If you want to enforce using a proxy, you need to intercept the traffic at network level. This always has the downside that HTTPS traffic can not be easily intercepted as you would need to play man-in-the-middle via a trusted CA.
If HTTPS is not an issue (either because you decide to ignore it, or because you resolved to deploy your own CA to the certificates trust stores of each container), several spots for intercepting the traffic come to mind:
- the docker host system (aka the default gateway of the containers)
- the default gateway of the docker host system
In either case you need to utilize iptables
(or a similar firewalling toolset) to redirect traffic that comes from your containers on port 80
(and 443
in case of HTTPS) to be redirected through the proxy.
Using iptables
this could look like
sudo iptables -t nat -A PREROUTING -i eth1 -s 192.168.1.0/24 -p tcp --dport 80 -j REDIRECT --to-port 3129
Where 3129
would be the port a SQUID might be listening for http connections, for example.
More information can be found in the SQUID configuration examples: https://wiki.squid-cache.org/ConfigExamples/Intercept/LinuxRedirect