Add ALLOW_PAUSE/ALLOW_UNPAUSE, bump upstream to ls75, update tooling

- Add ALLOW_PAUSE and ALLOW_UNPAUSE options (synced from upstream ls75)
- Bump upstream reference to linuxserver/docker-socket-proxy:3.2.15-r0-ls75
- Update pre-commit hooks: pre-commit-hooks v6.0.0, yamllint v1.38.0, shellcheck-py v0.11.0.1, hadolint v2.14.0
- Update GitHub Actions: actions/checkout v6, actions/setup-python v6
- Version 1.2.0

Author: fergus

.github/workflows/ci.yaml

@@ -10,8 +10,8 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v6
+      - uses: actions/setup-python@v6
         with:
           python-version: "3.12"
       - run: pip install pre-commit
@@ -21,8 +21,8 @@ jobs:
     needs: lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v6
+      - uses: actions/setup-python@v6
         with:
           python-version: "3.12"
       - run: pip install pyyaml
@@ -32,7 +32,7 @@ jobs:
     needs: test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - run: |
           docker build \
             --build-arg BUILD_FROM=ghcr.io/home-assistant/amd64-base:3.23 \

.pre-commit-config.yaml

@@ -1,6 +1,6 @@
 repos:
   - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v5.0.0
+    rev: v6.0.0
     hooks:
       - id: trailing-whitespace
       - id: end-of-file-fixer
@@ -9,21 +9,21 @@ repos:
       - id: check-added-large-files
 
   - repo: https://github.com/adrienverge/yamllint
-    rev: v1.35.1
+    rev: v1.38.0
     hooks:
       - id: yamllint
         args: [-c, .yamllint.yaml]
 
   - repo: https://github.com/shellcheck-py/shellcheck-py
-    rev: v0.10.0.1
+    rev: v0.11.0.1
     hooks:
       - id: shellcheck
         args: [--severity=warning]
         files: ^socket-proxy/rootfs/etc/services\.d/socket-proxy/run$
         types: [file]
 
   - repo: https://github.com/hadolint/hadolint
-    rev: v2.12.0
+    rev: v2.14.0
     hooks:
       - id: hadolint-docker
         files: Dockerfile$

socket-proxy/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## 1.2.0
+
+- Add `ALLOW_PAUSE` and `ALLOW_UNPAUSE` options — allow pausing and unpausing containers (synced from upstream linuxserver/docker-socket-proxy 3.2.15-r0-ls75)
+- Bump upstream reference to linuxserver/docker-socket-proxy 3.2.15-r0-ls75
+- Update pre-commit hooks: pre-commit-hooks v6.0.0, yamllint v1.38.0, shellcheck-py v0.11.0.1, hadolint v2.14.0
+- Update GitHub Actions: actions/checkout v6, actions/setup-python v6
+
 ## 1.1.2
 
 - Bump HAProxy from 3.2.13-r0 to 3.2.15-r0 (Alpine 3.23 package update)

socket-proxy/build.yaml

@@ -1,4 +1,4 @@
-# Upstream reference: linuxserver/docker-socket-proxy:3.2.13-r0-ls70
+# Upstream reference: linuxserver/docker-socket-proxy:3.2.15-r0-ls75
 build_from:
   aarch64: ghcr.io/home-assistant/aarch64-base:3.23
   amd64: ghcr.io/home-assistant/amd64-base:3.23

socket-proxy/config.yaml

@@ -3,7 +3,7 @@ description: >-
   Filtered, read-only Docker socket proxy using HAProxy.
   Requires Protection mode to be disabled (Info tab) for Docker socket access.
 slug: socket-proxy
-version: 1.1.2
+version: 1.2.0
 url: https://github.com/fergus/haos-docker-socket-proxy
 arch:
   - amd64
@@ -24,6 +24,8 @@ options:
   ALLOW_START: false
   ALLOW_STOP: false
   ALLOW_RESTARTS: false
+  ALLOW_PAUSE: false
+  ALLOW_UNPAUSE: false
   ALLOWED_CIDRS: []
   AUTH: false
   BUILD: false
@@ -56,6 +58,8 @@ schema:
   ALLOW_START: bool
   ALLOW_STOP: bool
   ALLOW_RESTARTS: bool
+  ALLOW_PAUSE: bool
+  ALLOW_UNPAUSE: bool
   ALLOWED_CIDRS:
     - str
   AUTH: bool

socket-proxy/rootfs/etc/services.d/socket-proxy/run

@@ -37,8 +37,8 @@ bashio::log.info "  +------------------------------------+"
 bashio::log.info ""
 
 # Version and config info
-ADDON_VERSION="1.1.2"
-UPSTREAM_PIN="linuxserver/docker-socket-proxy:3.2.15-r0-ls71"
+ADDON_VERSION="1.2.0"
+UPSTREAM_PIN="linuxserver/docker-socket-proxy:3.2.15-r0-ls75"
 bashio::log.info "Version:   ${ADDON_VERSION}"
 bashio::log.info "Upstream:  ${UPSTREAM_PIN}"
 
@@ -61,6 +61,8 @@ is_valid_cidr() {
 ALLOW_START=$(bool2int 'ALLOW_START')
 ALLOW_STOP=$(bool2int 'ALLOW_STOP')
 ALLOW_RESTARTS=$(bool2int 'ALLOW_RESTARTS')
+ALLOW_PAUSE=$(bool2int 'ALLOW_PAUSE')
+ALLOW_UNPAUSE=$(bool2int 'ALLOW_UNPAUSE')
 AUTH=$(bool2int 'AUTH')
 BUILD=$(bool2int 'BUILD')
 COMMIT=$(bool2int 'COMMIT')
@@ -88,7 +90,7 @@ TASKS=$(bool2int 'TASKS')
 VERSION=$(bool2int 'VERSION')
 VOLUMES=$(bool2int 'VOLUMES')
 
-export ALLOW_START ALLOW_STOP ALLOW_RESTARTS AUTH BUILD COMMIT CONFIGS
+export ALLOW_START ALLOW_STOP ALLOW_RESTARTS ALLOW_PAUSE ALLOW_UNPAUSE AUTH BUILD COMMIT CONFIGS
 export CONTAINERS DISABLE_IPV6 DISTRIBUTION EVENTS EXEC GRPC IMAGES INFO
 export LOG_LEVEL NETWORKS NODES PING PLUGINS POST SECRETS SERVICES
 export SESSION SWARM SYSTEM TASKS VERSION VOLUMES
@@ -156,6 +158,8 @@ if [ "${POST}" = "1" ]; then WRITE_OPS+=("POST"); fi
 if [ "${ALLOW_START}" = "1" ]; then WRITE_OPS+=("ALLOW_START"); fi
 if [ "${ALLOW_STOP}" = "1" ]; then WRITE_OPS+=("ALLOW_STOP"); fi
 if [ "${ALLOW_RESTARTS}" = "1" ]; then WRITE_OPS+=("ALLOW_RESTARTS"); fi
+if [ "${ALLOW_PAUSE}" = "1" ]; then WRITE_OPS+=("ALLOW_PAUSE"); fi
+if [ "${ALLOW_UNPAUSE}" = "1" ]; then WRITE_OPS+=("ALLOW_UNPAUSE"); fi
 
 bashio::log.info "Port:      ${PORT}"
 bashio::log.info "IPv6:      $([ "${DISABLE_IPV6}" = "1" ] && echo 'disabled' || echo 'enabled')"

socket-proxy/rootfs/templates/haproxy.cfg

@@ -36,6 +36,8 @@ frontend proxy
     http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/containers/[a-zA-Z0-9_.-]+/((stop)|(restart)|(kill)) } { env(ALLOW_RESTARTS) -m bool }
     http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/containers/[a-zA-Z0-9_.-]+/start } { env(ALLOW_START) -m bool }
     http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/containers/[a-zA-Z0-9_.-]+/stop } { env(ALLOW_STOP) -m bool }
+    http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/containers/[a-zA-Z0-9_.-]+/pause } { env(ALLOW_PAUSE) -m bool }
+    http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/containers/[a-zA-Z0-9_.-]+/unpause } { env(ALLOW_UNPAUSE) -m bool }
     http-request deny unless METH_GET || { env(POST) -m bool }
     http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/auth } { env(AUTH) -m bool }
     http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/build } { env(BUILD) -m bool }

socket-proxy/translations/en.yaml

@@ -11,6 +11,12 @@ configuration:
   ALLOW_RESTARTS:
     name: Allow Restarts
     description: Allow restarting, stopping, and killing containers.
+  ALLOW_PAUSE:
+    name: Allow Pause
+    description: Allow pausing containers (POST .../pause).
+  ALLOW_UNPAUSE:
+    name: Allow Unpause
+    description: Allow unpausing containers (POST .../unpause).
   ALLOWED_CIDRS:
     name: Allowed Source IPs
     description: List of IP addresses or CIDR ranges permitted to connect. Leave empty to allow all sources.