Docker Socket Proxy

The edge stack includes an easily-overlooked service: docker-proxy, a minimal nginx:1.30-alpine. It exists to solve one specific incompatibility between Traefik 3 and OrbStack.

The problem

Traefik 3 discovers containers by calling the Docker API, and it hardcodes API version v1.24 in the request path (/v1.24/containers/json, etc.). Docker Desktop tolerates this. OrbStack does not — it rejects the pinned legacy version, and Traefik’s docker provider fails to see any containers, so nothing gets routed.

The fix

docker-proxy is an nginx reverse proxy that sits between Traefik and the real Docker socket. It listens on port 2375 inside the edge network and forwards to unix:/var/run/docker.sock, rewriting the URL to strip the /vNN.NN/ version prefix.

Traefik ──► docker-proxy:2375 ──(strip /v1.24/)──► unix:/var/run/docker.sock

With the version prefix removed, the Docker daemon answers using its own default API version — which OrbStack accepts — and Traefik’s discovery works again.

Traefik is configured to use this proxy as its provider endpoint (docker-proxy:2375) rather than mounting the socket directly.

Files

File	Purpose
edge/docker-proxy/nginx.conf	The server block on port 2375 that proxies to the socket and rewrites the version prefix.
edge/docker-proxy/nginx.main.conf	Minimal top-level nginx config (worker processes, events).

Not a security proxy

Despite the name, docker-socket-proxy here is a version-stripping shim, not an access-control layer. Its sole job is making Traefik 3 and OrbStack agree on an API version.

Why it has no host ports

Like every edge service, docker-proxy publishes nothing to the host — it’s only ever reached from inside the multi-docker-edge network by Traefik. See The Edge Stack for the full service list.