docker-proxy

A small userland binary that forwards traffic from a host port to a container port. It exists because iptables DNAT alone cannot reach a container that publishes a port to 127.0.0.1 — the kernel won't route loopback traffic to the bridge namespace. docker-proxy runs in the host network namespace and forwards bytes to the container endpoint.

Source

File	Purpose
cmd/docker-proxy/main_linux.go	Flag parsing, signal handling, dispatch by proto.
cmd/docker-proxy/tcp_proxy_linux.go	TCP forwarder.
cmd/docker-proxy/udp_proxy_linux.go	UDP forwarder.
cmd/docker-proxy/sctp_proxy_linux.go	SCTP forwarder.
cmd/docker-proxy/proxy_linux.go	Common Proxy interface.

When it runs

The bridge driver in daemon/libnetwork/drivers/bridge/ launches a docker-proxy per published port unless --userland-proxy=false is set in the daemon config. The proxy binary is a separate executable so it can be replaced or sandboxed independently of the daemon.

Toggling

// /etc/docker/daemon.json
{ "userland-proxy": false }

When disabled, the bridge driver relies purely on iptables/nftables rules. The userland proxy is still useful for loopback publishing and certain NAT edge cases.

Tests

cmd/docker-proxy/network_proxy_linux_test.go exercises the TCP/UDP/SCTP code paths without needing a daemon.