dpxy watches a Docker or Podman daemon for container start and stop events and automatically manages port forwarding between the local machine and a remote host. When a container with published ports starts, dpxy listens on each host port and forwards TCP connections to the corresponding port on the remote host. When the container stops, the forwards are torn down.

This is useful when running Docker or Podman on a remote VM (e.g. via DOCKER_HOST) and wanting published container ports to be accessible locally without manually managing tunnels.

• SSH access to the remote host (for ssh:// URLs)

dpxy [-host <host-url>] [-remote-binary <binary>]

If -host is not provided, dpxy falls back to the DOCKER_HOST environment variable, or CONTAINER_HOST if DOCKER_HOST is not set.

The -remote-binary flag controls the container runtime binary invoked on the remote host for the dial-stdio connection. It defaults to docker and can be set to podman or a full path (e.g. /usr/bin/docker) if the binary is not on the remote host's default PATH.

# SSH-based remote Docker host
dpxy -host ssh://user@myhost

# SSH-based remote Podman host
dpxy -host ssh://user@myhost -remote-binary podman

# Using the environment variable
DOCKER_HOST=ssh://user@myhost dpxy

On Linux, binding to ports below 1024 requires elevated privileges by default. To allow dpxy to bind to these ports as a non-root user, grant the binary the CAP_NET_BIND_SERVICE capability:

sudo setcap cap_net_bind_service=+ep /usr/local/bin/dpxy

Note that setcap must be reapplied whenever the binary is replaced.

When running under systemd, the provided unit file handles this automatically via AmbientCapabilities instead, so setcap is not needed in that case.

Copy the unit file and create an environment file, then enable and start the service:

sudo cp contrib/dpxy.service /etc/systemd/system/dpxy.service
echo "DOCKER_HOST=ssh://user@myhost" | sudo tee /etc/default/dpxy
sudo systemctl daemon-reload
sudo systemctl enable --now dpxy

Configuration is read from /etc/default/dpxy. Supported variables:

Edit contrib/net.sivel.dpxy.plist and replace the DOCKER_HOST placeholder with your Docker host URL, then load it:

cp contrib/net.sivel.dpxy.plist ~/Library/LaunchAgents/
launchctl bootstrap gui/$(id -u) ~/Library/LaunchAgents/net.sivel.dpxy.plist

Logs are written to /usr/local/var/log/dpxy.log.

To unload:

launchctl bootout gui/$(id -u) ~/Library/LaunchAgents/net.sivel.dpxy.plist