diff --git a/Dockerfile b/Dockerfile
index b45f6a4..0c6afc3 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -29,10 +29,15 @@ RUN \
     /etc/haproxy \
     /tmp/*
 
-ENV ALLOW_RESTARTS=0 \
+ENV ALLOW_ARCHIVE=0 \
+  ALLOW_CHANGES=0 \
+  ALLOW_EXPORT=0 \
+  ALLOW_LOGS=0 \
+  ALLOW_PAUSE=0 \
+  ALLOW_RESTARTS=0 \
   ALLOW_STOP=0 \
   ALLOW_START=0 \
-  ALLOW_PAUSE=0 \
+  ALLOW_TOP=0 \
   ALLOW_UNPAUSE=0 \
   AUTH=0 \
   BUILD=0 \
diff --git a/Dockerfile.aarch64 b/Dockerfile.aarch64
index b45f6a4..0c6afc3 100644
--- a/Dockerfile.aarch64
+++ b/Dockerfile.aarch64
@@ -29,10 +29,15 @@ RUN \
     /etc/haproxy \
     /tmp/*
 
-ENV ALLOW_RESTARTS=0 \
+ENV ALLOW_ARCHIVE=0 \
+  ALLOW_CHANGES=0 \
+  ALLOW_EXPORT=0 \
+  ALLOW_LOGS=0 \
+  ALLOW_PAUSE=0 \
+  ALLOW_RESTARTS=0 \
   ALLOW_STOP=0 \
   ALLOW_START=0 \
-  ALLOW_PAUSE=0 \
+  ALLOW_TOP=0 \
   ALLOW_UNPAUSE=0 \
   AUTH=0 \
   BUILD=0 \
diff --git a/Dockerfile.riscv64 b/Dockerfile.riscv64
index b45f6a4..0c6afc3 100644
--- a/Dockerfile.riscv64
+++ b/Dockerfile.riscv64
@@ -29,10 +29,15 @@ RUN \
     /etc/haproxy \
     /tmp/*
 
-ENV ALLOW_RESTARTS=0 \
+ENV ALLOW_ARCHIVE=0 \
+  ALLOW_CHANGES=0 \
+  ALLOW_EXPORT=0 \
+  ALLOW_LOGS=0 \
+  ALLOW_PAUSE=0 \
+  ALLOW_RESTARTS=0 \
   ALLOW_STOP=0 \
   ALLOW_START=0 \
-  ALLOW_PAUSE=0 \
+  ALLOW_TOP=0 \
   ALLOW_UNPAUSE=0 \
   AUTH=0 \
   BUILD=0 \
diff --git a/README.md b/README.md
index 770b049..b3b87e6 100644
--- a/README.md
+++ b/README.md
@@ -150,10 +150,15 @@ services:
     image: lscr.io/linuxserver/socket-proxy:latest
     container_name: socket-proxy
     environment:
-      - ALLOW_START=0 #optional
-      - ALLOW_STOP=0 #optional
-      - ALLOW_RESTARTS=0 #optional
+      - ALLOW_ARCHIVE=0 #optional
+      - ALLOW_CHANGES=0 #optional
+      - ALLOW_EXPORT=0 #optional
+      - ALLOW_LOGS=0 #optional
       - ALLOW_PAUSE=0 #optional
+      - ALLOW_RESTARTS=0 #optional
+      - ALLOW_STOP=0 #optional
+      - ALLOW_START=0 #optional
+      - ALLOW_TOP=0 #optional
       - ALLOW_UNPAUSE=0 #optional
       - AUTH=0 #optional
       - BUILD=0 #optional
@@ -181,16 +186,6 @@ services:
       - TZ=Etc/UTC #optional
       - VERSION=1 #optional
       - VOLUMES=0 #optional
-      - LIBPOD_ALLOW_PAUSE=0 #optional
-      - LIBPOD_ALLOW_POD_PAUSE=0 #optional
-      - LIBPOD_ALLOW_POD_RESTARTS=0 #optional
-      - LIBPOD_ALLOW_POD_START=0 #optional
-      - LIBPOD_ALLOW_POD_STOP=0 #optional
-      - LIBPOD_ALLOW_POD_UNPAUSE=0 #optional
-      - LIBPOD_ALLOW_RESTARTS=0 #optional
-      - LIBPOD_ALLOW_START=0 #optional
-      - LIBPOD_ALLOW_STOP=0 #optional
-      - LIBPOD_ALLOW_UNPAUSE=0 #optional
       - LIBPOD_CONTAINERS=0 #optional
       - LIBPOD_EVENTS=0 #optional
       - LIBPOD_EXEC=0 #optional
@@ -219,10 +214,15 @@ services:
 ```bash
 docker run -d \
   --name=socket-proxy \
-  -e ALLOW_START=0 `#optional` \
-  -e ALLOW_STOP=0 `#optional` \
-  -e ALLOW_RESTARTS=0 `#optional` \
+  -e ALLOW_ARCHIVE=0 `#optional` \
+  -e ALLOW_CHANGES=0 `#optional` \
+  -e ALLOW_EXPORT=0 `#optional` \
+  -e ALLOW_LOGS=0 `#optional` \
   -e ALLOW_PAUSE=0 `#optional` \
+  -e ALLOW_RESTARTS=0 `#optional` \
+  -e ALLOW_STOP=0 `#optional` \
+  -e ALLOW_START=0 `#optional` \
+  -e ALLOW_TOP=0 `#optional` \
   -e ALLOW_UNPAUSE=0 `#optional` \
   -e AUTH=0 `#optional` \
   -e BUILD=0 `#optional` \
@@ -250,16 +250,6 @@ docker run -d \
   -e TZ=Etc/UTC `#optional` \
   -e VERSION=1 `#optional` \
   -e VOLUMES=0 `#optional` \
-  -e LIBPOD_ALLOW_PAUSE=0 `#optional` \
-  -e LIBPOD_ALLOW_POD_PAUSE=0 `#optional` \
-  -e LIBPOD_ALLOW_POD_RESTARTS=0 `#optional` \
-  -e LIBPOD_ALLOW_POD_START=0 `#optional` \
-  -e LIBPOD_ALLOW_POD_STOP=0 `#optional` \
-  -e LIBPOD_ALLOW_POD_UNPAUSE=0 `#optional` \
-  -e LIBPOD_ALLOW_RESTARTS=0 `#optional` \
-  -e LIBPOD_ALLOW_START=0 `#optional` \
-  -e LIBPOD_ALLOW_STOP=0 `#optional` \
-  -e LIBPOD_ALLOW_UNPAUSE=0 `#optional` \
   -e LIBPOD_CONTAINERS=0 `#optional` \
   -e LIBPOD_EVENTS=0 `#optional` \
   -e LIBPOD_EXEC=0 `#optional` \
@@ -288,11 +278,16 @@ Containers are configured using parameters passed at runtime (such as those abov
 
 | Parameter | Function |
 | :----: | --- |
-| `-e ALLOW_START=0` | `/containers/{id}/start` - **This option will work even if `POST=0`** |
-| `-e ALLOW_STOP=0` | `/containers/{id}/stop` - **This option will work even if `POST=0`** |
-| `-e ALLOW_RESTARTS=0` | `/containers/{id}/stop`, `/containers/{id}/restart`, and `/containers/{id}/kill` - **This option will work even if `POST=0`** |
-| `-e ALLOW_PAUSE=0` | `/containers/{id}/pause` - **This option will work even if `POST=0`** |
-| `-e ALLOW_UNPAUSE=0` | `/containers/{id}/unpause` - **This option will work even if `POST=0`** |
+| `-e ALLOW_ARCHIVE=0` | `(/libpod)?/(containers|pods)/{id}/archive` - **This option is independent of `POST`** |
+| `-e ALLOW_CHANGES=0` | `(/libpod)?/(containers|pods)/{id}/changes` - **This option is independent of `POST`** |
+| `-e ALLOW_EXPORT=0` | `(/libpod)?/(containers|pods)/{id}/export` - **This option is independent of `POST`** |
+| `-e ALLOW_LOGS=0` | `(/libpod)?/(containers|pods)/{id}/logs` - **This option is independent of `POST`** |
+| `-e ALLOW_PAUSE=0` | `(/libpod)?/(containers|pods)/{id}/pause` - **This option will work even if `POST=0`** |
+| `-e ALLOW_RESTARTS=0` | `(/libpod)?/(containers|pods)/{id}/stop`, `/(/libpod)?/(containers|pods)/{id}/restart`, and `/(/libpod)?/(containers|pods)/{id}/kill` - **This option will work even if `POST=0`** |
+| `-e ALLOW_START=0` | `(/libpod)?/(containers|pods)/{id}/start` - **This option will work even if `POST=0`** |
+| `-e ALLOW_STOP=0` | `(/libpod)?/(containers|pods)/{id}/stop` - **This option will work even if `POST=0`** |
+| `-e ALLOW_TOP=0` | `(/libpod)?/(containers|pods)/{id}/top` - **This option is independent of `POST`** |
+| `-e ALLOW_UNPAUSE=0` | `(/libpod)?/(containers|pods)/{id}/unpause` - **This option will work even if `POST=0`** |
 | `-e AUTH=0` | `/auth` |
 | `-e BUILD=0` | `/build` |
 | `-e COMMIT=0` | `/commit` |
@@ -320,16 +315,6 @@ Containers are configured using parameters passed at runtime (such as those abov
 | `-e VERSION=1` | `/version` |
 | `-e VOLUMES=0` | `/volumes` |
 | **Podman libpod API** | |
-| `-e LIBPOD_ALLOW_START=0` | `/libpod/containers/{id}/start` - **This option will work even if `POST=0`** |
-| `-e LIBPOD_ALLOW_STOP=0` | `/libpod/containers/{id}/stop` - **This option will work even if `POST=0`** |
-| `-e LIBPOD_ALLOW_RESTARTS=0` | `/libpod/containers/{id}/stop`, `/libpod/containers/{id}/restart`, and `/libpod/containers/{id}/kill` - **This option will work even if `POST=0`** |
-| `-e LIBPOD_ALLOW_PAUSE=0` | `/libpod/containers/{id}/pause` - **This option will work even if `POST=0`** |
-| `-e LIBPOD_ALLOW_UNPAUSE=0` | `/libpod/containers/{id}/unpause` - **This option will work even if `POST=0`** |
-| `-e LIBPOD_ALLOW_POD_START=0` | `/libpod/pods/{name}/start` - **This option will work even if `POST=0`** |
-| `-e LIBPOD_ALLOW_POD_STOP=0` | `/libpod/pods/{name}/stop` - **This option will work even if `POST=0`** |
-| `-e LIBPOD_ALLOW_POD_RESTARTS=0` | `/libpod/pods/{name}/stop`, `/libpod/pods/{name}/restart`, and `/libpod/pods/{name}/kill` - **This option will work even if `POST=0`** |
-| `-e LIBPOD_ALLOW_POD_PAUSE=0` | `/libpod/pods/{name}/pause` - **This option will work even if `POST=0`** |
-| `-e LIBPOD_ALLOW_POD_UNPAUSE=0` | `/libpod/pods/{name}/unpause` - **This option will work even if `POST=0`** |
 | `-e LIBPOD_CONTAINERS=0` | `/libpod/containers` |
 | `-e LIBPOD_EVENTS=0` | `/libpod/events` |
 | `-e LIBPOD_EXEC=0` | `/libpod/exec` |
@@ -469,6 +454,7 @@ Once registered you can define the dockerfile to use with `-f Dockerfile.aarch64
 
 ## Versions
 
+* **18.08.26:** - Add `ALLOW_ARCHIVE`, `ALLOW_CHANGES`, `ALLOW_EXPORT`, `ALLOW_LOGS`, `ALLOW_TOP` options.
 * **15.06.26:** - Rebase to Alpine 3.24.
 * **13.06.26:** - Add libpod API support for Podman via `LIBPOD_*` environment variables.
 * **24.02.26:** - Add `ALLOW_PAUSE` and `ALLOW_UNPAUSE`.
diff --git a/readme-vars.yml b/readme-vars.yml
index 8f759fe..d155bdb 100644
--- a/readme-vars.yml
+++ b/readme-vars.yml
@@ -157,10 +157,15 @@ full_custom_readme: |
       image: lscr.io/linuxserver/socket-proxy:latest
       container_name: socket-proxy
       environment:
-        - ALLOW_START=0 #optional
-        - ALLOW_STOP=0 #optional
-        - ALLOW_RESTARTS=0 #optional
+        - ALLOW_ARCHIVE=0 #optional
+        - ALLOW_CHANGES=0 #optional
+        - ALLOW_EXPORT=0 #optional
+        - ALLOW_LOGS=0 #optional
         - ALLOW_PAUSE=0 #optional
+        - ALLOW_RESTARTS=0 #optional
+        - ALLOW_STOP=0 #optional
+        - ALLOW_START=0 #optional
+        - ALLOW_TOP=0 #optional
         - ALLOW_UNPAUSE=0 #optional
         - AUTH=0 #optional
         - BUILD=0 #optional
@@ -188,16 +193,6 @@ full_custom_readme: |
         - TZ=Etc/UTC #optional
         - VERSION=1 #optional
         - VOLUMES=0 #optional
-        - LIBPOD_ALLOW_PAUSE=0 #optional
-        - LIBPOD_ALLOW_POD_PAUSE=0 #optional
-        - LIBPOD_ALLOW_POD_RESTARTS=0 #optional
-        - LIBPOD_ALLOW_POD_START=0 #optional
-        - LIBPOD_ALLOW_POD_STOP=0 #optional
-        - LIBPOD_ALLOW_POD_UNPAUSE=0 #optional
-        - LIBPOD_ALLOW_RESTARTS=0 #optional
-        - LIBPOD_ALLOW_START=0 #optional
-        - LIBPOD_ALLOW_STOP=0 #optional
-        - LIBPOD_ALLOW_UNPAUSE=0 #optional
         - LIBPOD_CONTAINERS=0 #optional
         - LIBPOD_EVENTS=0 #optional
         - LIBPOD_EXEC=0 #optional
@@ -226,10 +221,15 @@ full_custom_readme: |
   ```bash
   docker run -d \
     --name=socket-proxy \
-    -e ALLOW_START=0 `#optional` \
-    -e ALLOW_STOP=0 `#optional` \
-    -e ALLOW_RESTARTS=0 `#optional` \
+    -e ALLOW_ARCHIVE=0 `#optional` \
+    -e ALLOW_CHANGES=0 `#optional` \
+    -e ALLOW_EXPORT=0 `#optional` \
+    -e ALLOW_LOGS=0 `#optional` \
     -e ALLOW_PAUSE=0 `#optional` \
+    -e ALLOW_RESTARTS=0 `#optional` \
+    -e ALLOW_STOP=0 `#optional` \
+    -e ALLOW_START=0 `#optional` \
+    -e ALLOW_TOP=0 `#optional` \
     -e ALLOW_UNPAUSE=0 `#optional` \
     -e AUTH=0 `#optional` \
     -e BUILD=0 `#optional` \
@@ -257,16 +257,6 @@ full_custom_readme: |
     -e TZ=Etc/UTC `#optional` \
     -e VERSION=1 `#optional` \
     -e VOLUMES=0 `#optional` \
-    -e LIBPOD_ALLOW_PAUSE=0 `#optional` \
-    -e LIBPOD_ALLOW_POD_PAUSE=0 `#optional` \
-    -e LIBPOD_ALLOW_POD_RESTARTS=0 `#optional` \
-    -e LIBPOD_ALLOW_POD_START=0 `#optional` \
-    -e LIBPOD_ALLOW_POD_STOP=0 `#optional` \
-    -e LIBPOD_ALLOW_POD_UNPAUSE=0 `#optional` \
-    -e LIBPOD_ALLOW_RESTARTS=0 `#optional` \
-    -e LIBPOD_ALLOW_START=0 `#optional` \
-    -e LIBPOD_ALLOW_STOP=0 `#optional` \
-    -e LIBPOD_ALLOW_UNPAUSE=0 `#optional` \
     -e LIBPOD_CONTAINERS=0 `#optional` \
     -e LIBPOD_EVENTS=0 `#optional` \
     -e LIBPOD_EXEC=0 `#optional` \
@@ -295,11 +285,16 @@ full_custom_readme: |
 
   | Parameter | Function |
   | :----: | --- |
-  | `-e ALLOW_START=0` | `/containers/{id}/start` - **This option will work even if `POST=0`** |
-  | `-e ALLOW_STOP=0` | `/containers/{id}/stop` - **This option will work even if `POST=0`** |
-  | `-e ALLOW_RESTARTS=0` | `/containers/{id}/stop`, `/containers/{id}/restart`, and `/containers/{id}/kill` - **This option will work even if `POST=0`** |
-  | `-e ALLOW_PAUSE=0` | `/containers/{id}/pause` - **This option will work even if `POST=0`** |
-  | `-e ALLOW_UNPAUSE=0` | `/containers/{id}/unpause` - **This option will work even if `POST=0`** |
+  | `-e ALLOW_ARCHIVE=0` | `(/libpod)?/(containers|pods)/{id}/archive` - **This option is independent of `POST`** |
+  | `-e ALLOW_CHANGES=0` | `(/libpod)?/(containers|pods)/{id}/changes` - **This option is independent of `POST`** |
+  | `-e ALLOW_EXPORT=0` | `(/libpod)?/(containers|pods)/{id}/export` - **This option is independent of `POST`** |
+  | `-e ALLOW_LOGS=0` | `(/libpod)?/(containers|pods)/{id}/logs` - **This option is independent of `POST`** |
+  | `-e ALLOW_PAUSE=0` | `(/libpod)?/(containers|pods)/{id}/pause` - **This option will work even if `POST=0`** |
+  | `-e ALLOW_RESTARTS=0` | `(/libpod)?/(containers|pods)/{id}/stop`, `(/libpod)?/(containers|pods)/{id}/restart`, and `(/libpod)?/(containers|pods)/{id}/kill` - **This option will work even if `POST=0`** |
+  | `-e ALLOW_START=0` | `(/libpod)?/(containers|pods)/{id}/start` - **This option will work even if `POST=0`** |
+  | `-e ALLOW_STOP=0` | `(/libpod)?/(containers|pods)/{id}/stop` - **This option will work even if `POST=0`** |
+  | `-e ALLOW_TOP=0` | `(/libpod)?/(containers|pods)/{id}/top` - **This option is independent of `POST`** |
+  | `-e ALLOW_UNPAUSE=0` | `(/libpod)?/(containers|pods)/{id}/unpause` - **This option will work even if `POST=0`** |
   | `-e AUTH=0` | `/auth` |
   | `-e BUILD=0` | `/build` |
   | `-e COMMIT=0` | `/commit` |
@@ -327,16 +322,6 @@ full_custom_readme: |
   | `-e VERSION=1` | `/version` |
   | `-e VOLUMES=0` | `/volumes` |
   | **Podman libpod API** | |
-  | `-e LIBPOD_ALLOW_START=0` | `/libpod/containers/{id}/start` - **This option will work even if `POST=0`** |
-  | `-e LIBPOD_ALLOW_STOP=0` | `/libpod/containers/{id}/stop` - **This option will work even if `POST=0`** |
-  | `-e LIBPOD_ALLOW_RESTARTS=0` | `/libpod/containers/{id}/stop`, `/libpod/containers/{id}/restart`, and `/libpod/containers/{id}/kill` - **This option will work even if `POST=0`** |
-  | `-e LIBPOD_ALLOW_PAUSE=0` | `/libpod/containers/{id}/pause` - **This option will work even if `POST=0`** |
-  | `-e LIBPOD_ALLOW_UNPAUSE=0` | `/libpod/containers/{id}/unpause` - **This option will work even if `POST=0`** |
-  | `-e LIBPOD_ALLOW_POD_START=0` | `/libpod/pods/{name}/start` - **This option will work even if `POST=0`** |
-  | `-e LIBPOD_ALLOW_POD_STOP=0` | `/libpod/pods/{name}/stop` - **This option will work even if `POST=0`** |
-  | `-e LIBPOD_ALLOW_POD_RESTARTS=0` | `/libpod/pods/{name}/stop`, `/libpod/pods/{name}/restart`, and `/libpod/pods/{name}/kill` - **This option will work even if `POST=0`** |
-  | `-e LIBPOD_ALLOW_POD_PAUSE=0` | `/libpod/pods/{name}/pause` - **This option will work even if `POST=0`** |
-  | `-e LIBPOD_ALLOW_POD_UNPAUSE=0` | `/libpod/pods/{name}/unpause` - **This option will work even if `POST=0`** |
   | `-e LIBPOD_CONTAINERS=0` | `/libpod/containers` |
   | `-e LIBPOD_EVENTS=0` | `/libpod/events` |
   | `-e LIBPOD_EXEC=0` | `/libpod/exec` |
@@ -476,6 +461,7 @@ full_custom_readme: |
 
   ## Versions
 
+  * **18.08.26:** - Add `ALLOW_ARCHIVE`, `ALLOW_CHANGES`, `ALLOW_EXPORT`, `ALLOW_LOGS`, `ALLOW_TOP` options.
   * **15.06.26:** - Rebase to Alpine 3.24.
   * **13.06.26:** - Add libpod API support for Podman via `LIBPOD_*` environment variables.
   * **24.02.26:** - Add `ALLOW_PAUSE` and `ALLOW_UNPAUSE`.
diff --git a/root/templates/haproxy.cfg b/root/templates/haproxy.cfg
index 015611c..a1e0ed0 100644
--- a/root/templates/haproxy.cfg
+++ b/root/templates/haproxy.cfg
@@ -2,6 +2,8 @@ global
     log stdout format raw daemon "${LOG_LEVEL}"
     pidfile /run/haproxy.pid
     maxconn 2000
+    user root
+    chroot /
 
 defaults
     mode http
@@ -25,13 +27,26 @@ backend docker
 
 frontend proxy
     bind @@BIND_PROTO@@
-    http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/containers/[a-zA-Z0-9_.-]+/((stop)|(restart)|(kill)) } { env(ALLOW_RESTARTS) -m bool }
-    http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/containers/[a-zA-Z0-9_.-]+/start } { env(ALLOW_START) -m bool }
-    http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/containers/[a-zA-Z0-9_.-]+/stop } { env(ALLOW_STOP) -m bool }
-    http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/containers/[a-zA-Z0-9_.-]+/pause } { env(ALLOW_PAUSE) -m bool }
-    http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/containers/[a-zA-Z0-9_.-]+/unpause } { env(ALLOW_UNPAUSE) -m bool }
-    
-    # libpod endpoints
+
+    acl allow_archive env(ALLOW_ARCHIVE) -m bool
+    acl allow_change env(ALLOW_CHANGE) -m bool
+    acl allow_export env(ALLOW_EXPORT) -m bool
+    acl allow_logs env(ALLOW_LOGS) -m bool
+    acl allow_top env(ALLOW_TOP) -m bool
+
+    http-request deny if { path,url_dec -m reg -i ^(/v[\d\.]+)?(/libpod)?/(containers|pods)/[a-zA-Z0-9_.-]+/(archive) } !allow_archive
+    http-request deny if { path,url_dec -m reg -i ^(/v[\d\.]+)?(/libpod)?/(containers|pods)/[a-zA-Z0-9_.-]+/(change) } !allow_change
+    http-request deny if { path,url_dec -m reg -i ^(/v[\d\.]+)?(/libpod)?/(containers|pods)/[a-zA-Z0-9_.-]+/(export) } !allow_export
+    http-request deny if { path,url_dec -m reg -i ^(/v[\d\.]+)?(/libpod)?/(containers|pods)/[a-zA-Z0-9_.-]+/(logs) } !allow_logs
+    http-request deny if { path,url_dec -m reg -i ^(/v[\d\.]+)?(/libpod)?/(containers|pods)/[a-zA-Z0-9_.-]+/(top) } !allow_top
+
+    http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?(/libpod)?/(containers|pods)/[a-zA-Z0-9_.-]+/((stop)|(restart)|(kill)) } { env(ALLOW_RESTARTS) -m bool }
+    http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?(/libpod)?/(containers|pods)/[a-zA-Z0-9_.-]+/start } { env(ALLOW_START) -m bool }
+    http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?(/libpod)?/(containers|pods)/[a-zA-Z0-9_.-]+/stop } { env(ALLOW_STOP) -m bool }
+    http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?(/libpod)?/(containers|pods)/[a-zA-Z0-9_.-]+/pause } { env(ALLOW_PAUSE) -m bool }
+    http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?(/libpod)?/(containers|pods)/[a-zA-Z0-9_.-]+/unpause } { env(ALLOW_UNPAUSE) -m bool }
+
+    # legacy libpod endpoints
     http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/libpod/containers/[a-zA-Z0-9_.-]+/((stop)|(restart)|(kill)) } { env(LIBPOD_ALLOW_RESTARTS) -m bool }
     http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/libpod/containers/[a-zA-Z0-9_.-]+/start } { env(LIBPOD_ALLOW_START) -m bool }
     http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/libpod/containers/[a-zA-Z0-9_.-]+/stop } { env(LIBPOD_ALLOW_STOP) -m bool }
@@ -42,7 +57,7 @@ frontend proxy
     http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/libpod/pods/[a-zA-Z0-9_.-]+/stop } { env(LIBPOD_ALLOW_POD_STOP) -m bool }
     http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/libpod/pods/[a-zA-Z0-9_.-]+/pause } { env(LIBPOD_ALLOW_POD_PAUSE) -m bool }
     http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/libpod/pods/[a-zA-Z0-9_.-]+/unpause } { env(LIBPOD_ALLOW_POD_UNPAUSE) -m bool }
-    
+
     http-request deny unless METH_GET || { env(POST) -m bool }
     http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/auth } { env(AUTH) -m bool }
     http-request allow if { path,url_dec -m reg -i ^(/v[\d\.]+)?/build } { env(BUILD) -m bool }