diff --git a/README.md b/README.md
index ffaab78..708a580 100644
--- a/README.md
+++ b/README.md
@@ -10,6 +10,7 @@ This container is a stand-in till there is native support for `--exit-on-unhealt
 [![](https://images.microbadger.com/badges/version/willfarrell/autoheal.svg)](http://microbadger.com/images/willfarrell/autoheal "Get your own version badge on microbadger.com")  [![](https://images.microbadger.com/badges/image/willfarrell/autoheal.svg)](http://microbadger.com/images/willfarrell/autoheal "Get your own image badge on microbadger.com")
 
 ## How to use
+### UNIX socket passthrough
 ```bash
 docker run -d \
     --name autoheal \
@@ -18,6 +19,16 @@ docker run -d \
     -v /var/run/docker.sock:/var/run/docker.sock \
     willfarrell/autoheal
 ```
+### TCP socket
+```bash
+docker run -d \
+    --name autoheal \
+    --restart=always \
+    -e AUTOHEAL_CONTAINER_LABEL=all \
+    -e DOCKER_SOCK=tcp://HOST:PORT \
+    -v /path/to/certs/:/certs/:ro \
+    willfarrell/autoheal
+```
 a) Apply the label `autoheal=true` to your container to have it watched.
 
 b) Set ENV `AUTOHEAL_CONTAINER_LABEL=all` to watch all running containers. 
@@ -25,6 +36,12 @@ b) Set ENV `AUTOHEAL_CONTAINER_LABEL=all` to watch all running containers.
 c) Set ENV `AUTOHEAL_CONTAINER_LABEL` to existing label name that has the value `true`.
 
 Note: You must apply `HEALTHCHECK` to your docker images first. See https://docs.docker.com/engine/reference/builder/#healthcheck for details.
+See https://docs.docker.com/engine/security/https/ for how to configure TCP with mTLS
+
+The certificates, and keys need these names:
+* ca.pem
+* client-cert.pem
+* client-key.pem
 
 ## ENV Defaults
 ```
diff --git a/docker-entrypoint b/docker-entrypoint
index 9d92781..0b50c84 100755
--- a/docker-entrypoint
+++ b/docker-entrypoint
@@ -5,16 +5,31 @@ set -e
 set -o pipefail
 
 DOCKER_SOCK=${DOCKER_SOCK:-/var/run/docker.sock}
+UNIX_SOCK=""
 CURL_TIMEOUT=${CURL_TIMEOUT:-30}
 
+# only use unix domain socket if no TCP endpoint is defined
+case "${DOCKER_SOCK}" in
+  "tcp://"*) HTTP_ENDPOINT="$(echo ${DOCKER_SOCK} | sed 's#tcp://#https://#')"
+             CA="--cacert /certs/ca.pem"
+             CLIENT_KEY="--key /certs/client-key.pem"
+             CLIENT_CERT="--cert /certs/client-cert.pem"
+             ;;
+  *)         HTTP_ENDPOINT="http://localhost"
+             UNIX_SOCK="--unix-socket ${DOCKER_SOCK}"
+             ;;
+esac
+
 AUTOHEAL_CONTAINER_LABEL=${AUTOHEAL_CONTAINER_LABEL:-autoheal}
 AUTOHEAL_START_PERIOD=${AUTOHEAL_START_PERIOD:-0}
 AUTOHEAL_INTERVAL=${AUTOHEAL_INTERVAL:-5}
 AUTOHEAL_DEFAULT_STOP_TIMEOUT=${AUTOHEAL_DEFAULT_STOP_TIMEOUT:-10}
 
-# shellcheck disable=2039
 docker_curl() {
-  curl --max-time "$CURL_TIMEOUT" --no-buffer -s --unix-socket "$DOCKER_SOCK" "$@"
+  curl --max-time "${CURL_TIMEOUT}" --no-buffer -s \
+  ${CA} ${CLIENT_KEY} ${CLIENT_CERT} \
+  ${UNIX_SOCK} \
+  "$@"
 }
 
 # shellcheck disable=2039
@@ -29,7 +44,7 @@ get_container_info() {
   else
     label_filter=",\"label\":\[\"${AUTOHEAL_CONTAINER_LABEL}=true\"\]"
   fi
-  url="http://localhost/containers/json?filters=\{\"health\":\[\"unhealthy\"\]${label_filter}\}"
+  url="${HTTP_ENDPOINT}/containers/json?filters=\{\"health\":\[\"unhealthy\"\]${label_filter}\}"
   docker_curl "$url"
 }
 
@@ -38,7 +53,7 @@ restart_container() {
   local container_id="$1"
   local timeout="$2"
 
-  docker_curl -f -X POST "http://localhost/containers/${container_id}/restart?t=${timeout}"
+  docker_curl -f -X POST "${HTTP_ENDPOINT}/containers/${container_id}/restart?t=${timeout}"
 }
 
 # SIGTERM-handler
@@ -49,10 +64,7 @@ term_handler() {
 # shellcheck disable=2039
 trap 'kill $$; term_handler' SIGTERM
 
-if [ "$1" = "autoheal" ] && [ -e "$DOCKER_SOCK" ]
-then
-  # https://docs.docker.com/engine/api/v1.25/
-
+if [ "$1" = "autoheal" ] && [ -e "$DOCKER_SOCK" ];then
   # Delayed startup
   if [ "$AUTOHEAL_START_PERIOD" -gt 0 ]
   then
@@ -84,6 +96,7 @@ then
     done
     sleep "$AUTOHEAL_INTERVAL"
   done
+
 else
   exec "$@"
-fi
+fi
\ No newline at end of file