@@ -75,12 +75,20 @@ pub trait SetupConfiguration: DynClone + Send + Sync + Debug {
     /// Returns the number of worker threads for the async runtime.
     fn async_runtime_worker_threads(&self) -> usize;
 
+    /// Returns the Unix domain socket path if Unix domain socket is enabled.
+    /// Returns None if Unix socket is disabled.
+    fn unix_socket_path(&self) -> Option<&str>;
+
     /// Returns the timeout duration (in minutes) for PostgreSQL connections
     fn postgres_idle_connection_timeout_minutes(&self) -> u64;
 
     /// Returns whether TLS should be enforced for all connections.
     fn enforce_tls(&self) -> bool;
 
+    /// Returns the file permissions for Unix socket files (octal format).
+    /// Defaults to 0o660 (owner+group read/write) if not specified.
+    fn unix_socket_file_permissions(&self) -> u32;
+
     /// Provides a way to downcast the trait object to a concrete type.
     fn as_any(&self) -> &dyn std::any::Any;
 }
 
@@ -48,14 +48,43 @@ pub struct DocumentDBSetupConfiguration {
 
     // Runtime configuration
     pub async_runtime_worker_threads: Option<usize>,
+
+    // Unix domain socket configuration
+    // If specified with a non-empty path, Unix socket is enabled at that path.
+    // If not specified (None), Unix socket is disabled.
+    pub unix_socket_path: Option<String>,
+
+    // Unix socket file permissions (octal format string, e.g., "0660" for owner+group read/write)
+    // If not specified, defaults to 0o660
+    pub unix_socket_file_permissions: Option<String>,
 }
 
 impl DocumentDBSetupConfiguration {
     pub fn new(config_path: &Path) -> Result<Self> {
         let config_file = File::open(config_path)?;
-        serde_json::from_reader(config_file).map_err(|e| {
+        let config: Self = serde_json::from_reader(config_file).map_err(|e| {
             DocumentDBError::internal_error(format!("Failed to parse configuration file: {e}"))
-        })
+        })?;
+
+        // Validate Unix socket path if provided
+        if let Some(path) = &config.unix_socket_path {
+            if path.trim().is_empty() {
+                return Err(DocumentDBError::internal_error(
+                    "UnixSocketPath cannot be empty. Either provide a valid path or omit the field to disable Unix sockets.".to_string()
+                ));
+            }
+        }
+
+        // Validate Unix socket permissions if provided
+        if let Some(perm_str) = &config.unix_socket_file_permissions {
+            if u32::from_str_radix(perm_str, 8).is_err() {
+                return Err(DocumentDBError::internal_error(
+                    format!("Invalid UnixSocketFilePermissions '{perm_str}'. Expected octal format like '0600', '0644'")
+                ));
+            }
+        }
+
+        Ok(config)
     }
 }
 
@@ -138,11 +167,22 @@ impl SetupConfiguration for DocumentDBSetupConfiguration {
         })
     }
 
+    fn unix_socket_path(&self) -> Option<&str> {
+        self.unix_socket_path.as_deref()
+    }
+
     fn postgres_idle_connection_timeout_minutes(&self) -> u64 {
         self.postgres_idle_connection_timeout_minutes.unwrap_or(5)
     }
 
     fn enforce_tls(&self) -> bool {
         self.enforce_tls.unwrap_or(true)
     }
+
+    fn unix_socket_file_permissions(&self) -> u32 {
+        match &self.unix_socket_file_permissions {
+            None => 0o660, // Default when not provided
+            Some(perm_str) => u32::from_str_radix(perm_str, 8).unwrap(),
+        }
+    }
 }
@@ -31,7 +31,7 @@ use std::net::IpAddr;
 use std::{pin::Pin, sync::Arc, time::Duration};
 use tokio::{
     io::{AsyncRead, AsyncWrite, BufStream},
-    net::{TcpListener, TcpStream},
+    net::{TcpListener, TcpStream, UnixListener, UnixStream},
 };
 use tokio_openssl::SslStream;
 use tokio_util::sync::CancellationToken;
@@ -61,6 +61,71 @@ const STREAM_WRITE_BUFFER_SIZE: usize = 8 * 1024;
 // TLS detection timeout
 const TLS_PEEK_TIMEOUT_SECS: u64 = 5;
 
+/// Applies configurable permissions to Unix domain socket file.
+///
+/// On Unix systems: Sets permissions to the specified octal value
+/// On other platforms: No-op (permissions handled by OS defaults)
+#[cfg(unix)]
+fn apply_socket_permissions(path: &str, permissions: u32) -> std::io::Result<()> {
+    use std::os::unix::fs::PermissionsExt;
+    let file_permissions = std::fs::Permissions::from_mode(permissions);
+    std::fs::set_permissions(path, file_permissions)
+}
+
+#[cfg(not(unix))]
+fn apply_socket_permissions(_path: &str, _permissions: u32) -> std::io::Result<()> {
+    Ok(())
+}
+
+/// Creates and configures a Unix domain socket listener.
+///
+/// This function handles the complete Unix socket setup:
+/// 1. Removes stale socket file from previous run (crash recovery)
+/// 2. Binds to the socket path
+/// 3. Sets appropriate permissions via platform-specific logic
+///
+/// # Arguments
+///
+/// * `socket_path` - Path where the Unix socket should be created
+/// * `permissions` - Octal file permissions (e.g., 0o660)
+///
+/// # Returns
+///
+/// Returns the configured `UnixListener` or an error if setup fails.
+///
+/// # Errors
+///
+/// This function will return an error if:
+/// * Failed to bind to the socket path
+/// * Failed to set socket file permissions
+fn create_unix_socket_listener(socket_path: &str, permissions: u32) -> Result<UnixListener> {
+    // Attempt to remove stale socket file from previous run (e.g., after crash).
+    // This is standard Unix socket practice - PostgreSQL, MySQL, Redis all use this pattern.
+    // Socket files cannot be cleaned up during crash (SIGKILL, segfault, power loss, etc.),
+    // so cleanup at startup is the only reliable approach for crash recovery.
+    // If the file couldn't be removed, bind() will fail with clear error "Address already in use".
+    if let Err(e) = std::fs::remove_file(socket_path) {
+        if e.kind() != std::io::ErrorKind::NotFound {
+            tracing::warn!(
+                "Could not remove existing socket file {}: {}.",
+                socket_path,
+                e
+            );
+        }
+    }
+
+    let listener = UnixListener::bind(socket_path)?;
+
+    apply_socket_permissions(socket_path, permissions)?;
+
+    tracing::info!(
+        "Unix socket listener bound to {} with permissions {:o}",
+        socket_path,
+        permissions
+    );
+    Ok(listener)
+}
+
 /// Runs the DocumentDB gateway server, accepting and handling incoming connections.
 ///
 /// This function sets up a TCP listener and SSL context, then continuously accepts
@@ -104,7 +169,24 @@ where
     ))
     .await?;
 
-    // Listen for new tcp connections until token is not cancelled
+    tracing::info!(
+        "TCP listener bound to port {}",
+        service_context.setup_configuration().gateway_listen_port()
+    );
+
+    let unix_listener =
+        if let Some(unix_socket_path) = service_context.setup_configuration().unix_socket_path() {
+            let permissions = service_context
+                .setup_configuration()
+                .unix_socket_file_permissions();
+            let unix_listener = create_unix_socket_listener(unix_socket_path, permissions)?;
+            Some(unix_listener)
+        } else {
+            tracing::info!("Unix socket disabled (not configured)");
+            None
+        };
+
+    // Listen for new tcp and unix socket connections
     loop {
         tokio::select! {
             stream_and_address = tcp_listener.accept() => {
@@ -119,7 +201,28 @@ where
                     .await;
 
                     if let Err(conn_err) = conn_res {
-                        tracing::error!("Failed to accept a connection: {conn_err:?}.");
+                        tracing::error!("Failed to accept a TCP connection: {conn_err:?}.");
+                    }
+                });
+            }
+            stream_result = async {
+                match &unix_listener {
+                    Some(listener) => listener.accept().await,
+                    None => std::future::pending().await,
+                }
+            }, if unix_listener.is_some() => {
+                let conn_service_context = service_context.clone();
+                let conn_telemetry = telemetry.clone();
+                tokio::spawn(async move {
+                    let conn_res = handle_unix_connection::<T>(
+                        stream_result,
+                        conn_service_context,
+                        conn_telemetry,
+                    )
+                    .await;
+
+                    if let Err(conn_err) = conn_res {
+                        tracing::error!("Failed to accept a Unix socket connection: {conn_err:?}.");
                     }
                 });
             }
@@ -337,6 +440,63 @@ where
     Ok(())
 }
 
+/// Handles a single Unix socket connection without TLS.
+///
+/// Unix socket connections are local-only and don't require TLS encryption.
+/// This function creates a connection context and processes the connection.
+///
+/// # Arguments
+///
+/// * `stream_result` - Result containing the Unix stream from accept()
+/// * `service_context` - Service configuration and shared state
+/// * `telemetry` - Optional telemetry provider for metrics collection
+///
+/// # Returns
+///
+/// Returns `Ok(())` on successful connection handling, or an error if connection
+/// setup fails.
+async fn handle_unix_connection<T>(
+    stream_result: std::result::Result<(UnixStream, tokio::net::unix::SocketAddr), std::io::Error>,
+    service_context: ServiceContext,
+    telemetry: Option<Box<dyn TelemetryProvider>>,
+) -> Result<()>
+where
+    T: PgDataClient,
+{
+    let (unix_stream, _socket_addr) = stream_result?;
+
+    let connection_id = Uuid::new_v4();
+    tracing::info!(
+        activity_id = connection_id.to_string().as_str(),
+        "New Unix socket connection established"
+    );
+
+    // For Unix sockets, use localhost as the address since they don't have IP addresses
+
+    let connection_context = ConnectionContext::new(
+        service_context,
+        telemetry,
+        "localhost".to_string(),
+        None, // No TLS for Unix sockets
+        connection_id,
+        "UnixSocket".to_string(),
+    );
+
+    let buffered_stream = BufStream::with_capacity(
+        STREAM_READ_BUFFER_SIZE,
+        STREAM_WRITE_BUFFER_SIZE,
+        unix_stream,
+    );
+
+    tracing::info!(
+        activity_id = connection_id.to_string().as_str(),
+        "Unix socket connection established - Connection Id {connection_id}"
+    );
+
+    handle_stream::<T, _>(buffered_stream, connection_context).await;
+    Ok(())
+}
+
 async fn handle_stream<T, S>(mut stream: S, mut connection_context: ConnectionContext)
 where
     T: PgDataClient,
 
@@ -133,6 +133,16 @@ pub fn setup_configuration() -> DocumentDBSetupConfiguration {
     }
 }
 
+pub fn setup_configuration_with_unix_socket_custom(
+    path: Option<String>,
+    permissions: Option<String>,
+) -> DocumentDBSetupConfiguration {
+    let mut config = setup_configuration();
+    config.unix_socket_path = path;
+    config.unix_socket_file_permissions = permissions;
+    config
+}
+
 pub fn get_client() -> Client {
     let credential = Credential::builder()
         .username("test".to_string())
@@ -179,6 +189,35 @@ pub async fn initialize_with_config(config: DocumentDBSetupConfiguration) -> Cli
     get_client()
 }
 
+#[allow(dead_code)]
+pub fn get_unix_socket_client_custom(path: &str) -> Client {
+    use std::time::Duration;
+    let credential = Credential::builder()
+        .username("test".to_string())
+        .password("test".to_string())
+        .mechanism(AuthMechanism::ScramSha256)
+        .build();
+
+    let client_options = ClientOptions::builder()
+        .credential(credential)
+        .hosts(vec![ServerAddress::parse(path).unwrap()])
+        .connect_timeout(Duration::from_millis(100))
+        .server_selection_timeout(Duration::from_millis(100))
+        .build();
+    Client::with_options(client_options).unwrap()
+}
+
+#[allow(dead_code)]
+pub async fn initialize_with_config_and_unix(path: Option<String>) -> (Client, Option<Client>) {
+    let config = setup_configuration_with_unix_socket_custom(path.clone(), None);
+    initialize_full(config).await;
+
+    let tcp_client = get_client();
+    let unix_client = path.map(|socket_path| get_unix_socket_client_custom(&socket_path));
+
+    (tcp_client, unix_client)
+}
+
 #[allow(dead_code)]
 pub async fn initialize() -> Client {
     initialize_full(setup_configuration()).await;