When running HAProxy in a docker container, we can only see (and forward) the original client's IP when running the container with the --net=host option as described here.

Our question: Is this advisable from a security standpoint? Will this allow attackers more easily to exploit HAProxy vulnerabilities? Or is it common practice?

  • Won't running HaProxy in a container harm its performance? May 4 '20 at 15:31
  • Maybe, idk. But on CoreOS you have to run all services in containers. May 4 '20 at 15:36

Using the host's network stack beats the purpose of isolation.

Rather than using the host network, you can create a network of its own and fiddle with iptable NAT to not MASQUERADE the incoming connections and directly pass them to the HAPROXY container. This way, the HAproxy will receive client ip that is received in your host end.

Like in here.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.