Socket Firewall

Socket Firewall (Registry Mode) is a container that sits between your package managers and the registries they pull from. Every package download is checked against Socket before it reaches the machine. A blocked package returns HTTP 403, so the install fails with a reason and a request ID.

These pages take you from a running firewall to a production rollout. Start with the first page, then follow the goals that matter to you.

Get started

Goal	Page
Stand up the firewall in about 15 minutes	Stand Up Socket Firewall For The First Time
Prove a malicious package is blocked, including when it's a transitive dependency	Flat block
Hold back newly published versions for a few days	Cooldown
Decide what is blocked, warned or allowed	Policy config

Run it in production

Goal	Page
Keep verdicts across restarts and share them between instances	Redis cache
Hide blocked versions so installs resolve to an allowed version	Metadata filtering
Choose where the firewall sits in your network	Deployments
Route traffic with no client changes	DNS override
Point developer machines at the firewall	Configure registry: dev
Point pipelines and Docker builds at the firewall	Configure registry: CI/CD

See what it decided

Goal	Page
Read the decision log and its fields	Data
Send decisions to any HTTP endpoint	Webhook config
Send decisions to Splunk	Splunk config

Before you start

A host with Docker and Docker Compose.
A Socket API token with the packages:list and entitlements:list scopes (Settings → API Tokens).
A hostname for the firewall. These pages use sfw.example.com; replace it with your own.