refactor and harden Docker label handling

README.md

@@ -135,7 +135,7 @@ Allowlists for both requests and bind mount restrictions can be specified for pa
 
 1. Set `-proxycontainername` or the environment variable `SP_PROXYCONTAINERNAME` to the name of the socket proxy container.
 2. Make sure that each container that will use the socket proxy is in a Docker network that the socket proxy container is also in.
-3. Use the same regex syntax for request allowlists and for bind mount restrictions that were discussed earlier, but for labels on each container that will use the socket proxy. Each label name will have the prefix of `socket-proxy.allow.`, with `socket-proxy.allow.bindmountfrom` for bind mount restrictions. For example:
+3. Use the same regex syntax for request allowlists and for bind mount restrictions that were discussed earlier, but for labels on each container that will use the socket proxy. Each label name has the prefix `<dockerlabelprefix>.allow.`; by default this is `socket-proxy.allow.`, with `socket-proxy.allow.bindmountfrom` for bind mount restrictions. Set `-dockerlabelprefix` or `SP_DOCKERLABELPREFIX` when multiple socket proxies share a Docker daemon. For example, `-dockerlabelprefix=traefik-socket-proxy` uses labels beginning with `traefik-socket-proxy.allow.`.
 
 ```yaml
 services:
@@ -254,6 +254,7 @@ socket-proxy can be configured via command-line parameters or via environment va
 | `-watchdoginterval`            | `SP_WATCHDOGINTERVAL`            | `0`                    | Check for socket availability every x seconds (disable checks, if not set or value is 0)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
 | `-proxysocketendpoint`         | `SP_PROXYSOCKETENDPOINT`         | (not set)              | Proxy to the given unix socket instead of a TCP port                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
 | `-proxysocketendpointfilemode` | `SP_PROXYSOCKETENDPOINTFILEMODE` | `0600`                 | Explicitly set the file mode for the filtered unix socket endpoint (only useful with `-proxysocketendpoint`)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
+| `-dockerlabelprefix`           | `SP_DOCKERLABELPREFIX`           | `socket-proxy`         | Specifies the prefix before `.allow.` in Docker container labels used for per-container allowlists. It must contain only lowercase letters, digits, dots, and hyphens. For example, `-dockerlabelprefix=traefik-socket-proxy` recognizes `traefik-socket-proxy.allow.get`.                                                                                                                                                                                                                                                                                                                            |
 | `-proxycontainername`          | `SP_PROXYCONTAINERNAME`          | (not set)              | Provides the name of the socket proxy container to enable per-container allowlists specified by Docker container labels (not available with `-proxysocketendpoint`)                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
 
 ### Changelog

cmd/socket-proxy/handlehttprequest.go

@@ -74,6 +74,17 @@ func determineAllowList(r *http.Request) (config.AllowList, bool) {
 			slog.Warn("cannot get valid IP address for client allowlist check", "reason", err, "method", r.Method, "URL", r.URL, "client", r.RemoteAddr) // #nosec G706 - structured logging (slog) safely encodes values
 		}
 		if !allowedIP {
+			// A container can send its first request before Docker's start event has
+			// updated the per-container allowlist. Refresh it once before denying
+			// the request, while still failing closed if Docker cannot be queried.
+			if cfg.ProxyContainerName != "" {
+				refreshedAllowLists, err := cfg.RefreshAllowLists(r.Context())
+				if err != nil {
+					slog.Warn("failed to refresh per-container allowlists", "error", err)
+				} else if allowList, found := refreshedAllowLists.FindByIP(clientIPStr); found {
+					return allowList, true
+				}
+			}
 			return config.AllowList{}, false
 		}
 	}