watchtower + docker proxy / volumes ??

[ThierryIT]

Hi, I am running a new instance of your product for Watchtower.
But I have a small problem concerning the "volumes".

`services:
  watchtower:
    image: containrrr/watchtower:1.7.1
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    depends_on:
      - dockerproxy
  dockerproxy:
    image: wollomatic/socket-proxy:1.1.3
    container_name: dockerproxy_watchtower
    command:
      - '-loglevel=debug'
      - '-allowfrom=0.0.0.0/0'
      - '-listenip=0.0.0.0'
      - '-allowGET=/v1\..{1,2}/(version|containers/.*|events.*)'

      - '-watchdoginterval=3600'
      - '-stoponwatchdog'
      - '-shutdowngracetime=10'
    restart: unless-stopped
    read_only: true
    mem_limit: 64M
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges
    user: 65534:995 # change gid from 998 to the gid of the docker group on your host
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:rw
    networks:
      - socket_w

networks:
   mynet:
     external: true
   socket_w:
     driver: bridge
     internal: true
     attachable: false`

My "volumes" are wrong isn't it ?

[wollomatic]

Please see the example for Watchtower here: https://github.com/wollomatic/socket-proxy/blob/main/examples/docker-compose/watchtower/compose.yaml

You need to whitelist all requests that Watchtower is allowed to do. This is done with the allowGET, allowPOST, and allowDELETE lines.

You can mount the docker socket read only.