Fender: a Docker socket proxy that removes Docker Hub lock-in
Fender sits between the Docker CLI and daemon, transparently rewriting image references to your chosen registries—no Dockerfile or CI script changes required.
Fender is a transparent Unix socket proxy that sits between the Docker CLI and daemon, eliminating implicit Docker Hub lock-in without requiring any changes to Dockerfiles, CI scripts, or CLI habits. On startup it registers itself as an active Docker context, so all docker commands automatically route through it—no DOCKER_HOST exports needed. It rewrites unqualified or docker.io-normalized image references according to configured default-registry or registry-map rules, while leaving explicitly-tagged registries (like ghcr.io/org/app) untouched.
The tool follows the same context-resolution order as the Docker CLI and watches ~/.docker/ via fsnotify to detect context switches live, without restarts. It also recovers gracefully from crashes (e.g., kill -9 or power loss) by reading stored previous-context metadata on next launch. Authentication can be configured via a standalone auths block, inline credentials in registry mappings, or CI/CD secrets.
With ready-made GitHub Actions and GitLab CI integrations, fender enables private registry mirroring scenarios—redirecting all pull/push traffic to corporate mirror registries—without touching CI scripts. Written in Go and installable via go install or from source, its zero-config operation and transparent integration into existing Docker workflows make it a low-friction registry management layer for infrastructure engineers.