{"topic":{"id":13978,"title":"给 docker 配置 proxy 的方法","slug":"topic","categoryId":11,"createdAt":"2024-12-06 12:49:50.234527","bumpedAt":"2024-12-07 01:30:50.610592","views":339,"postsCount":3,"highestPostNumber":3,"likeCount":3,"closed":false,"pinned":false,"pinnedGlobally":false,"pinnedAt":null,"pinnedUntil":null,"isBanner":false,"excerpt":"Chinese network is notorious for its unpredictability and counter-productivity. Most of the content are borrowed from Arch wiki and elsewhere and are only applicable to Linux. Configuring HTTP Proxies for Docker There ar…","deletedAt":null,"isAnonymous":false,"category":{"id":11,"name":"深入交流","slug":"distilled","color":"c01c28"},"author":{"id":4668,"username":"IO","name":null,"avatarUrl":"/uploads/image/86/f2/86f267c0aaa73835a999b7cc3a7e7a701605574eda9a2c2a56f5ddbbba64d1a9.avif"},"tags":["docker"]},"posts":[{"id":44275,"postNumber":1,"raw":"Chinese network is notorious for its unpredictability and counter-productivity.\n\nMost of the content are borrowed from Arch wiki and elsewhere and are only applicable to Linux.\n\n### Configuring HTTP Proxies for Docker\n\nThere are two parts to configuring Docker to use an HTTP proxy: Configuring the Docker **daemon** and configuring Docker **containers**.\n\n#### Docker **daemon** proxy configuration\n\nSee [Docker documentation on configuring Docker daemon to use HTTP proxies](https://docs.docker.com/config/daemon/systemd/#httphttps-proxy).\n\nBasically, your `/etc/docker/daemon.json` should be something like this:\n```\n{\n \"proxies\": {\n \"http-proxy\": \"http://172.17.0.1:4099\",\n \"https-proxy\": \"http://172.17.0.1:4099\",\n \"no-proxy\": \"*.test.example.com,.example.org,127.0.0.0/8\"\n }\n}\n```\n\n#### Docker **container** proxy configuration\n\nSee [Docker documentation on configuring proxies](https://docs.docker.com/network/proxy/#configure-the-docker-client) for information on how to automatically configure proxies for all containers created using the `docker` CLI.\nBasically, your `~/.docker/config.json` should be like:\n```\n{\n \"proxies\": {\n \"default\": {\n \"httpProxy\": \"http://172.17.0.1:4099\",\n \"httpsProxy\": \"http://172.17.0.1:4099\",\n \"noProxy\": \"192.168.1.1/16,127.0.0.0/8\"\n }\n }\n}\n```\n\nAnd your http proxy should listen on the IP (`172.17.0.1` in this case) of interface `docker0` or simply `0.0.0.0`. Make sure your firewall does not block the port. Note that in most cases, the url for \"httpsProxy\" should start with `http` instead of `https` unless you know what you are doing.\n\nCheck whether it works by running a curl container:\n```\ndocker run --rm curlimages/curl:8.11.0 -L -v http://g.co\n```\n\n\n\nIf your `docker0` IP is different than above, you can take a look at a more adaptive method at: https://stackoverflow.com/questions/30439684/docker-container-how-to-use-host-proxy\n\n#### Convert Socks5 to http proxy\nAs you can see from the config above, Docker container and daemon's proxy should be HTTP(s) proxy, while most modern proxy software only provide SOCKS5 proxy.\n\nYou can use multiple open source tools available, such as [cvtp](https://github.com/fokx/cvtp):\n\n```\ncvtp -listen=all -from=127.0.0.1:7891\n```\nWhen you don't want the proxy, you can bypass it easily:\n```\ncvtp -listen=all -from=127.0.0.1:7891 -bypass\n```\n\n### Configuring System Level Proxy\nTools like `proxychains`, [graftcp](https://github.com/hmgle/graftcp), iptables based transparent proxy e.g.g [ss-tproxy](https://github.com/zfl9/ss-tproxy) won't work with Docker.\n\nYou can use [tun2socks](https://github.com/xjasonlyu/tun2socks/) and add `--net=host` to `docker run`. The steps can be something like:\n```\n# check original route table\nip a\nip r\n# set physical gateway\nnic=eno145\ngateway=10.184.17.1\n# add the IP aboard that your proxy software is connecting to direct route:\nip route add X.X.X.X/32 via $gateway dev $nic metric 1\n# add tun nic\nip tuntap add mode tun dev tun0\nip addr add 198.18.0.1/15 dev tun0\nip link set dev tun0 up\n\n# start socks5 to tun converter\ntun2socks --device tun0 --proxy socks5://127.0.0.1:XXXX -interface $nic \n\n# dangerous especially if you are typing on a remote host\n# delete the original default route and route all traffic through tun0\nip r delete default\nip route add default via 198.18.0.1 dev tun0 metric 2\n\n## optional:\n# configure sysctl\nsysctl net.ipv4.conf.all.rp_filter=0\nsysctl net.ipv4.conf.$nic.rp_filter=0\n\n# check what is your public IP address now \ncurl https://myip.xjtu.app\n```\n\n\n### Configuring DNS\n\nIf you can successfully `curl -v https://1.1.1.1` but cannot `curl -v https://one.one.one.one`, chances are that your DNS is done.\n\nSee [Docker's DNS documentation](https://docs.docker.com/config/containers/container-networking/#dns-services) for the documented behavior of DNS within Docker containers and information on customizing DNS configuration. In most cases, the resolvers configured on the host are also configured in the container.\n\nMost DNS resolvers hosted on `127.0.0.0/8` are [not supported](https://github.com/moby/moby/issues/6388#issuecomment-76124221) due to conflicts between the container and host network namespaces. Such resolvers are [removed from the container's /etc/resolv.conf](https://github.com/moby/libnetwork/blob/master/resolvconf/resolvconf.go). If this would result in an empty `/etc/resolv.conf`, Google DNS is used instead.\n\nAdditionally, a special case is handled if `127.0.0.53` is the only configured nameserver. In this case, Docker assumes the resolver is [systemd-resolved](https://wiki.archlinux.org/title/Systemd-resolved) and uses the upstream DNS resolvers from `/run/systemd/resolve/resolv.conf`.\n\nIf you are using a service such as [dnsmasq](https://wiki.archlinux.org/title/Dnsmasq) to provide a local resolver, consider adding a virtual interface with a link local IP address in the `169.254.0.0/16` block for dnsmasq to bind to instead of `127.0.0.1` to avoid the network namespace conflict.\n\nBasically you can use `cloudflared` to listen on `0.0.0.0`:\n```\nsudo setcap 'cap_net_bind_service=+ep' cloudflared\ncloudflared proxy-dns --address 0.0.0.0 --upstream https://9.9.9.9/dns-query --upstream https://1.1.1.1/dns-query --upstream https://1.0.0.1/dns-query --upstream https://149.112.112.9/dns-query --upstream https://149.112.112.112/dns-query --upstream https://8.8.8.8/dns-query --upstream https://ordns.he.net/dns-query --upstream https://64.6.64.6/dns-query --upstream https://doh.cleanbrowsing.org/doh/security-filter/ \n```","cooked":"

Chinese network is notorious for its unpredictability and counter-productivity.

Most of the content are borrowed from Arch wiki and elsewhere and are only applicable to Linux.

Configuring HTTP Proxies for Docker

There are two parts to configuring Docker to use an HTTP proxy: Configuring the Docker daemon and configuring Docker containers.

Docker daemon proxy configuration

See Docker documentation on configuring Docker daemon to use HTTP proxies.

Basically, your /etc/docker/daemon.json should be something like this:

{\n  \"proxies\": {\n    \"http-proxy\": \"http://172.17.0.1:4099\",\n    \"https-proxy\": \"http://172.17.0.1:4099\",\n    \"no-proxy\": \"*.test.example.com,.example.org,127.0.0.0/8\"\n  }\n}\n

Docker container proxy configuration

See Docker documentation on configuring proxies for information on how to automatically configure proxies for all containers created using the docker CLI.
\nBasically, your ~/.docker/config.json should be like:

{\n \"proxies\": {\n   \"default\": {\n     \"httpProxy\": \"http://172.17.0.1:4099\",\n     \"httpsProxy\": \"http://172.17.0.1:4099\",\n     \"noProxy\": \"192.168.1.1/16,127.0.0.0/8\"\n   }\n }\n}\n

And your http proxy should listen on the IP (172.17.0.1 in this case) of interface docker0 or simply 0.0.0.0. Make sure your firewall does not block the port. Note that in most cases, the url for \"httpsProxy\" should start with http instead of https unless you know what you are doing.

Check whether it works by running a curl container:

docker run --rm curlimages/curl:8.11.0 -L -v http://g.co\n

If your docker0 IP is different than above, you can take a look at a more adaptive method at: https://stackoverflow.com/questions/30439684/docker-container-how-to-use-host-proxy

Convert Socks5 to http proxy

As you can see from the config above, Docker container and daemon's proxy should be HTTP(s) proxy, while most modern proxy software only provide SOCKS5 proxy.

You can use multiple open source tools available, such as cvtp:

cvtp -listen=all -from=127.0.0.1:7891\n

When you don't want the proxy, you can bypass it easily:

cvtp -listen=all -from=127.0.0.1:7891 -bypass\n

Configuring System Level Proxy

Tools like proxychains, graftcp, iptables based transparent proxy e.g.g ss-tproxy won't work with Docker.

You can use tun2socks and add --net=host to docker run. The steps can be something like:

# check original route table\nip a\nip r\n# set physical gateway\nnic=eno145\ngateway=10.184.17.1\n# add the IP aboard that your proxy software is connecting to direct route:\nip route add X.X.X.X/32 via $gateway dev $nic metric 1\n# add tun nic\nip tuntap add mode tun dev tun0\nip addr add 198.18.0.1/15 dev tun0\nip link set dev tun0 up\n\n# start socks5 to tun converter\ntun2socks --device tun0 --proxy socks5://127.0.0.1:XXXX -interface $nic \n\n# dangerous especially if you are typing on a remote host\n# delete the original default route and route all traffic through tun0\nip r delete default\nip route add default via 198.18.0.1 dev tun0 metric 2\n\n## optional:\n# configure sysctl\nsysctl net.ipv4.conf.all.rp_filter=0\nsysctl net.ipv4.conf.$nic.rp_filter=0\n\n# check what is your public IP address now \ncurl https://myip.xjtu.app\n

Configuring DNS

If you can successfully curl -v https://1.1.1.1 but cannot curl -v https://one.one.one.one, chances are that your DNS is done.

See Docker's DNS documentation for the documented behavior of DNS within Docker containers and information on customizing DNS configuration. In most cases, the resolvers configured on the host are also configured in the container.

Most DNS resolvers hosted on 127.0.0.0/8 are not supported due to conflicts between the container and host network namespaces. Such resolvers are removed from the container's /etc/resolv.conf. If this would result in an empty /etc/resolv.conf, Google DNS is used instead.

Additionally, a special case is handled if 127.0.0.53 is the only configured nameserver. In this case, Docker assumes the resolver is systemd-resolved and uses the upstream DNS resolvers from /run/systemd/resolve/resolv.conf.

If you are using a service such as dnsmasq to provide a local resolver, consider adding a virtual interface with a link local IP address in the 169.254.0.0/16 block for dnsmasq to bind to instead of 127.0.0.1 to avoid the network namespace conflict.

Basically you can use cloudflared to listen on 0.0.0.0:

sudo setcap 'cap_net_bind_service=+ep' cloudflared\ncloudflared proxy-dns  --address 0.0.0.0 --upstream https://9.9.9.9/dns-query --upstream https://1.1.1.1/dns-query  --upstream https://1.0.0.1/dns-query --upstream https://149.112.112.9/dns-query --upstream https://149.112.112.112/dns-query --upstream https://8.8.8.8/dns-query  --upstream https://ordns.he.net/dns-query --upstream https://64.6.64.6/dns-query --upstream https://doh.cleanbrowsing.org/doh/security-filter/ \n

\n","createdAt":"2024-12-06 12:49:50.620499","updatedAt":"2024-12-06 12:49:50.620499","replyToPostNumber":null,"replyCount":0,"likeCount":2,"wordCount":667,"liked":false,"bookmarked":false,"polls":[],"reactions":[{"reaction":"face_holding_back_tears_hugging_face","count":1,"users":[{"id":6205,"username":"uika_winwing","name":null}],"hasReacted":false},{"reaction":"❤️","count":2,"users":[{"id":1411,"username":"lwe","name":null},{"id":6205,"username":"uika_winwing","name":null}],"hasReacted":false}],"wiki":false,"version":1,"publicVersion":1,"deletedAt":null,"isAnonymous":false,"user":{"id":4668,"username":"IO","name":null,"avatarUrl":"/uploads/image/86/f2/86f267c0aaa73835a999b7cc3a7e7a701605574eda9a2c2a56f5ddbbba64d1a9.avif","admin":true,"moderator":false,"signatureRaw":"","signatureCooked":null}},{"id":44281,"postNumber":2,"raw":"If you only wanna image:\n\nhttps://www.v2ex.com/t/1095188","cooked":"

If you only wanna image:

\n","createdAt":"2024-12-06 16:58:32.303831","updatedAt":"2024-12-06 16:58:32.303831","replyToPostNumber":null,"replyCount":1,"likeCount":0,"wordCount":6,"liked":false,"bookmarked":false,"polls":[],"reactions":[],"wiki":false,"version":1,"publicVersion":1,"deletedAt":null,"isAnonymous":false,"user":{"id":4668,"username":"IO","name":null,"avatarUrl":"/uploads/image/86/f2/86f267c0aaa73835a999b7cc3a7e7a701605574eda9a2c2a56f5ddbbba64d1a9.avif","admin":true,"moderator":false,"signatureRaw":"","signatureCooked":null}},{"id":44289,"postNumber":3,"raw":"What you refer to is only an alternative to:\n[quote=\"shared_user, post:1, topic:13978, username:anonymous_coward\"]\nDocker **daemon** proxy configuration\n[/quote]","cooked":"

What you refer to is only an alternative to:

\n\t\t\t\t\t\t\t

\n\t\t\t\t\t\t\t\t

\n\t\t\t\t\t\t\t\t\t

\n\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t

\n\t\t\t\t\t\t\t\t\tshared_user:\n\t\t\t\t\t\t\t\t

\n\t\t\t\t\t\t\t\t

\n\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t

\n\t\t\t\t\t\t\t

\n
Docker daemon proxy configuration
\n

\n\t\t\t\t\t\t

\n","createdAt":"2024-12-07 01:30:50.610592","updatedAt":"2024-12-07 01:30:50.610592","replyToPostNumber":2,"replyCount":0,"likeCount":1,"wordCount":18,"liked":false,"bookmarked":false,"polls":[],"reactions":[{"reaction":"❤️","count":1,"users":[{"id":4336,"username":"扑满","name":null}],"hasReacted":false}],"wiki":false,"version":1,"publicVersion":1,"deletedAt":null,"isAnonymous":false,"user":{"id":4668,"username":"IO","name":null,"avatarUrl":"/uploads/image/86/f2/86f267c0aaa73835a999b7cc3a7e7a701605574eda9a2c2a56f5ddbbba64d1a9.avif","admin":true,"moderator":false,"signatureRaw":"","signatureCooked":null}}],"hasMore":false,"lastReadPostNumber":1,"hasUrlPostNumber":false}