<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:SimSun;
panose-1:2 1 6 0 3 1 1 1 1 1;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:"\@SimSun";
panose-1:2 1 6 0 3 1 1 1 1 1;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle18
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.EmailStyle19
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:#1F497D;}
span.EmailStyle20
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:#1F497D;}
span.EmailStyle21
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:1953201846;
mso-list-type:hybrid;
mso-list-template-ids:-1157978326 67698689 67698691 67698693 67698689 67698691 67698693 67698689 67698691 67698693;}
@list l0:level1
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Symbol;}
@list l0:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:"Courier New";}
@list l0:level3
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Wingdings;}
@list l0:level4
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Symbol;}
@list l0:level5
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:"Courier New";}
@list l0:level6
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Wingdings;}
@list l0:level7
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Symbol;}
@list l0:level8
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:"Courier New";}
@list l0:level9
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Wingdings;}
ol
{margin-bottom:0in;}
ul
{margin-bottom:0in;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><a name="_MailEndCompose"><span style="color:#1F497D">Bart,<o:p></o:p></span></a></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">In most of the time, we use “http proxy server” as proxy to access both http and https requests. The header “http” of
</span><a href="http://%3cproxy">http://<proxy</a><span style="color:#1F497D"> IP>:<proxy port> indicates that this proxy server is a “http proxy server”, the connection through client and proxy server uses http request no matter what the target request type
is. Usually proxy is used internally within a trusted organization and we trust the proxy server not being attacked by Man-in-the-Middle Attack</span><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#333333;background:white">.</span><span style="color:#1F497D"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">However, there is also a more secure way to connect to a “https proxy server” that the header of proxy url is “https”, each request is https between client and proxy server regardless the target request type.
Consequently TLS/SSL handshake is needed and client needs the public key of proxy server as well for TLS/SSL authentication. That’s why you face “</span><span style="color:#1F497D">TLS handshake timeouts” issue. I’m not sure whether Tinyproxy supports configuration
as a https server. If it does, </span><a href="https://%3cproxy">https://<proxy</a><span style="color:#1F497D"> ip>:<proxy port> should work with a public key set at client side.</span><span style="color:#1F497D"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<div>
<p class="MsoNormal"><span style="color:#1F497D">Mingyuan<o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><a name="_____replyseparator"></a><b>From:</b> Ngo, Tee [mailto:Tee.Ngo@windriver.com]
<br>
<b>Sent:</b> Friday, May 31, 2019 0:32<br>
<b>To:</b> Wensley, Barton <Barton.Wensley@windriver.com>; Qi, Mingyuan <mingyuan.qi@intel.com>; starlingx-discuss@lists.starlingx.io<br>
<b>Cc:</b> Miller, Frank <Frank.Miller@windriver.com><br>
<b>Subject:</b> RE: [Container] docker daemon proxy issue clarification<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="color:#1F497D">Bart, Mingyuan,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">We got derailed a bit but gained more knowledge in the process. I have reverted back to my original one line fix. With this change, the NO_PROXY IPs are automatically derived from the provided subnets. The user
can also extend the default list by adding <b>docker_no_proxy</b> with additional IPs to the host override file.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Tee<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma",sans-serif">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma",sans-serif"> Wensley, Barton
<br>
<b>Sent:</b> May-30-19 11:12 AM<br>
<b>To:</b> Qi, Mingyuan; </span><a href="mailto:starlingx-discuss@lists.starlingx.io"><span style="font-size:10.0pt;font-family:"Tahoma",sans-serif">starlingx-discuss@lists.starlingx.io</span></a><span style="font-size:10.0pt;font-family:"Tahoma",sans-serif">;
Ngo, Tee<br>
<b>Cc:</b> Miller, Frank<br>
<b>Subject:</b> RE: [Container] docker daemon proxy issue clarification<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="color:#1F497D">Thanks Mingyuan for looking into this.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">I have done my own testing and can confirm your findings:<o:p></o:p></span></p>
<p class="MsoListParagraph" style="text-indent:-.25in;mso-list:l0 level1 lfo2"><![if !supportLists]><span style="font-family:Symbol;color:#1F497D"><span style="mso-list:Ignore">·<span style="font:7.0pt "Times New Roman"">
</span></span></span><![endif]><span style="color:#1F497D">Configuring an http and https proxy at the same time is supported.<o:p></o:p></span></p>
<p class="MsoListParagraph" style="text-indent:-.25in;mso-list:l0 level1 lfo2"><![if !supportLists]><span style="font-family:Symbol;color:#1F497D"><span style="mso-list:Ignore">·<span style="font:7.0pt "Times New Roman"">
</span></span></span><![endif]><span style="color:#1F497D">Configuring both proxies in the same config file is also OK.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Based on that, the only fix required in [0] is to configure the default NO_PROXY settings when they are not specified.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">We are testing with Tinyproxy (</span><a href="https://tinyproxy.github.io">https://tinyproxy.github.io</a><span style="color:#1F497D">) here in Ottawa, which acts as both an http and https proxy. Our config
is different than what you specified below.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">For http proxy only:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">docker_http_proxy: </span><a href="http://%3cproxy">http://<proxy</a><span style="color:#1F497D"> IP>:<proxy port><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">For https proxy only:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">docker_https_proxy: </span><a href="http://%3cproxy">http://<proxy</a><span style="color:#1F497D"> IP>:<proxy port><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">For http and https proxy:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">docker_http_proxy: </span><a href="http://%3cproxy">http://<proxy</a><span style="color:#1F497D"> IP>:<proxy port><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">docker_https_proxy: </span><a href="http://%3cproxy">http://<proxy</a><span style="color:#1F497D"> IP>:<proxy port><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">The difference from your email below is that we never specify https to access our proxy - doing that causes TLS handshake timeouts. I suspect that is just a difference in the proxies we are using? In any case,
I see that in many of the on-line articles (e.g. [3]), http is always used to access the proxy itself.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Bart<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma",sans-serif">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma",sans-serif"> Qi, Mingyuan [</span><a href="mailto:mingyuan.qi@intel.com"><span style="font-size:10.0pt;font-family:"Tahoma",sans-serif">mailto:mingyuan.qi@intel.com</span></a><span style="font-size:10.0pt;font-family:"Tahoma",sans-serif">]
<br>
<b>Sent:</b> May 30, 2019 12:59 AM<br>
<b>To:</b> </span><a href="mailto:starlingx-discuss@lists.starlingx.io"><span style="font-size:10.0pt;font-family:"Tahoma",sans-serif">starlingx-discuss@lists.starlingx.io</span></a><span style="font-size:10.0pt;font-family:"Tahoma",sans-serif">; Ngo, Tee;
Wensley, Barton<br>
<b>Cc:</b> Miller, Frank<br>
<b>Subject:</b> [Container] docker daemon proxy issue clarification<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Hi Bart and Tee,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">To clarify the docker daemon proxy issue discussed in review comments[0], I move the discussion here for a clear view.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">The question is, docker daemon proxy setting in starlingx is not the same as current docker doc[1]. The difference is we in starlingx only create http-proxy.conf for HTTP_PROXY, HTTPS_PROXY, NO_PROXY setting, while the document suggests
http-proxy.conf for HTTP_PROXY and https-proxy for HTTPS_PROXY. Does it impact the docker daemon proxy setting?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">That might be a little confused of the terminology of above file name and environment variable name. HTTP_PROXY means all the target url requests go via this proxy server if the request type is http, and the same meaning as HTTPS_PROXY,
not the proxy server type itself is http or https. <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Through my test of docker daemon proxy and golang net lib (used by docker daemon proxy connection) code[2] , the http-proxy.conf and https-proxy.conf have the same target just to set HTTP_PROXY/HTTPS_PROXY/NO_PROXY environment variables
to golang net lib. The file name of the conf does not impact the proxy setting. I even renamed http-proxy.conf to test.conf and got a successful pulling from http registry and both https registry through proxy. So I don’t think following current docker proxy
setting doc is a must.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Moreover, as I said in the review comments[0], starlingx docker daemon proxy setting was the official approach(only one http-proxy.conf file) at some time in 2018, but it’s disappeared. Some technical articles[3][4][5] indicates that this
setting approach is valid. Therefore, I think current starlingx approach for docker daemon proxy setting is valid and no changes needed.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">The remaining question from Tee to test https proxy is not the same as above. To use a https proxy server, the setting should be:<o:p></o:p></p>
<p class="MsoNormal">HTTP_PROXY=https://proxy.url:port<o:p></o:p></p>
<p class="MsoNormal">HTTPS_PROXY=https://proxy.url:port<o:p></o:p></p>
<p class="MsoNormal">No matter these environment variables are set in http-proxy.conf or https-proxy.conf or test.conf.<o:p></o:p></p>
<p class="MsoNormal">If test team has a https proxy server, this can be tested by current config mechanism.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">[0] <a href="https://review.opendev.org/#/c/661825/">https://review.opendev.org/#/c/661825/</a><o:p></o:p></p>
<p class="MsoNormal">[1] <a href="https://docs.docker.com/config/daemon/systemd/#httphttps-proxy">
https://docs.docker.com/config/daemon/systemd/#httphttps-proxy</a><o:p></o:p></p>
<p class="MsoNormal">[2] <a href="https://github.com/golang/net/blob/master/http/httpproxy/proxy.go#L28">
https://github.com/golang/net/blob/master/http/httpproxy/proxy.go#L28</a><o:p></o:p></p>
<p class="MsoNormal">[3] <a href="https://www.ibm.com/support/knowledgecenter/en/SSBS6K_3.1.2/installing/install_proxy.html">
https://www.ibm.com/support/knowledgecenter/en/SSBS6K_3.1.2/installing/install_proxy.html</a><o:p></o:p></p>
<p class="MsoNormal">[4] <a href="https://elegantinfrastructure.com/docker/ultimate-guide-to-docker-http-proxy-configuration/">
https://elegantinfrastructure.com/docker/ultimate-guide-to-docker-http-proxy-configuration/</a><o:p></o:p></p>
<p class="MsoNormal">[5] <a href="https://www.thegeekdiary.com/how-to-configure-docker-to-use-proxy/">
https://www.thegeekdiary.com/how-to-configure-docker-to-use-proxy/</a><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Best Regards,<o:p></o:p></p>
<p class="MsoNormal">Mingyuan<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
</body>
</html>