diff --git a/abra.sh b/abra.sh
index ea6b88f..126ccaf 100644
--- a/abra.sh
+++ b/abra.sh
@@ -1,3 +1,3 @@
-export TRAEFIK_YML_VERSION=v20
+export TRAEFIK_YML_VERSION=v21
 export FILE_PROVIDER_YML_VERSION=v10
 export ENTRYPOINT_VERSION=v3
diff --git a/compose.yml b/compose.yml
index 636b171..a321708 100644
--- a/compose.yml
+++ b/compose.yml
@@ -11,7 +11,6 @@ services:
       - "80:80"
       - "443:443"
     volumes:
-      - "/var/run/docker.sock:/var/run/docker.sock"
       - "letsencrypt:/etc/letsencrypt"
       - "file-providers:/etc/traefik/file-providers"
     configs:
@@ -24,6 +23,7 @@ services:
         mode: 0555
     networks:
       - proxy
+      - internal
     environment:
       - DASHBOARD_ENABLED
       - LOG_LEVEL
@@ -50,9 +50,45 @@ services:
         - "coop-cloud.${STACK_NAME}.version=2.6.3+v2.11.2"
         - "coop-cloud.${STACK_NAME}.timeout=${TIMEOUT:-120}"
 
+  socket-proxy:
+    image: lscr.io/linuxserver/socket-proxy:1.26.1-r0-ls15
+    environment:
+      - ALLOW_START=0
+      - ALLOW_STOP=0
+      - ALLOW_RESTARTS=0
+      - AUTH=0
+      - BUILD=0
+      - COMMIT=0
+      - CONFIGS=0
+      - CONTAINERS=1 # Needs access
+      - DISABLE_IPV6=0
+      - DISTRIBUTION=0
+      - EVENTS=1 # Needs access
+      - EXEC=0
+      - IMAGES=0
+      - INFO=0
+      - NETWORKS=1 # Needs access
+      - NODES=0
+      - PING=0
+      - POST=0
+      - PLUGINS=0
+      - SECRETS=0
+      - SERVICES=1 # Needs access
+      - SESSION=0
+      - SWARM=0
+      - SYSTEM=0
+      - TASKS=1 # Needs access
+      - VERSION=1 # Needs access
+      - VOLUMES=0
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+    networks:
+      - internal
+
 networks:
   proxy:
     external: true
+  internal:
 
 configs:
   traefik_yml:
diff --git a/traefik.yml.tmpl b/traefik.yml.tmpl
index 5ef1676..f2af6ad 100644
--- a/traefik.yml.tmpl
+++ b/traefik.yml.tmpl
@@ -4,7 +4,7 @@ log:
 
 providers:
   docker:
-    endpoint: "unix:///var/run/docker.sock"
+    endpoint: "tcp://socket-proxy:2375"
     exposedByDefault: false
     network: proxy
     swarmMode: true