You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: README.md
+19-19Lines changed: 19 additions & 19 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -52,7 +52,7 @@ The architectures supported by this image are:
52
52
53
53
## Application Setup
54
54
55
-
You can specify mods to download via the `DOCKER_MODS` environment variable like any other container, or allow discovery through docker by mounting the docker socket into the container (or configuring a suitable alternative endpoint via DOCKER_HOST).
55
+
You can specify mods to download via the `DOCKER_MODS` environment variable like any other container, or allow discovery through docker by mounting the docker socket into the container (or configuring a suitable alternative endpoint via the built-in `DOCKER_HOST` environment variable).
56
56
57
57
The Modmanager container will download all needed mods on startup and then check for updates every 6 hours; if you're using docker discovery it will automatically pick up any new mods.
58
58
@@ -64,38 +64,38 @@ Note that the Modmanager container itself does not support applying mods *or* cu
64
64
65
65
### Security considerations
66
66
67
-
Mapping `docker.sock` is a potential security liability because docker has root access on the host and any process that has full access to `docker.sock` would also have root access on the host. Docker api has no built-in way to set limitations on access, however, you can use a proxy for the `docker.sock` via a solution like [our docker socket proxy](https://github.com/linuxserver/docker-socket-proxy), which adds the ability to limit access. Then you would just set `DOCKER_HOST=` environment variable to point to the proxy address.
67
+
Mapping `docker.sock` is a potential security liability because docker has root access on the host and any process that has full access to `docker.sock` would therefore also have root access on the host. The docker API has no built-in way to set limitations on access, however, you can use a proxy for `docker.sock` via a solution like [our docker socket proxy](https://github.com/linuxserver/docker-socket-proxy), which adds the ability to limit API accessto specific endpoints.
68
68
69
69
### Multiple Hosts
70
70
71
71
>[!NOTE]
72
72
>Make sure you fully understand what you're doing before you try and set this up as there are lots of ways it can go wrong if you're just guessing.
73
73
74
-
Modmanager can query & download mods for remote hosts, as well as the one on which it is installed. At a very basic level if you're just using the DOCKER_MODS env and not the docker integration, simply mount the `/modcache` folder on your remote host(s), ensuring it is mapped for all participating containers.
74
+
Modmanager can query & download mods for remote hosts, as well as the one on which it is installed. At a very basic level if you're just using the `DOCKER_MODS` env and not the docker integration, simply mount the `/modcache` folder on your remote host(s), ensuring it is mapped for all participating containers.
75
75
76
-
If you are using the docker integration, our only supported means for connecting to remote hosts is [our socket proxy container](). Run an instance on each remote host:
76
+
If you are using the docker integration, our only supported means for connecting to remote hosts is [our socket proxy container](https://github.com/linuxserver/docker-socket-proxy/). Run an instance on each remote host:
77
77
78
78
>[!WARNING]
79
-
>DO NOT expose a socket proxy to your LAN that allows any write operations (`POST=1`, `ALLOW_RESTART=1`, etc) or that exposes any more information than is absolutely necessary. NEVER expose a socket proxy to your WAN.
79
+
>DO NOT expose a socket proxy to your LAN if it allows any write operations (`POST=1`, `ALLOW_RESTART=1`, etc) or exposes any API elements that are not absolutely necessary. NEVER expose a socket proxy to your WAN.
80
80
81
81
```yml
82
82
modmanager-dockerproxy:
83
-
image: lscr.io/linuxserver/socket-proxy:latest
84
-
container_name: modmanager-dockerproxy
85
-
environment:
86
-
- CONTAINERS=1
87
-
- POST=0
88
-
volumes:
89
-
- /var/run/docker.sock:/var/run/docker.sock:ro
90
-
tmpfs:
91
-
- /run:exec
92
-
ports:
93
-
- 2375:2375
94
-
restart: unless-stopped
95
-
read_only: true
83
+
image: lscr.io/linuxserver/socket-proxy:latest
84
+
container_name: modmanager-dockerproxy
85
+
environment:
86
+
- CONTAINERS=1
87
+
- POST=0
88
+
volumes:
89
+
- /var/run/docker.sock:/var/run/docker.sock:ro
90
+
tmpfs:
91
+
- /run:exec
92
+
ports:
93
+
- 2375:2375
94
+
restart: unless-stopped
95
+
read_only: true
96
96
```
97
97
98
-
And then add it to the `DOCKER_MODS_EXTRA_HOSTS` env using the full protocol and port, e.g.
98
+
And then add it to the `DOCKER_MODS_EXTRA_HOSTS` env using the full protocol and port, separating multiple servers with a pipe (`\|`), e.g.
Copy file name to clipboardExpand all lines: readme-vars.yml
+19-19Lines changed: 19 additions & 19 deletions
Original file line number
Diff line number
Diff line change
@@ -56,7 +56,7 @@ full_custom_readme: |
56
56
57
57
## Application Setup
58
58
59
-
You can specify mods to download via the `DOCKER_MODS` environment variable like any other container, or allow discovery through docker by mounting the docker socket into the container (or configuring a suitable alternative endpoint via DOCKER_HOST).
59
+
You can specify mods to download via the `DOCKER_MODS` environment variable like any other container, or allow discovery through docker by mounting the docker socket into the container (or configuring a suitable alternative endpoint via the built-in `DOCKER_HOST` environment variable).
60
60
61
61
The Modmanager container will download all needed mods on startup and then check for updates every 6 hours; if you're using docker discovery it will automatically pick up any new mods.
62
62
@@ -68,38 +68,38 @@ full_custom_readme: |
68
68
69
69
### Security considerations
70
70
71
-
Mapping `docker.sock` is a potential security liability because docker has root access on the host and any process that has full access to `docker.sock` would also have root access on the host. Docker api has no built-in way to set limitations on access, however, you can use a proxy for the `docker.sock` via a solution like [our docker socket proxy](https://github.com/linuxserver/docker-socket-proxy), which adds the ability to limit access. Then you would just set `DOCKER_HOST=` environment variable to point to the proxy address.
71
+
Mapping `docker.sock` is a potential security liability because docker has root access on the host and any process that has full access to `docker.sock` would therefore also have root access on the host. The docker API has no built-in way to set limitations on access, however, you can use a proxy for `docker.sock` via a solution like [our docker socket proxy](https://github.com/linuxserver/docker-socket-proxy), which adds the ability to limit API accessto specific endpoints.
72
72
73
73
### Multiple Hosts
74
74
75
75
>[!NOTE]
76
76
>Make sure you fully understand what you're doing before you try and set this up as there are lots of ways it can go wrong if you're just guessing.
77
77
78
-
Modmanager can query & download mods for remote hosts, as well as the one on which it is installed. At a very basic level if you're just using the DOCKER_MODS env and not the docker integration, simply mount the `/modcache` folder on your remote host(s), ensuring it is mapped for all participating containers.
78
+
Modmanager can query & download mods for remote hosts, as well as the one on which it is installed. At a very basic level if you're just using the `DOCKER_MODS` env and not the docker integration, simply mount the `/modcache` folder on your remote host(s), ensuring it is mapped for all participating containers.
79
79
80
-
If you are using the docker integration, our only supported means for connecting to remote hosts is [our socket proxy container](). Run an instance on each remote host:
80
+
If you are using the docker integration, our only supported means for connecting to remote hosts is [our socket proxy container](https://github.com/linuxserver/docker-socket-proxy/). Run an instance on each remote host:
81
81
82
82
>[!WARNING]
83
-
>DO NOT expose a socket proxy to your LAN that allows any write operations (`POST=1`, `ALLOW_RESTART=1`, etc) or that exposes any more information than is absolutely necessary. NEVER expose a socket proxy to your WAN.
83
+
>DO NOT expose a socket proxy to your LAN if it allows any write operations (`POST=1`, `ALLOW_RESTART=1`, etc) or exposes any API elements that are not absolutely necessary. NEVER expose a socket proxy to your WAN.
84
84
85
85
```yml
86
86
modmanager-dockerproxy:
87
-
image: lscr.io/linuxserver/socket-proxy:latest
88
-
container_name: modmanager-dockerproxy
89
-
environment:
90
-
- CONTAINERS=1
91
-
- POST=0
92
-
volumes:
93
-
- /var/run/docker.sock:/var/run/docker.sock:ro
94
-
tmpfs:
95
-
- /run:exec
96
-
ports:
97
-
- 2375:2375
98
-
restart: unless-stopped
99
-
read_only: true
87
+
image: lscr.io/linuxserver/socket-proxy:latest
88
+
container_name: modmanager-dockerproxy
89
+
environment:
90
+
- CONTAINERS=1
91
+
- POST=0
92
+
volumes:
93
+
- /var/run/docker.sock:/var/run/docker.sock:ro
94
+
tmpfs:
95
+
- /run:exec
96
+
ports:
97
+
- 2375:2375
98
+
restart: unless-stopped
99
+
read_only: true
100
100
```
101
101
102
-
And then add it to the `DOCKER_MODS_EXTRA_HOSTS` env using the full protocol and port, e.g.
102
+
And then add it to the `DOCKER_MODS_EXTRA_HOSTS` env using the full protocol and port, separating multiple servers with a pipe (`\|`), e.g.
0 commit comments