Secure Pipes

Docker Socket Forwarding

Use a Secure Pipes SSH tunnel to access a remote Docker socket from your Mac, or a local socket from a remote host.

Before you run

Docker socket access grants powerful control over the Docker host, often equivalent to administrator access. Use loopback addresses only, never expose the listener to an untrusted network, and stop the tunnel after use. Other users and processes on the listener machine may also access the unauthenticated local port. The SSH user must have permission to access the relevant socket; the SSH server must allow the corresponding forwarding. Do not weaken socket permissions to make this work.

Examples

Prerequisites: install the Docker CLI where you run the test and ensure the destination Docker daemon is running. On the Mac, inspect the current Docker context; a Unix socket path must be absolute. Remote contexts are not local sockets.

docker context inspect --format '{{.Endpoints.docker.Host}}'

Local forwarding: in Secure Pipes choose Local Forward, set the local endpoint to 127.0.0.1:8888, and choose Remote Unix Socket with /var/run/docker.sock. Connect to the remote Ubuntu host, then run this command on the Mac.

docker -H tcp://127.0.0.1:8888 ps

To find the Mac socket for remote forwarding, inspect the Docker context on the Mac. For example, OrbStack may report unix:///Users/yourname/.orbstack/run/docker.sock; use your actual absolute path.

docker context inspect --format '{{.Endpoints.docker.Host}}'

Remote forwarding: in Secure Pipes choose Remote Forward, set the remote endpoint to 127.0.0.1:8888, and choose Local Unix Socket with the Mac socket path. After connecting, run this command on the remote host.

docker -H tcp://127.0.0.1:8888 ps

Alternatively, set DOCKER_HOST for one command only. This does not change the current shell or the saved Docker context.

DOCKER_HOST=tcp://127.0.0.1:8888 docker ps

Authoritative references

Reviewed October 27, 2026