Getting started

Run the proxy

DockYARP watches the Docker socket and routes to containers based on their labels. Its runtime image is non-root, so it cannot open /var/run/docker.sock directly — it reaches the Docker API through a read-only socket proxy instead:

services:
  dockerproxy:
    image: tecnativa/docker-socket-proxy
    environment:
      CONTAINERS: "1"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro

  dockyarp:
    image: ghcr.io/gcelet/dockyarp   # or dockyarp:local for a local build
    ports:
      - "80:8080"
      - "443:8443"
    environment:
      Docker__Enabled: "true"
      Docker__DockerEndpoint: "tcp://dockerproxy:2375"
    volumes:
      - certs:/certs
    depends_on: [dockerproxy]

volumes:
  certs:

docker compose up -d

The admin API and dashboard are off by default (AdminApi:Surface: Disabled) — see Examples to turn them on.

Expose a container

Add nginx-proxy-compatible labels to any container. DockYARP picks it up live — no restart needed.

services:
  web:
    image: my-app
    labels:
      - "VIRTUAL_HOST=app.example.io"
      - "VIRTUAL_PORT=8080"

The container is now served at http://app.example.io/.

Add automatic TLS

Declare LETSENCRYPT_HOST (and a contact email) to have a certificate provisioned and renewed for the host:

    labels:
      - "VIRTUAL_HOST=app.example.io"
      - "VIRTUAL_PORT=8080"
      - "LETSENCRYPT_HOST=app.example.io"
      - "LETSENCRYPT_EMAIL=admin@example.io"

Next steps

• Configuration — the full label and application-config reference.
• Features — what DockYARP does at runtime (discovery, routing, TLS, admin API…).
• Examples — copy-pasteable recipes for common setups.
• Architecture — how discovery, routing (YARP), and TLS fit together.
• Deployment — running DockYARP in production.