[Bug] Use of closed network connection

[ElioDiNino]

I am unsure where the true issue lies, but when running Beszel, a few hours after starting the agent, the socket proxy spits out the error http: proxy error: read unix @->/run/docker.sock: use of closed network connection. Please see henrygd/beszel#1028 for more context.

Note that I have observed the issue with both the socket volume mount and TCP connection.

[11notes]

I've added two timeouts for you (04fdc6d), you can fine tune. As you stated yourself, Traefik and other apps work with this proxy with no issues. I myself use this proxy in my commercial container offerings.

[ElioDiNino]

I've added two timeouts for you (04fdc6d), you can fine tune. As you stated yourself, Traefik and other apps work with this proxy with no issues. I myself use this proxy in my commercial container offerings.

Sweet thanks, I will play around with the values and see if it helps at all!

[ElioDiNino]

Unfortunately, after testing a variety of values and leaving things to run multiple times, this hasn't resolved my issue. I am going to play around with other options to try and isolate the issue

[11notes]

Can you give me the compose you used to test these timeouts? When looking as Beszel I do not see anything special when connecting to the Docker socket: https://github.com/henrygd/beszel/blob/main/beszel/internal/agent/docker.go#L273C27-L273C38 it does have a timeout variable though: https://github.com/henrygd/beszel/blob/main/beszel/internal/agent/docker.go#L285 maybe try setting DOCKER_TIMEOUT to a higher value? Default is 2.1s

[ElioDiNino]

Can you give me the compose you used to test these timeouts? When looking as Beszel I do not see anything special when connecting to the Docker socket: https://github.com/henrygd/beszel/blob/main/beszel/internal/agent/docker.go#L273C27-L273C38

Yeah, can do. The configs I was running before trying to fix stuff can be found here and here

From there, I tried setting the SOCKET_PROXY_TIMEOUT and SOCKET_PROXY_KEEPALIVE environment variables on the new socket proxy version, but found increasing the values (e.g. 75s) made things worse, while decreasing them (e.g. 10s) did not lead to any improvement. I also confirmed that passing the socket directly to Beszel does work as expected, so I don't think it's an issue with the core Docker socket. I also tried connecting socket proxy to Beszel via TCP instead of the volume-mounted unix socket but that made no difference. Lastly, I tried everything with and without network_mode: host. I have yet to try the linuxserver socket proxy since I have been busy.

it does have a timeout variable though: https://github.com/henrygd/beszel/blob/main/beszel/internal/agent/docker.go#L285 maybe try setting DOCKER_TIMEOUT to a higher value? Default is 2.1s

Yeah, I can certainly try that. I will try something higher than SOCKET_PROXY_TIMEOUT maybe?

[ElioDiNino]

I tried 15s for DOCKER_TIMEOUT with SOCKET_PROXY_TIMEOUT and SOCKET_PROXY_KEEPALIVE set to 10s. The connection remained intact many hours longer, but ultimately ended up erroring again. I have a few more interesting logs this time though (with the last 2 logs lining up with when Beszel reported its errors):

2025/08/12 15:07:55 Unsolicited response received on idle HTTP channel starting with "HTTP/1.1 200 OK\r\nApi-Version: 1.51\r\nContent-Type: application/json\r\nDocker-Experimental: false\r\nOstype: linux\r\nServer: Docker/28.3.3 (linux)\r\nDate: Tue, 12 Aug 2025 19:07:55 GMT\r\nTransfer-Encoding: chunked\r\n\r\n921\r\n{\"read\":\"2025-08-12T19:07:55.061910311Z\",\"preread\":\"0001-01-01T00:00:00Z\",\"pids_stats\":{\"current\":52},\"blkio_stats\":{\"io_service_bytes_recursive\":[{\"major\":179,\"minor\":0,\"op\":\"Read\",\"value\":34963456},{\"major\":179,\"minor\":0,\"op\":\"Write\",\"value\":372736},{\"major\":179,\"minor\":0,\"op\":\"Sync\",\"value\":372736},{\"major\":179,\"minor\":0,\"op\":\"Async\",\"value\":34963456},{\"major\":179,\"minor\":0,\"op\":\"Total\",\"value\":35336192}],\"io_serviced_recursive\":[{\"major\":179,\"minor\":0,\"op\":\"Read\",\"value\":651},{\"major\":179,\"minor\":0,\"op\":\"Write\",\"value\":52},{\"major\":179,\"minor\":0,\"op\":\"Sync\",\"value\":52},{\"major\":179,\"minor\":0,\"op\":\"Async\",\"value\":651},{\"major\":179,\"minor\":0,\"op\":\"Total\",\"value\":703}],\"io_queue_recursive\":[],\"io_service_time_recursive\":[],\"io_wait_time_recursive\":[],\"io_merged_recursive\":[],\"io_time_recursive\":[],\"sectors_recursive\":[]},\"num_procs\":0,\"storage_stats\":{},\"cpu_stats\":{\"cpu_usage\":{\"total_usage\":579679271034,\"percpu_usage\":[138625389604,126165238389,190755733097,49131042515,42572875085,32428992344],\"usage_in_kernelmode\":176190000000,\"usage_in_usermode\":401360000000},\"system_cpu_usage\":1733488690000000,\"online_cpus\":6,\"throttling_data\":{\"periods\":0,\"throttled_periods\":0,\"throttled_time\":0}},\"precpu_stats\":{\"cpu_usage\":{\"total_usage\":0,\"usage_in_kernelmode\":0,\"usage_in_usermode\":0},\"throttling_data\":{\"periods\":0,\"throttled_periods\":0,\"throttled_time\":0}},\"memory_stats\":{\"usage\":42053632,\"max_usage\":50294784,\"stats\":{\"active_anon\":11653120,\"active_file\":14831616,\"cache\":26296320,\"dirty\":0,\"hierarchical_memory_limit\":9223372036854771712,\"hierarchical_memsw_limit\":9223372036854771712,\"inactive_anon\":0,\"inactive_file\":11464704,\"mapped_file\":11370496,\"pgfault\":12830898,\"pgmajfault\":357,\"pgpgin\":6825139,\"pgpgout\":6817918,\"rss\":11653120,\"rss_huge\":8388608,\"total_active_anon\":11653120,\"total_active_file\":14831616,\"total_cache\":26296320,\"total_dirty\":0,\"total_inactive_anon\":0,\"total_inactive_file\":11464704,\"total_mapped_file\":11370496,\"total_pgfault\":12830898,\"total_pgmajfault\":357,\"total_pgpgin\":6825139,\"total_pgpgout\":6817918,\"total_rss\":11653120,\"total_rss_huge\":8388608,\"total_unevictable\":0,\"total_writeback\":0,\"unevictable\":0,\"writeback\":0},\"limit\":3890036736},\"networks\":{\"eth0\":{\"rx_bytes\":60755,\"rx_packets\":718,\"rx_errors\":0,\"rx_dropped\":0,\"tx_bytes\":7144,\"tx_packets\":87,\"tx_errors\":0,\"tx_dropped\":0}}}\n\r\n0\r\n\r\n"; err=<nil>
2025/08/12 15:52:10 Unsolicited response received on idle HTTP channel starting with "HTTP/1.1 200 OK\r\nApi-Version: 1.51\r\nContent-Type: application/json\r\nDocker-Experimental: false\r\nOstype: linux\r\nServer: Docker/28.3.3 (linux)\r\nDate: Tue, 12 Aug 2025 19:52:10 GMT\r\nTransfer-Encoding: chunked\r\n\r\n6f94\r\n[{\"Id\":\"093dbf6acefbc193782088a33e479bf6949f039f38a3d3f728c95b6a4c390a0d\",\"Names\":[\"/beszel-beszel-local-agent-1\"],\"Image\":\"ghcr.io/henrygd/beszel/beszel-agent:0\",\"ImageID\":\"sha256:5cb160d7bb91727aaee990bc4d63e7aae1f67b854f4424842589d2ffa5a6c82e\",\"Command\":\"/agent\",\"Created\":1755000981,\"Ports\":[],\"Labels\":{\"com.docker.compose.config-hash\":\"f82988cf854cadd8d195910813dbc233e549719e6035bbc8f2154bf1f2253534\",\"com.docker.compose.container-number\":\"1\",\"com.docker.compose.depends_on\":\"beszel:service_healthy:false\",\"com.docker.compose.image\":\"sha256:5cb160d7bb91727aaee990bc4d63e7aae1f67b854f4424842589d2ffa5a6c82e\",\"com.docker.compose.oneoff\":\"False\",\"com.docker.compose.project\":\"beszel\",\"com.docker.compose.project.config_files\":\"\",\"com.docker.compose.project.working_dir\":\"/data/compose/50/v25\",\"com.docker.compose.replace\":\"f844d608d67e21eaeaf685074cdec624f2556e4d6260af00f4d94f3bb8685c7c\",\"com.docker.compose.service\":\"beszel-local-agent\",\"com.docker.compose.version\":\"\",\"diun.enable\":\"true\",\"org.opencontainers.image.created\":\"2025-08-04T02:11:51.749Z\",\"org.opencontainers.image.description\":\"Lightweight server monitoring hub with historical data, docker stats, and alerts.\",\"org.opencontainers.image.licenses\":\"MIT\",\"org.opencontainers.image.revision\":\"de56544ca339e7a8fe43118d068737611f177a42\",\"org.opencontainers.image.source\":\"https://github.com/henrygd/beszel\",\"org.opencontainers.image.title\":\"beszel\",\"org.opencontainers.image.url\":\"https://github.com/henrygd/beszel\",\"org.opencontainers.image.version\":\"0.12.3\"},\"State\":\"running\",\"Status\":\"Up 8 hours (healthy)\",\"HostConfig\":{\"NetworkMode\":\"beszel_default\"},\"NetworkSettings\":{\"Networks\":{\"beszel_default\":{\"IPAMConfig\":null,\"Links\":null,\"Aliases\":null,\"MacAddress\":\"5e:a5:2e:c7:c6:40\",\"DriverOpts\":null,\"GwPriority\":0,\"NetworkID\":\"6e8d9100d659de9e9d88cafbf391cc9bfde0b8c229e5331176c1543d3f3dca47\",\"EndpointID\":\"e350999e0fe3b353a5eec4ef3c09c78acc7f232a89f3eb498e7cf3c4cc8daf4f\",\"Gateway\":\"172.27.0.1\",\"IPAddress\":\"172.27.0.2\",\"IPPrefixLen\":16,\"IPv6Gateway\":\"\",\"GlobalIPv6Address\":\"\",\"GlobalIPv6PrefixLen\":0,\"DNSNames\":null}}},\"Mounts\":[{\"Type\":\"volume\",\"Name\":\"beszel_beszel-socket\",\"Source\":\"/var/lib/docker/volumes/beszel_beszel-socket/_data\",\"Destination\":\"/beszel_socket\",\"Driver\":\"local\",\"Mode\":\"z\",\"RW\":true,\"Propagation\":\"\"},{\"Type\":\"volume\",\"Name\":\"socket-proxy\",\"Source\":\"/var/lib/docker/volumes/socket-proxy/_data\",\"Destination\":\"/socket-proxy\",\"Driver\":\"local\",\"Mode\":\"z\",\"RW\":false,\"Propagation\":\"\"},{\"Type\":\"volume\",\"Name\":\"beszel_agent\",\"Source\":\"/var/lib/docker/volumes/beszel_agent/_data\",\"Destination\":\"/var/lib/beszel-agent\",\"Driver\":\"local\",\"Mode\":\"z\",\"RW\":true,\"Propagation\":\"\"}]},{\"Id\":\"8c2e176029760f2d62378215806eebd819dff9f33b468136946e64f594b95a67\",\"Names\":[\"/beszel-beszel-1\"],\"Image\":\"ghcr.io/henrygd/beszel/beszel:0\",\"ImageID\":\"sha256:4d9221fba00fcca7aaf6e29f8571449497c9fb2f1385027007ddc332c809a607\",\"Command\":\"/beszel serve --http=0.0.0.0:8090\",\"Created\":1754958539,\"Ports\":[{\"PrivatePort\":8090,\"Type\":\"tcp\"}],\"Labels\":{\"caddy\":\"beszel.{$INTERNAL_DOMAIN}\",\"caddy.reverse_proxy\":\"{{ upstreams 8090 }}\",\"com.docker.compose.config-hash\":\"f69f6533519338499a7adcdfd6fe49dcf595e73b6ae6347b05c7d3371c92a05d\",\"com.docker.compose.container-number\":\"1\",\"com.docker.compose.depends_on\":\"\",\"com.docker.compose.image\":\"sha256:4d9221fba00fcca7aaf6e29f8571449497c9fb2f1385027007ddc332c809a607\",\"com.docker.compose.oneoff\":\"False\",\"com.docker.compose.project\":\"beszel\",\"com.docker.compose.project.config_files\":\"\",\"com.docker.compose.project.working_dir\":\"/data/compose/50/v23\",\"com.docker.compose.replace\":\"014429ca3976d9f533a013201850bdb4dd2e8bdf69b6c01174a3b31015c2ab63\",\"com.docker.compose.service\":\"beszel\",\"com.docker.compose.version\":\"\",\"diun.enable\":\"true\",\"org.opencontainers.image.created\":\"2025-08-04T02:11:54.170Z\",\"org.opencontainers.image.description\":\"Lightweight server monitoring hub wi"; err=<nil>
2025/08/12 15:52:10 http: proxy error: net/http: HTTP/1.x transport connection broken: malformed HTTP status code "historical"
2025/08/12 17:39:15 Unsolicited response received on idle HTTP channel starting with "HTTP/1.1 200 OK\r\nApi-Version: 1.51\r\nContent-Type: application/json\r\nDocker-Experimental: false\r\nOstype: linux\r\nServer: Docker/28.3.3 (linux)\r\nDate: Tue, 12 Aug 2025 21:39:15 GMT\r\nTransfer-Encoding: chunked\r\n\r\n6f94\r\n[{\"Id\":\"093dbf6acefbc193782088a33e479bf6949f039f38a3d3f728c95b6a4c390a0d\",\"Names\":[\"/beszel-beszel-local-agent-1\"],\"Image\":\"ghcr.io/henrygd/beszel/beszel-agent:0\",\"ImageID\":\"sha256:5cb160d7bb91727aaee990bc4d63e7aae1f67b854f4424842589d2ffa5a6c82e\",\"Command\":\"/agent\",\"Created\":1755000981,\"Ports\":[],\"Labels\":{\"com.docker.compose.config-hash\":\"f82988cf854cadd8d195910813dbc233e549719e6035bbc8f2154bf1f2253534\",\"com.docker.compose.container-number\":\"1\",\"com.docker.compose.depends_on\":\"beszel:service_healthy:false\",\"com.docker.compose.image\":\"sha256:5cb160d7bb91727aaee990bc4d63e7aae1f67b854f4424842589d2ffa5a6c82e\",\"com.docker.compose.oneoff\":\"False\",\"com.docker.compose.project\":\"beszel\",\"com.docker.compose.project.config_files\":\"\",\"com.docker.compose.project.working_dir\":\"/data/compose/50/v25\",\"com.docker.compose.replace\":\"f844d608d67e21eaeaf685074cdec624f2556e4d6260af00f4d94f3bb8685c7c\",\"com.docker.compose.service\":\"beszel-local-agent\",\"com.docker.compose.version\":\"\",\"diun.enable\":\"true\",\"org.opencontainers.image.created\":\"2025-08-04T02:11:51.749Z\",\"org.opencontainers.image.description\":\"Lightweight server monitoring hub with historical data, docker stats, and alerts.\",\"org.opencontainers.image.licenses\":\"MIT\",\"org.opencontainers.image.revision\":\"de56544ca339e7a8fe43118d068737611f177a42\",\"org.opencontainers.image.source\":\"https://github.com/henrygd/beszel\",\"org.opencontainers.image.title\":\"beszel\",\"org.opencontainers.image.url\":\"https://github.com/henrygd/beszel\",\"org.opencontainers.image.version\":\"0.12.3\"},\"State\":\"running\",\"Status\":\"Up 9 hours (healthy)\",\"HostConfig\":{\"NetworkMode\":\"beszel_default\"},\"NetworkSettings\":{\"Networks\":{\"beszel_default\":{\"IPAMConfig\":null,\"Links\":null,\"Aliases\":null,\"MacAddress\":\"5e:a5:2e:c7:c6:40\",\"DriverOpts\":null,\"GwPriority\":0,\"NetworkID\":\"6e8d9100d659de9e9d88cafbf391cc9bfde0b8c229e5331176c1543d3f3dca47\",\"EndpointID\":\"e350999e0fe3b353a5eec4ef3c09c78acc7f232a89f3eb498e7cf3c4cc8daf4f\",\"Gateway\":\"172.27.0.1\",\"IPAddress\":\"172.27.0.2\",\"IPPrefixLen\":16,\"IPv6Gateway\":\"\",\"GlobalIPv6Address\":\"\",\"GlobalIPv6PrefixLen\":0,\"DNSNames\":null}}},\"Mounts\":[{\"Type\":\"volume\",\"Name\":\"beszel_beszel-socket\",\"Source\":\"/var/lib/docker/volumes/beszel_beszel-socket/_data\",\"Destination\":\"/beszel_socket\",\"Driver\":\"local\",\"Mode\":\"z\",\"RW\":true,\"Propagation\":\"\"},{\"Type\":\"volume\",\"Name\":\"socket-proxy\",\"Source\":\"/var/lib/docker/volumes/socket-proxy/_data\",\"Destination\":\"/socket-proxy\",\"Driver\":\"local\",\"Mode\":\"z\",\"RW\":false,\"Propagation\":\"\"},{\"Type\":\"volume\",\"Name\":\"beszel_agent\",\"Source\":\"/var/lib/docker/volumes/beszel_agent/_data\",\"Destination\":\"/var/lib/beszel-agent\",\"Driver\":\"local\",\"Mode\":\"z\",\"RW\":true,\"Propagation\":\"\"}]},{\"Id\":\"8c2e176029760f2d62378215806eebd819dff9f33b468136946e64f594b95a67\",\"Names\":[\"/beszel-beszel-1\"],\"Image\":\"ghcr.io/henrygd/beszel/beszel:0\",\"ImageID\":\"sha256:4d9221fba00fcca7aaf6e29f8571449497c9fb2f1385027007ddc332c809a607\",\"Command\":\"/beszel serve --http=0.0.0.0:8090\",\"Created\":1754958539,\"Ports\":[{\"PrivatePort\":8090,\"Type\":\"tcp\"}],\"Labels\":{\"caddy\":\"beszel.{$INTERNAL_DOMAIN}\",\"caddy.reverse_proxy\":\"{{ upstreams 8090 }}\",\"com.docker.compose.config-hash\":\"f69f6533519338499a7adcdfd6fe49dcf595e73b6ae6347b05c7d3371c92a05d\",\"com.docker.compose.container-number\":\"1\",\"com.docker.compose.depends_on\":\"\",\"com.docker.compose.image\":\"sha256:4d9221fba00fcca7aaf6e29f8571449497c9fb2f1385027007ddc332c809a607\",\"com.docker.compose.oneoff\":\"False\",\"com.docker.compose.project\":\"beszel\",\"com.docker.compose.project.config_files\":\"\",\"com.docker.compose.project.working_dir\":\"/data/compose/50/v23\",\"com.docker.compose.replace\":\"014429ca3976d9f533a013201850bdb4dd2e8bdf69b6c01174a3b31015c2ab63\",\"com.docker.compose.service\":\"beszel\",\"com.docker.compose.version\":\"\",\"diun.enable\":\"true\",\"org.opencontainers.image.created\":\"2025-08-04T02:11:54.170Z\",\"org.opencontainers.image.description\":\"Lightweight server monitoring hub wi"; err=<nil>
2025/08/12 17:39:15 http: proxy error: net/http: HTTP/1.x transport connection broken: malformed HTTP status code "historical"
2025/08/12 18:06:55 httputil: ReverseProxy read error during body copy: read unix @->/run/docker.sock: use of closed network connection
2025/08/12 18:06:55 http: proxy error: net/http: HTTP/1.x transport connection broken: malformed HTTP response "MIPS\\\",\\\"SCMP_ARCH_MIPS64\\\",\\\"SCMP_ARCH_MIPS64N32\\\",\\\"SCMP_ARCH_MIPSEL\\\",\\\"SCMP_ARCH_MIPSEL64\\\",\\\"SCMP_ARCH_MIPSEL64N32\\\",\\\"SCMP_ARCH_PPC\\\",\\\"SCMP_ARCH_PPC64\\\",\\\"SCMP_ARCH_PPC64LE\\\",\\\"SCMP_ARCH_RISCV64\\\",\\\"SCMP_ARCH_S390\\\",\\\"SCMP_ARCH_S390X\\\",\\\"SCMP_ARCH_X32\\\",\\\"SCMP_ARCH_X86\\\",\\\"SCMP_ARCH_X86_64\\\"],\\\"knownFlags\\\":[\\\"SECCOMP_FILTER_FLAG_TSYNC\\\",\\\"SECCOMP_FILTER_FLAG_SPEC_ALLOW\\\",\\\"SECCOMP_FILTER_FLAG_LOG\\\"],\\\"supportedFlags\\\":[\\\"SECCOMP_FILTER_FLAG_TSYNC\\\"]},\\\"apparmor\\\":{\\\"enabled\\\":true},\\\"selinux\\\":{\\\"enabled\\\":true},\\\"intelRdt\\\":{\\\"enabled\\\":true},\\\"mountExtensions\\\":{\\\"idmap\\\":{\\\"enabled\\\":true}}},\\\"annotations\\\":{\\\"io.github.seccomp.libseccomp.version\\\":\\\"2.5.5\\\",\\\"org.opencontainers.runc.checkpoint.enabled\\\":\\\"true\\\",\\\"org.opencontainers.runc.commit\\\":\\\"v1.2.5-0-g59923ef\\\",\\\"org.opencontainers.runc.version\\\":\\\"1.2.5\\\"},\\\"potentiallyUnsafeConfigAnnotations\\\":[\\\"bundle\\\",\\\"org.systemd.property.\\\",\\\"org.criu.config\\\"]}\"}},\"runc\":{\"path\":\"runc\",\"status\":{\"org.opencontainers.runtime-spec.features\":\"{\\\"ociVersionMin\\\":\\\"1.0.0\\\",\\\"ociVersionMax\\\":\\\"1.2.0\\\",\\\"hooks\\\":[\\\"prestart\\\",\\\"createRuntime\\\",\\\"createContainer\\\",\\\"startContainer\\\",\\\"poststart\\\",\\\"poststop\\\"],\\\"mountOptions\\\":[\\\"async\\\",\\\"atime\\\",\\\"bind\\\",\\\"defaults\\\",\\\"dev\\\",\\\"diratime\\\",\\\"dirsync\\\",\\\"exec\\\",\\\"iversion\\\",\\\"lazytime\\\",\\\"loud\\\",\\\"mand\\\",\\\"noatime\\\",\\\"nodev\\\",\\\"nodiratime\\\",\\\"noexec\\\",\\\"noiversion\\\",\\\"nolazytime\\\",\\\"nomand\\\",\\\"norelatime\\\",\\\"nostrictatime\\\",\\\"nosuid\\\",\\\"nosymfollow\\\",\\\"private\\\",\\\"ratime\\\",\\\"rbind\\\",\\\"rdev\\\",\\\"rdiratime\\\",\\\"relatime\\\",\\\"remount\\\",\\\"rexec\\\",\\\"rnoatime\\\",\\\"rnodev\\\",\\\"rnodiratime\\\",\\\"rnoexec\\\",\\\"rnorelatime\\\",\\\"rnostrictatime\\\",\\\"rnosuid\\\",\\\"rnosymfollow\\\",\\\"ro\\\",\\\"rprivate\\\",\\\"rrelatime\\\",\\\"rro\\\",\\\"rrw\\\",\\\"rshared\\\",\\\"rslave\\\",\\\"rstrictatime\\\",\\\"rsuid\\\",\\\"rsymfollow\\\",\\\"runbindable\\\",\\\"rw\\\",\\\"shared\\\",\\\"silent\\\",\\\"slave\\\",\\\"strictatime\\\",\\\"suid\\\",\\\"symfollow\\\",\\\"sync\\\",\\\"tmpcopyup\\\",\\\"unbindable\\\"],\\\"linux\\\":{\\\"namespaces\\\":[\\\"cgroup\\\",\\\"ipc\\\",\\\"mount\\\",\\\"network\\\",\\\"pid\\\",\\\"time\\\",\\\"user\\\",\\\"uts\\\"],\\\"capabilities\\\":[\\\"CAP_CHOWN\\\",\\\"CAP_DAC_OVERRIDE\\\",\\\"CAP_DAC_READ_SEARCH\\\",\\\"CAP_FOWNER\\\",\\\"CAP_FSETID\\\",\\\"CAP_KILL\\\",\\\"CAP_SETGID\\\",\\\"CAP_SETUID\\\",\\\"CAP_SETPCAP\\\",\\\"CAP_LINUX_IMMUTABLE\\\",\\\"CAP_NET_BIND_SERVICE\\\",\\\"CAP_NET_BROADCAST\\\",\\\"CAP_NET_ADMIN\\\",\\\"CAP_NET_RAW\\\",\\\"CAP_IPC_LOCK\\\",\\\"CAP_IPC_OWNER\\\",\\\"CAP_SYS_MODULE\\\",\\\"CAP_SYS_RAWIO\\\",\\\"CAP_SYS_CHROOT\\\",\\\"CAP_SYS_PTRACE\\\",\\\"CAP_SYS_PACCT\\\",\\\"CAP_SYS_ADMIN\\\",\\\"CAP_SYS_BOOT\\\",\\\"CAP_SYS_NICE\\\",\\\"CAP_SYS_RESOURCE\\\",\\\"CAP_SYS_TIME\\\",\\\"CAP_SYS_TTY_CONFIG\\\",\\\"CAP_MKNOD\\\",\\\"CAP_LEASE\\\",\\\"CAP_AUDIT_WRITE\\\",\\\"CAP_AUDIT_CONTROL\\\",\\\"CAP_SETFCAP\\\",\\\"CAP_MAC_OVERRIDE\\\",\\\"CAP_MAC_ADMIN\\\",\\\"CAP_SYSLOG\\\",\\\"CAP_WAKE_ALARM\\\",\\\"CAP_BLOCK_SUSPEND\\\",\\\"CAP_AUDIT_READ\\\",\\\"CAP_PERFMON\\\",\\\"CAP_BPF\\\",\\\"CAP_CHECKPOINT_RESTORE\\\"],\\\"cgroup\\\":{\\\"v1\\\":true,\\\"v2\\\":true,\\\"systemd\\\":true,\\\"systemdUser\\\":true,\\\"rdma\\\":true},\\\"seccomp\\\":{\\\"enabled\\\":true,\\\"actions\\\":[\\\"SCMP_ACT_ALLOW\\\",\\\"SCMP_ACT_ERRNO\\\",\\\"SCMP_ACT_KILL\\\",\\\"SCMP_ACT_KILL_PROCESS\\\",\\\"SCMP_ACT_KILL_THREAD\\\",\\\"SCMP_ACT_LOG\\\",\\\"SCMP_ACT_NOTIFY\\\",\\\"SCMP_ACT_TRACE\\\",\\\"SCMP_ACT_TRAP\\\"],\\\"operators\\\":[\\\"SCMP_CMP_EQ\\\",\\\"SCMP_CMP_GE\\\",\\\"SCMP_CMP_GT\\\",\\\"SCMP_CMP_LE\\\",\\\"SCMP_CMP_LT\\\",\\\"SCMP_CMP_MASKED_EQ\\\",\\\"SCMP_CMP_NE\\\"],\\\"archs\\\":[\\\"SCMP_ARCH_AARCH64\\\",\\\"SCMP_ARCH_ARM\\\",\\\"SCMP_ARCH_MIPS\\\",\\\"SCMP_ARCH_MIPS64\\\",\\\"SCMP_ARCH_MIPS64N32\\\",\\\"SCMP_ARCH_MIPSEL\\\",\\\"SCMP_ARCH_MIPSEL64\\\",\\\"SCMP_ARCH_MIPSEL64N32\\\",\\\"SCMP_ARCH_PPC\\\",\\\"SCMP_ARCH_PPC64\\\",\\\"SCMP_ARCH_PPC64LE\\\",\\\"SCMP_ARCH_RISCV64\\\",\\\"SCMP_ARCH_S390\\\",\\\"SCMP_ARCH_S390X\\\",\\\"SCMP_ARCH_X32\\\",\\\"SCMP_ARCH_X86\\\",\\\"SCMP_ARCH_X86_64\\\"],\\\"knownFlags\\\":[\\\"SECCOMP_FILTER_FLAG_TSYNC\\\",\\\"SECCOMP_FILTER_FLAG_SPEC_ALLOW\\\",\\\"SECCOMP_FILTER_FLAG_LOG\\\"],\\\"supportedFlags\\\":[\\\"SECCOMP_FILTER_FLAG_TSYNC\\\"]},\\\"apparmor\\\":{\\\"enabled\\\":true},\\\"selinux\\\":{\\\"enabled\\\":true},\\\"intelRdt\\\":{\\\"enabled\\\":true},\\\"mountExtensions\\\":{\\\"idmap\\\":{\\\"enabled\\\":true}}},\\\"annotations\\\":{\\\"io.github.seccomp.libseccomp.version\\\":\\\"2.5.5\\\",\\\"org.opencontainers.runc.checkpoint.enabled\\\":\\\"true\\\",\\\"org.opencontainers.runc.commit\\\":\\\"v1.2.5-0-g59923ef\\\",\\\"org.opencontainers.runc.version\\\":\\\"1.2.5\\\"},\\\"potentiallyUnsafeConfigAnnotations\\\":[\\\"bundle\\\",\\\"org.systemd.property.\\\",\\\"org.criu.config\\\"]}\"}}},\"DefaultRuntime\":\"runc\",\"Swarm\":{\"NodeID\":\"\",\"NodeAddr\":\"\",\"LocalNodeState\":\"inactive\",\"ControlAvailable\":false,\"Error\":\"\",\"RemoteManagers\":null},\"LiveRestoreEnabled\":false,\"Isolation\":\"\",\"InitBinary\":\"docker-init\",\"ContainerdCommit\":{\"ID\":\"05044ec0a9a75232cad458027ca83437aae3f4da\"},\"RuncCommit\":{\"ID\":\"v1.2.5-0-g59923ef\"},\"InitCommit\":{\"ID\":\"de40ad0\"},\"SecurityOptions\":[\"name=apparmor\",\"name=seccomp,profile=builtin\"],\"FirewallBackend\":{\"Driver\":\"iptables\"},\"CDISpecDirs\":[\"/etc/cdi\",\"/var/run/cdi\"],\"Containerd\":{\"Address\":\"/run/containerd/containerd.sock\",\"Namespaces\":{\"Containers\":\"moby\",\"Plugins\":\"plugins.moby\"}},\"Warnings\":null}"

[11notes]

2025/08/12 17:39:15 http: proxy error: net/http: HTTP/1.x transport connection broken: malformed HTTP status code "historical"
2025/08/12 18:06:55 httputil: ReverseProxy read error during body copy: read unix @->/run/docker.sock: use of closed network connection

I can work with that, thanks. It seems the Docker API responds with a wrong HTTP response that crashes the reverse proxy.

[wollomatic]

I had a similar problem with tecnativa/docker-socket-proxy a few years ago on systems with "live-restore": true in the /etc/docker/daemon.json. The socket connection breaks every time when docker is updated. Maybe it's the same reason here.

[ElioDiNino]

I had a similar problem with tecnativa/docker-socket-proxy a few years ago on systems with "live-restore": true in the /etc/docker/daemon.json. The socket connection breaks every time when docker is updated. Maybe it's the same reason here.

Interesting, thanks for the idea; however, I have not touched my daemon.json (it's empty), and so that is not the issue.

[ElioDiNino]

I will leave this issue open because there does seem to be something wrong with the proxy here, but as mentioned in this issue, I have moved off of this proxy onto https://github.com/wollomatic/socket-proxy since that one is just as secure and does not have the same issue.

[amanda-wee]

I can chip in to say that I have encountered what appears to be the same problem with using this docker socket proxy with beszel agent. They were all working well for over an hour after I set them up last night, then after I went to sleep, the logs recorded for the socket proxy container: http: proxy error: read unix @->/run/docker.sock: use of closed network connection. This happened for 3 out of 5 agents though, so it doesn't seem very consistent.

[espimarisa]

Chiming in here to say that this does appear to still be an issue as well for me.