Server Fault is a question and answer site for system and network administrators. It only takes a minute to sign up.
Sign up to join this community
In my docker container there are some applications that make http(s) requests. How can I configure the container so that all these requests go through an external http proxy?
Docker docs suggest setting the HTTP_PROXY env var, however, from my understanding, this is an advisory setting, and the apps in the container are not forced to use it.
I can't change anything on the host system, so I'm looking for some clever docker or the container OS configuration. The container OS is ubuntu:18.04.
If you want to enforce using a proxy, you need to intercept the traffic at network level. This always has the downside that HTTPS traffic can not be easily intercepted as you would need to play man-in-the-middle via a trusted CA.
If HTTPS is not an issue (either because you decide to ignore it, or because you resolved to deploy your own CA to the certificates trust stores of each container), several spots for intercepting the traffic come to mind:
In either case you need to utilize iptables (or a similar firewalling toolset) to redirect traffic that comes from your containers on port 80 (and 443 in case of HTTPS) to be redirected through the proxy.
Using iptables this could look like
sudo iptables -t nat -A PREROUTING -i eth1 -s 192.168.1.0/24 -p tcp --dport 80 -j REDIRECT --to-port 3129
Where 3129 would be the port a SQUID might be listening for http connections, for example.
More information can be found in the SQUID configuration examples: https://wiki.squid-cache.org/ConfigExamples/Intercept/LinuxRedirect
Setting env variables forces all the applications inside the container to use the configured proxy.
docker run Example:
--env HTTP_PROXY="http://127.0.0.1:3001"
--env HTTPS_PROXY="https://127.0.0.1:3001"
