Skip to content

Add improved controls for accessing container subpaths #52

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
thespad merged 3 commits into from
Aug 18, 2026
Merged

Add improved controls for accessing container subpaths #52

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
b31b2ff
Add improved controls for accessing container subpaths
thespad Aug 18, 2026
4a89553
Streamline docker + libpod config for ALLOW_ envs
thespad Aug 18, 2026
eaa43ca
Remove libpod ALLOW_ paths from readme, use globals
thespad Aug 18, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 7 additions & 2 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,10 +29,15 @@ RUN \
/etc/haproxy \
/tmp/*

ENV ALLOW_RESTARTS=0 \
ENV ALLOW_ARCHIVE=0 \
ALLOW_CHANGES=0 \
ALLOW_EXPORT=0 \
ALLOW_LOGS=0 \
ALLOW_PAUSE=0 \
ALLOW_RESTARTS=0 \
ALLOW_STOP=0 \
ALLOW_START=0 \
ALLOW_PAUSE=0 \
ALLOW_TOP=0 \
ALLOW_UNPAUSE=0 \
AUTH=0 \
BUILD=0 \
Expand Down
9 changes: 7 additions & 2 deletions Dockerfile.aarch64
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,10 +29,15 @@ RUN \
/etc/haproxy \
/tmp/*

ENV ALLOW_RESTARTS=0 \
ENV ALLOW_ARCHIVE=0 \
ALLOW_CHANGES=0 \
ALLOW_EXPORT=0 \
ALLOW_LOGS=0 \
ALLOW_PAUSE=0 \
ALLOW_RESTARTS=0 \
ALLOW_STOP=0 \
ALLOW_START=0 \
ALLOW_PAUSE=0 \
ALLOW_TOP=0 \
ALLOW_UNPAUSE=0 \
AUTH=0 \
BUILD=0 \
Expand Down
9 changes: 7 additions & 2 deletions Dockerfile.riscv64
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,10 +29,15 @@ RUN \
/etc/haproxy \
/tmp/*

ENV ALLOW_RESTARTS=0 \
ENV ALLOW_ARCHIVE=0 \
ALLOW_CHANGES=0 \
ALLOW_EXPORT=0 \
ALLOW_LOGS=0 \
ALLOW_PAUSE=0 \
ALLOW_RESTARTS=0 \
ALLOW_STOP=0 \
ALLOW_START=0 \
ALLOW_PAUSE=0 \
ALLOW_TOP=0 \
ALLOW_UNPAUSE=0 \
AUTH=0 \
BUILD=0 \
Expand Down
68 changes: 27 additions & 41 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -150,10 +150,15 @@ services:
image: lscr.io/linuxserver/socket-proxy:latest
container_name: socket-proxy
environment:
- ALLOW_START=0 #optional
- ALLOW_STOP=0 #optional
- ALLOW_RESTARTS=0 #optional
- ALLOW_ARCHIVE=0 #optional
- ALLOW_CHANGES=0 #optional
- ALLOW_EXPORT=0 #optional
- ALLOW_LOGS=0 #optional
- ALLOW_PAUSE=0 #optional
- ALLOW_RESTARTS=0 #optional
- ALLOW_STOP=0 #optional
- ALLOW_START=0 #optional
- ALLOW_TOP=0 #optional
- ALLOW_UNPAUSE=0 #optional
- AUTH=0 #optional
- BUILD=0 #optional
Expand Down Expand Up @@ -181,16 +186,6 @@ services:
- TZ=Etc/UTC #optional
- VERSION=1 #optional
- VOLUMES=0 #optional
- LIBPOD_ALLOW_PAUSE=0 #optional
- LIBPOD_ALLOW_POD_PAUSE=0 #optional
- LIBPOD_ALLOW_POD_RESTARTS=0 #optional
- LIBPOD_ALLOW_POD_START=0 #optional
- LIBPOD_ALLOW_POD_STOP=0 #optional
- LIBPOD_ALLOW_POD_UNPAUSE=0 #optional
- LIBPOD_ALLOW_RESTARTS=0 #optional
- LIBPOD_ALLOW_START=0 #optional
- LIBPOD_ALLOW_STOP=0 #optional
- LIBPOD_ALLOW_UNPAUSE=0 #optional
- LIBPOD_CONTAINERS=0 #optional
- LIBPOD_EVENTS=0 #optional
- LIBPOD_EXEC=0 #optional
Expand Down Expand Up @@ -219,10 +214,15 @@ services:
```bash
docker run -d \
--name=socket-proxy \
-e ALLOW_START=0 `#optional` \
-e ALLOW_STOP=0 `#optional` \
-e ALLOW_RESTARTS=0 `#optional` \
-e ALLOW_ARCHIVE=0 `#optional` \
-e ALLOW_CHANGES=0 `#optional` \
-e ALLOW_EXPORT=0 `#optional` \
-e ALLOW_LOGS=0 `#optional` \
-e ALLOW_PAUSE=0 `#optional` \
-e ALLOW_RESTARTS=0 `#optional` \
-e ALLOW_STOP=0 `#optional` \
-e ALLOW_START=0 `#optional` \
-e ALLOW_TOP=0 `#optional` \
-e ALLOW_UNPAUSE=0 `#optional` \
-e AUTH=0 `#optional` \
-e BUILD=0 `#optional` \
Expand Down Expand Up @@ -250,16 +250,6 @@ docker run -d \
-e TZ=Etc/UTC `#optional` \
-e VERSION=1 `#optional` \
-e VOLUMES=0 `#optional` \
-e LIBPOD_ALLOW_PAUSE=0 `#optional` \
-e LIBPOD_ALLOW_POD_PAUSE=0 `#optional` \
-e LIBPOD_ALLOW_POD_RESTARTS=0 `#optional` \
-e LIBPOD_ALLOW_POD_START=0 `#optional` \
-e LIBPOD_ALLOW_POD_STOP=0 `#optional` \
-e LIBPOD_ALLOW_POD_UNPAUSE=0 `#optional` \
-e LIBPOD_ALLOW_RESTARTS=0 `#optional` \
-e LIBPOD_ALLOW_START=0 `#optional` \
-e LIBPOD_ALLOW_STOP=0 `#optional` \
-e LIBPOD_ALLOW_UNPAUSE=0 `#optional` \
-e LIBPOD_CONTAINERS=0 `#optional` \
-e LIBPOD_EVENTS=0 `#optional` \
-e LIBPOD_EXEC=0 `#optional` \
Expand Down Expand Up @@ -288,11 +278,16 @@ Containers are configured using parameters passed at runtime (such as those abov

| Parameter | Function |
| :----: | --- |
| `-e ALLOW_START=0` | `/containers/{id}/start` - **This option will work even if `POST=0`** |
| `-e ALLOW_STOP=0` | `/containers/{id}/stop` - **This option will work even if `POST=0`** |
| `-e ALLOW_RESTARTS=0` | `/containers/{id}/stop`, `/containers/{id}/restart`, and `/containers/{id}/kill` - **This option will work even if `POST=0`** |
| `-e ALLOW_PAUSE=0` | `/containers/{id}/pause` - **This option will work even if `POST=0`** |
| `-e ALLOW_UNPAUSE=0` | `/containers/{id}/unpause` - **This option will work even if `POST=0`** |
| `-e ALLOW_ARCHIVE=0` | `(/libpod)?/(containers|pods)/{id}/archive` - **This option is independent of `POST`** |
| `-e ALLOW_CHANGES=0` | `(/libpod)?/(containers|pods)/{id}/changes` - **This option is independent of `POST`** |
| `-e ALLOW_EXPORT=0` | `(/libpod)?/(containers|pods)/{id}/export` - **This option is independent of `POST`** |
| `-e ALLOW_LOGS=0` | `(/libpod)?/(containers|pods)/{id}/logs` - **This option is independent of `POST`** |
| `-e ALLOW_PAUSE=0` | `(/libpod)?/(containers|pods)/{id}/pause` - **This option will work even if `POST=0`** |
| `-e ALLOW_RESTARTS=0` | `(/libpod)?/(containers|pods)/{id}/stop`, `/(/libpod)?/(containers|pods)/{id}/restart`, and `/(/libpod)?/(containers|pods)/{id}/kill` - **This option will work even if `POST=0`** |
| `-e ALLOW_START=0` | `(/libpod)?/(containers|pods)/{id}/start` - **This option will work even if `POST=0`** |
| `-e ALLOW_STOP=0` | `(/libpod)?/(containers|pods)/{id}/stop` - **This option will work even if `POST=0`** |
| `-e ALLOW_TOP=0` | `(/libpod)?/(containers|pods)/{id}/top` - **This option is independent of `POST`** |
| `-e ALLOW_UNPAUSE=0` | `(/libpod)?/(containers|pods)/{id}/unpause` - **This option will work even if `POST=0`** |
| `-e AUTH=0` | `/auth` |
| `-e BUILD=0` | `/build` |
| `-e COMMIT=0` | `/commit` |
Expand Down Expand Up @@ -320,16 +315,6 @@ Containers are configured using parameters passed at runtime (such as those abov
| `-e VERSION=1` | `/version` |
| `-e VOLUMES=0` | `/volumes` |
| **Podman libpod API** | |
| `-e LIBPOD_ALLOW_START=0` | `/libpod/containers/{id}/start` - **This option will work even if `POST=0`** |
| `-e LIBPOD_ALLOW_STOP=0` | `/libpod/containers/{id}/stop` - **This option will work even if `POST=0`** |
| `-e LIBPOD_ALLOW_RESTARTS=0` | `/libpod/containers/{id}/stop`, `/libpod/containers/{id}/restart`, and `/libpod/containers/{id}/kill` - **This option will work even if `POST=0`** |
| `-e LIBPOD_ALLOW_PAUSE=0` | `/libpod/containers/{id}/pause` - **This option will work even if `POST=0`** |
| `-e LIBPOD_ALLOW_UNPAUSE=0` | `/libpod/containers/{id}/unpause` - **This option will work even if `POST=0`** |
| `-e LIBPOD_ALLOW_POD_START=0` | `/libpod/pods/{name}/start` - **This option will work even if `POST=0`** |
| `-e LIBPOD_ALLOW_POD_STOP=0` | `/libpod/pods/{name}/stop` - **This option will work even if `POST=0`** |
| `-e LIBPOD_ALLOW_POD_RESTARTS=0` | `/libpod/pods/{name}/stop`, `/libpod/pods/{name}/restart`, and `/libpod/pods/{name}/kill` - **This option will work even if `POST=0`** |
| `-e LIBPOD_ALLOW_POD_PAUSE=0` | `/libpod/pods/{name}/pause` - **This option will work even if `POST=0`** |
| `-e LIBPOD_ALLOW_POD_UNPAUSE=0` | `/libpod/pods/{name}/unpause` - **This option will work even if `POST=0`** |
| `-e LIBPOD_CONTAINERS=0` | `/libpod/containers` |
| `-e LIBPOD_EVENTS=0` | `/libpod/events` |
| `-e LIBPOD_EXEC=0` | `/libpod/exec` |
Expand Down Expand Up @@ -469,6 +454,7 @@ Once registered you can define the dockerfile to use with `-f Dockerfile.aarch64

## Versions

* **18.08.26:** - Add `ALLOW_ARCHIVE`, `ALLOW_CHANGES`, `ALLOW_EXPORT`, `ALLOW_LOGS`, `ALLOW_TOP` options.
* **15.06.26:** - Rebase to Alpine 3.24.
* **13.06.26:** - Add libpod API support for Podman via `LIBPOD_*` environment variables.
* **24.02.26:** - Add `ALLOW_PAUSE` and `ALLOW_UNPAUSE`.
Expand Down
68 changes: 27 additions & 41 deletions readme-vars.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -157,10 +157,15 @@ full_custom_readme: |
image: lscr.io/linuxserver/socket-proxy:latest
container_name: socket-proxy
environment:
- ALLOW_START=0 #optional
- ALLOW_STOP=0 #optional
- ALLOW_RESTARTS=0 #optional
- ALLOW_ARCHIVE=0 #optional
- ALLOW_CHANGES=0 #optional
- ALLOW_EXPORT=0 #optional
- ALLOW_LOGS=0 #optional
- ALLOW_PAUSE=0 #optional
- ALLOW_RESTARTS=0 #optional
- ALLOW_STOP=0 #optional
- ALLOW_START=0 #optional
- ALLOW_TOP=0 #optional
- ALLOW_UNPAUSE=0 #optional
- AUTH=0 #optional
- BUILD=0 #optional
Expand Down Expand Up @@ -188,16 +193,6 @@ full_custom_readme: |
- TZ=Etc/UTC #optional
- VERSION=1 #optional
- VOLUMES=0 #optional
- LIBPOD_ALLOW_PAUSE=0 #optional
- LIBPOD_ALLOW_POD_PAUSE=0 #optional
- LIBPOD_ALLOW_POD_RESTARTS=0 #optional
- LIBPOD_ALLOW_POD_START=0 #optional
- LIBPOD_ALLOW_POD_STOP=0 #optional
- LIBPOD_ALLOW_POD_UNPAUSE=0 #optional
- LIBPOD_ALLOW_RESTARTS=0 #optional
- LIBPOD_ALLOW_START=0 #optional
- LIBPOD_ALLOW_STOP=0 #optional
- LIBPOD_ALLOW_UNPAUSE=0 #optional
- LIBPOD_CONTAINERS=0 #optional
- LIBPOD_EVENTS=0 #optional
- LIBPOD_EXEC=0 #optional
Expand Down Expand Up @@ -226,10 +221,15 @@ full_custom_readme: |
```bash
docker run -d \
--name=socket-proxy \
-e ALLOW_START=0 `#optional` \
-e ALLOW_STOP=0 `#optional` \
-e ALLOW_RESTARTS=0 `#optional` \
-e ALLOW_ARCHIVE=0 `#optional` \
-e ALLOW_CHANGES=0 `#optional` \
-e ALLOW_EXPORT=0 `#optional` \
-e ALLOW_LOGS=0 `#optional` \
-e ALLOW_PAUSE=0 `#optional` \
-e ALLOW_RESTARTS=0 `#optional` \
-e ALLOW_STOP=0 `#optional` \
-e ALLOW_START=0 `#optional` \
-e ALLOW_TOP=0 `#optional` \
-e ALLOW_UNPAUSE=0 `#optional` \
-e AUTH=0 `#optional` \
-e BUILD=0 `#optional` \
Expand Down Expand Up @@ -257,16 +257,6 @@ full_custom_readme: |
-e TZ=Etc/UTC `#optional` \
-e VERSION=1 `#optional` \
-e VOLUMES=0 `#optional` \
-e LIBPOD_ALLOW_PAUSE=0 `#optional` \
-e LIBPOD_ALLOW_POD_PAUSE=0 `#optional` \
-e LIBPOD_ALLOW_POD_RESTARTS=0 `#optional` \
-e LIBPOD_ALLOW_POD_START=0 `#optional` \
-e LIBPOD_ALLOW_POD_STOP=0 `#optional` \
-e LIBPOD_ALLOW_POD_UNPAUSE=0 `#optional` \
-e LIBPOD_ALLOW_RESTARTS=0 `#optional` \
-e LIBPOD_ALLOW_START=0 `#optional` \
-e LIBPOD_ALLOW_STOP=0 `#optional` \
-e LIBPOD_ALLOW_UNPAUSE=0 `#optional` \
-e LIBPOD_CONTAINERS=0 `#optional` \
-e LIBPOD_EVENTS=0 `#optional` \
-e LIBPOD_EXEC=0 `#optional` \
Expand Down Expand Up @@ -295,11 +285,16 @@ full_custom_readme: |

| Parameter | Function |
| :----: | --- |
| `-e ALLOW_START=0` | `/containers/{id}/start` - **This option will work even if `POST=0`** |
| `-e ALLOW_STOP=0` | `/containers/{id}/stop` - **This option will work even if `POST=0`** |
| `-e ALLOW_RESTARTS=0` | `/containers/{id}/stop`, `/containers/{id}/restart`, and `/containers/{id}/kill` - **This option will work even if `POST=0`** |
| `-e ALLOW_PAUSE=0` | `/containers/{id}/pause` - **This option will work even if `POST=0`** |
| `-e ALLOW_UNPAUSE=0` | `/containers/{id}/unpause` - **This option will work even if `POST=0`** |
| `-e ALLOW_ARCHIVE=0` | `(/libpod)?/(containers|pods)/{id}/archive` - **This option is independent of `POST`** |
| `-e ALLOW_CHANGES=0` | `(/libpod)?/(containers|pods)/{id}/changes` - **This option is independent of `POST`** |
| `-e ALLOW_EXPORT=0` | `(/libpod)?/(containers|pods)/{id}/export` - **This option is independent of `POST`** |
| `-e ALLOW_LOGS=0` | `(/libpod)?/(containers|pods)/{id}/logs` - **This option is independent of `POST`** |
| `-e ALLOW_PAUSE=0` | `(/libpod)?/(containers|pods)/{id}/pause` - **This option will work even if `POST=0`** |
| `-e ALLOW_RESTARTS=0` | `(/libpod)?/(containers|pods)/{id}/stop`, `(/libpod)?/(containers|pods)/{id}/restart`, and `(/libpod)?/(containers|pods)/{id}/kill` - **This option will work even if `POST=0`** |
| `-e ALLOW_START=0` | `(/libpod)?/(containers|pods)/{id}/start` - **This option will work even if `POST=0`** |
| `-e ALLOW_STOP=0` | `(/libpod)?/(containers|pods)/{id}/stop` - **This option will work even if `POST=0`** |
| `-e ALLOW_TOP=0` | `(/libpod)?/(containers|pods)/{id}/top` - **This option is independent of `POST`** |
| `-e ALLOW_UNPAUSE=0` | `(/libpod)?/(containers|pods)/{id}/unpause` - **This option will work even if `POST=0`** |
| `-e AUTH=0` | `/auth` |
| `-e BUILD=0` | `/build` |
| `-e COMMIT=0` | `/commit` |
Expand Down Expand Up @@ -327,16 +322,6 @@ full_custom_readme: |
| `-e VERSION=1` | `/version` |
| `-e VOLUMES=0` | `/volumes` |
| **Podman libpod API** | |
| `-e LIBPOD_ALLOW_START=0` | `/libpod/containers/{id}/start` - **This option will work even if `POST=0`** |
| `-e LIBPOD_ALLOW_STOP=0` | `/libpod/containers/{id}/stop` - **This option will work even if `POST=0`** |
| `-e LIBPOD_ALLOW_RESTARTS=0` | `/libpod/containers/{id}/stop`, `/libpod/containers/{id}/restart`, and `/libpod/containers/{id}/kill` - **This option will work even if `POST=0`** |
| `-e LIBPOD_ALLOW_PAUSE=0` | `/libpod/containers/{id}/pause` - **This option will work even if `POST=0`** |
| `-e LIBPOD_ALLOW_UNPAUSE=0` | `/libpod/containers/{id}/unpause` - **This option will work even if `POST=0`** |
| `-e LIBPOD_ALLOW_POD_START=0` | `/libpod/pods/{name}/start` - **This option will work even if `POST=0`** |
| `-e LIBPOD_ALLOW_POD_STOP=0` | `/libpod/pods/{name}/stop` - **This option will work even if `POST=0`** |
| `-e LIBPOD_ALLOW_POD_RESTARTS=0` | `/libpod/pods/{name}/stop`, `/libpod/pods/{name}/restart`, and `/libpod/pods/{name}/kill` - **This option will work even if `POST=0`** |
| `-e LIBPOD_ALLOW_POD_PAUSE=0` | `/libpod/pods/{name}/pause` - **This option will work even if `POST=0`** |
| `-e LIBPOD_ALLOW_POD_UNPAUSE=0` | `/libpod/pods/{name}/unpause` - **This option will work even if `POST=0`** |
| `-e LIBPOD_CONTAINERS=0` | `/libpod/containers` |
| `-e LIBPOD_EVENTS=0` | `/libpod/events` |
| `-e LIBPOD_EXEC=0` | `/libpod/exec` |
Expand Down Expand Up @@ -476,6 +461,7 @@ full_custom_readme: |

## Versions

* **18.08.26:** - Add `ALLOW_ARCHIVE`, `ALLOW_CHANGES`, `ALLOW_EXPORT`, `ALLOW_LOGS`, `ALLOW_TOP` options.
* **15.06.26:** - Rebase to Alpine 3.24.
* **13.06.26:** - Add libpod API support for Podman via `LIBPOD_*` environment variables.
* **24.02.26:** - Add `ALLOW_PAUSE` and `ALLOW_UNPAUSE`.
Expand Down
31 changes: 23 additions & 8 deletions root/templates/haproxy.cfg
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,8 @@ global
log stdout format raw daemon "${LOG_LEVEL}"
pidfile /run/haproxy.pid
maxconn 2000
user root
chroot /

defaults
mode http
Expand All @@ -25,13 +27,26 @@ backend docker

frontend proxy
bind @@BIND_PROTO@@
http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/containers/[a-zA-Z0-9_.-]+/((stop)|(restart)|(kill)) } { env(ALLOW_RESTARTS) -m bool }
http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/containers/[a-zA-Z0-9_.-]+/start } { env(ALLOW_START) -m bool }
http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/containers/[a-zA-Z0-9_.-]+/stop } { env(ALLOW_STOP) -m bool }
http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/containers/[a-zA-Z0-9_.-]+/pause } { env(ALLOW_PAUSE) -m bool }
http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/containers/[a-zA-Z0-9_.-]+/unpause } { env(ALLOW_UNPAUSE) -m bool }

# libpod endpoints

acl allow_archive env(ALLOW_ARCHIVE) -m bool
acl allow_change env(ALLOW_CHANGE) -m bool
acl allow_export env(ALLOW_EXPORT) -m bool
acl allow_logs env(ALLOW_LOGS) -m bool
acl allow_top env(ALLOW_TOP) -m bool

http-request deny if { path,url_dec -m reg -i ^(/v[\d\.]+)?(/libpod)?/(containers|pods)/[a-zA-Z0-9_.-]+/(archive) } !allow_archive
http-request deny if { path,url_dec -m reg -i ^(/v[\d\.]+)?(/libpod)?/(containers|pods)/[a-zA-Z0-9_.-]+/(change) } !allow_change
http-request deny if { path,url_dec -m reg -i ^(/v[\d\.]+)?(/libpod)?/(containers|pods)/[a-zA-Z0-9_.-]+/(export) } !allow_export
http-request deny if { path,url_dec -m reg -i ^(/v[\d\.]+)?(/libpod)?/(containers|pods)/[a-zA-Z0-9_.-]+/(logs) } !allow_logs
http-request deny if { path,url_dec -m reg -i ^(/v[\d\.]+)?(/libpod)?/(containers|pods)/[a-zA-Z0-9_.-]+/(top) } !allow_top

http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?(/libpod)?/(containers|pods)/[a-zA-Z0-9_.-]+/((stop)|(restart)|(kill)) } { env(ALLOW_RESTARTS) -m bool }
http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?(/libpod)?/(containers|pods)/[a-zA-Z0-9_.-]+/start } { env(ALLOW_START) -m bool }
http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?(/libpod)?/(containers|pods)/[a-zA-Z0-9_.-]+/stop } { env(ALLOW_STOP) -m bool }
http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?(/libpod)?/(containers|pods)/[a-zA-Z0-9_.-]+/pause } { env(ALLOW_PAUSE) -m bool }
http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?(/libpod)?/(containers|pods)/[a-zA-Z0-9_.-]+/unpause } { env(ALLOW_UNPAUSE) -m bool }

# legacy libpod endpoints
http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/libpod/containers/[a-zA-Z0-9_.-]+/((stop)|(restart)|(kill)) } { env(LIBPOD_ALLOW_RESTARTS) -m bool }
http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/libpod/containers/[a-zA-Z0-9_.-]+/start } { env(LIBPOD_ALLOW_START) -m bool }
http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/libpod/containers/[a-zA-Z0-9_.-]+/stop } { env(LIBPOD_ALLOW_STOP) -m bool }
Expand All @@ -42,7 +57,7 @@ frontend proxy
http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/libpod/pods/[a-zA-Z0-9_.-]+/stop } { env(LIBPOD_ALLOW_POD_STOP) -m bool }
http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/libpod/pods/[a-zA-Z0-9_.-]+/pause } { env(LIBPOD_ALLOW_POD_PAUSE) -m bool }
http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/libpod/pods/[a-zA-Z0-9_.-]+/unpause } { env(LIBPOD_ALLOW_POD_UNPAUSE) -m bool }

http-request deny unless METH_GET || { env(POST) -m bool }
http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/auth } { env(AUTH) -m bool }
http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/build } { env(BUILD) -m bool }
Expand Down