^(/v[\d\.]+)?/_ping {if ($path_ping = 0){return 403;}proxy_pass http://unix:$dockersocket;}
51+
location ~* ^(/v[\d\.]+)?/plugins {if ($path_plugins = 0){return 403;}proxy_pass http://unix:$dockersocket;}
52+
location ~* ^(/v[\d\.]+)?/secrets {if ($path_secrets = 0){return 403;}proxy_pass http://unix:$dockersocket;}
53+
location ~* ^(/v[\d\.]+)?/services {if ($path_services = 0){return 403;}proxy_pass http://unix:$dockersocket;}
54+
location ~* ^(/v[\d\.]+)?/session {if ($path_session = 0){return 403;}proxy_pass http://unix:$dockersocket;}
55+
location ~* ^(/v[\d\.]+)?/swarm {if ($path_swarm = 0){return 403;}proxy_pass http://unix:$dockersocket;}
56+
location ~* ^(/v[\d\.]+)?/system {if ($path_system = 0){return 403;}proxy_pass http://unix:$dockersocket;}
57+
location ~* ^(/v[\d\.]+)?/tasks {if ($path_tasks = 0){return 403;}proxy_pass http://unix:$dockersocket;}
58+
location ~* ^(/v[\d\.]+)?/version {if ($path_version = 0){return 403;}proxy_pass http://unix:$dockersocket;}
59+
location ~* ^(/v[\d\.]+)?/volumes {if ($path_volumes = 0){return 403;}proxy_pass http://unix:$dockersocket;}
60+
61+
}

0 commit comments

Comments
 (0)