[BUG] 403 when try to connect from Portainer

[lealoureiro]

Is there an existing issue for this?

• I have searched the existing issues

Current Behavior

I'm having an error when trying to connect to docker proxy from Portainer.

However allow the info endpoint in my docker-compose.

Expected Behavior

I should be allowed to call info endpoint from Portainer

Steps To Reproduce

URL configured in Portainer:

docker_socket_proxy_hs2:2375

And then trying to Connect to Docker host

Environment

- OS: Ubuntu 24.04
- How docker service was installed: distro's packamanager from Docker repos

Docker creation

services:
    docker_socket_proxy_hs2:
        container_name: docker_socket_proxy_hs2
        image: lscr.io/linuxserver/socket-proxy:3.0.10-r0-ls49
        networks:
            - homeserver-docker-internal
        volumes:
            - /var/run/docker.sock:/var/run/docker.sock:ro
        environment:
            - CONTAINERS=1
            - INFO=1
            - NETWORKS=1
            - PING=1
            - VOLUMES=1
            - LOG_LEVEL=debug
        read_only: true
        tmpfs:
            - /run
networks:
    homeserver-docker-internal:
        external: true

Container logs

[08/May/2025:20:41:29.630] proxy proxy/<NOSRV> 0/-1/-1/-1/0 403 192 - - PR-- 2/2/0/0/0 0/0 "GET /v1.41/info HTTP/1.1"

[github-actions]

Thanks for opening your first issue here! Be sure to follow the relevant issue templates, or risk having this issue marked as invalid.

[thespad]

I can't replicate this using your config, I get a 200 response on the /info endpoint as expected, though your docker API version is EOL so I don't have an easy way to test against it.

[NOTICE]   (1) : Loading success.
::ffff:172.22.0.51:54762 [08/May/2025:22:54:29.399] proxy docker/socket 0/0/0/0/0 200 287 - - ---- 2/2/0/0/0 0/0 "HEAD /_ping HTTP/1.1"
::ffff:172.22.0.51:54764 [08/May/2025:22:54:29.401] proxy docker/socket 0/0/0/7/7 200 1031 - - ---- 3/3/2/2/0 0/0 "GET /v1.41/version HTTP/1.1"
::ffff:172.22.0.51:54748 [08/May/2025:22:54:29.400] proxy docker/socket 0/0/0/9/9 200 2607 - - ---- 3/3/1/1/0 0/0 "GET /v1.41/info HTTP/1.1"
::ffff:172.22.0.51:54762 [08/May/2025:22:54:29.400] proxy docker/socket 0/0/0/15/15 200 239060 - - ---- 3/3/0/0/0 0/0 "GET /v1.47/containers/json?all=1 HTTP/1.1"
::ffff:172.22.0.51:54762 [08/May/2025:22:54:29.419] proxy docker/socket 0/0/0/10/10 200 68157 - - ---- 3/3/0/0/0 0/0 "GET /v1.47/images/json HTTP/1.1"
::ffff:172.22.0.51:54762 [08/May/2025:22:54:29.438] proxy docker/socket 0/0/0/3/3 200 12139 - - ---- 3/3/0/0/0 0/0 "GET /v1.47/info HTTP/1.1"
::ffff:172.22.0.51:54762 [08/May/2025:22:54:29.441] proxy docker/socket 0/0/0/1/1 200 15490 - - ---- 3/3/0/0/0 0/0 "GET /v1.47/volumes HTTP/1.1"

[lealoureiro]

Did you tried with Portainer? looks like the url has something different.
With uptime-kuma works for me.
Where you can see my version of Docker is EOL?

[thespad]

Yes, I'm testing with Portainer. It may just be an artifact of it being unable to query any other endpoints that it's only attempting to use the v1.41 API, which is 4+ years old at this point.

The fact you're not hitting the docker/socket backend in the log is because of the 403, so it never sends the traffic there.

[lealoureiro]

Why do you think is using older version?
I'm using latest available versions for Docker in Ubuntu 24.04:

Client: Docker Engine - Community
 Version:           28.1.1
 API version:       1.49
 Go version:        go1.23.8
 Git commit:        4eba377
 Built:             Fri Apr 18 09:52:14 2025
 OS/Arch:           linux/amd64
 Context:           default

Server: Docker Engine - Community
 Engine:
  Version:          28.1.1
  API version:      1.49 (minimum version 1.24)
  Go version:       go1.23.8
  Git commit:       01f442b
  Built:            Fri Apr 18 09:52:14 2025
  OS/Arch:          linux/amd64
  Experimental:     false
 containerd:
  Version:          1.7.27
  GitCommit:        05044ec0a9a75232cad458027ca83437aae3f4da
 runc:
  Version:          1.2.5
  GitCommit:        v1.2.5-0-g59923ef
 docker-init:
  Version:          0.19.0
  GitCommit:        de40ad0

And using quite recent version of Portainer: 2.27.4 LTS

[LinuxServer-CI]

This issue has been automatically marked as stale because it has not had recent activity. This might be due to missing feedback from OP. It will be closed if no further activity occurs. Thank you for your contributions.

[lealoureiro]

Problem seems to be fixed now after updating portainer to 2.27.9 LTS and socket proxy to 3.2.1-r0-ls51.
I believe just updating portainer was enough.