<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:x="urn:schemas-microsoft-com:office:excel" xmlns:p="urn:schemas-microsoft-com:office:powerpoint" xmlns:a="urn:schemas-microsoft-com:office:access" xmlns:dt="uuid:C2F41010-65B3-11d1-A29F-00AA00C14882" xmlns:s="uuid:BDC6E3F0-6DA3-11d1-A2A3-00AA00C14882" xmlns:rs="urn:schemas-microsoft-com:rowset" xmlns:z="#RowsetSchema" xmlns:b="urn:schemas-microsoft-com:office:publisher" xmlns:ss="urn:schemas-microsoft-com:office:spreadsheet" xmlns:c="urn:schemas-microsoft-com:office:component:spreadsheet" xmlns:odc="urn:schemas-microsoft-com:office:odc" xmlns:oa="urn:schemas-microsoft-com:office:activation" xmlns:html="http://www.w3.org/TR/REC-html40" xmlns:q="http://schemas.xmlsoap.org/soap/envelope/" xmlns:rtc="http://microsoft.com/officenet/conferencing" xmlns:D="DAV:" xmlns:Repl="http://schemas.microsoft.com/repl/" xmlns:mt="http://schemas.microsoft.com/sharepoint/soap/meetings/" xmlns:x2="http://schemas.microsoft.com/office/excel/2003/xml" xmlns:ppda="http://www.passport.com/NameSpace.xsd" xmlns:ois="http://schemas.microsoft.com/sharepoint/soap/ois/" xmlns:dir="http://schemas.microsoft.com/sharepoint/soap/directory/" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:dsp="http://schemas.microsoft.com/sharepoint/dsp" xmlns:udc="http://schemas.microsoft.com/data/udc" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:sub="http://schemas.microsoft.com/sharepoint/soap/2002/1/alerts/" xmlns:ec="http://www.w3.org/2001/04/xmlenc#" xmlns:sp="http://schemas.microsoft.com/sharepoint/" xmlns:sps="http://schemas.microsoft.com/sharepoint/soap/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:udcs="http://schemas.microsoft.com/data/udc/soap" xmlns:udcxf="http://schemas.microsoft.com/data/udc/xmlfile" xmlns:udcp2p="http://schemas.microsoft.com/data/udc/parttopart" xmlns:wf="http://schemas.microsoft.com/sharepoint/soap/workflow/" xmlns:dsss="http://schemas.microsoft.com/office/2006/digsig-setup" xmlns:dssi="http://schemas.microsoft.com/office/2006/digsig" xmlns:mdssi="http://schemas.openxmlformats.org/package/2006/digital-signature" xmlns:mver="http://schemas.openxmlformats.org/markup-compatibility/2006" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns:mrels="http://schemas.openxmlformats.org/package/2006/relationships" xmlns:spwp="http://microsoft.com/sharepoint/webpartpages" xmlns:ex12t="http://schemas.microsoft.com/exchange/services/2006/types" xmlns:ex12m="http://schemas.microsoft.com/exchange/services/2006/messages" xmlns:pptsl="http://schemas.microsoft.com/sharepoint/soap/SlideLibrary/" xmlns:spsl="http://microsoft.com/webservices/SharePointPortalServer/PublishedLinksService" xmlns:Z="urn:schemas-microsoft-com:" xmlns:tax="http://schemas.microsoft.com/sharepoint/taxonomy/soap/" xmlns:tns="http://schemas.microsoft.com/sharepoint/soap/recordsrepository/" xmlns:spsup="http://microsoft.com/webservices/SharePointPortalServer/UserProfileService" xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:st="" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0cm;
margin-right:0cm;
margin-bottom:0cm;
margin-left:36.0pt;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
span.EmailStyle18
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.EmailStyle19
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.EmailStyle20
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.EmailStyle21
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.EmailStyle22
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><span style="color:#1F497D">Thanks for the explanation Mingyuan. Based on what you describe below, StarlingX does not support an https connection to the proxy server. StarlingX does not provide a mechanism for a user to install public keys
- without that in place, an https connection to the proxy server is not possible. Please note that it is not an acceptable solution to have the user manually edit files on the StarlingX side to install the public key for the proxy. These edits would have to
be done on multiple hosts and the edits would disappear if a host was re-installed.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">We’ll have to ensure our documentation for the proxy feature clearly explains this limitation.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Bart<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> Qi, Mingyuan [mailto:mingyuan.qi@intel.com]
<br>
<b>Sent:</b> May 30, 2019 10:33 PM<br>
<b>To:</b> Ngo, Tee; Wensley, Barton; starlingx-discuss@lists.starlingx.io<br>
<b>Cc:</b> Miller, Frank<br>
<b>Subject:</b> RE: [Container] docker daemon proxy issue clarification<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><a name="_MailEndCompose"><span style="color:#1F497D">Bart,</span></a><span style="color:#1F497D"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">In most of the time, we use “http proxy server” as proxy to access both http and https requests. The header “http” of
</span><a href="http://%3cproxy">http://<proxy</a><span style="color:#1F497D"> IP>:<proxy port> indicates that this proxy server is a “http proxy server”, the connection through client and proxy server uses http request no matter what the target request type
is. Usually proxy is used internally within a trusted organization and we trust the proxy server not being attacked by Man-in-the-Middle Attack</span><span style="font-size:10.0pt;font-family:"Arial","sans-serif";color:#333333;background:white">.</span><span style="color:#1F497D"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">However, there is also a more secure way to connect to a “https proxy server” that the header of proxy url is “https”, each request is https between client and proxy server regardless the target request type.
Consequently TLS/SSL handshake is needed and client needs the public key of proxy server as well for TLS/SSL authentication. That’s why you face “TLS handshake timeouts” issue. I’m not sure whether Tinyproxy supports configuration as a https server. If it
does, </span><a href="https://%3cproxy">https://<proxy</a><span style="color:#1F497D"> ip>:<proxy port> should work with a public key set at client side.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<div>
<p class="MsoNormal"><span style="color:#1F497D">Mingyuan<o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><a name="_____replyseparator"></a><b>From:</b> Ngo, Tee [mailto:Tee.Ngo@windriver.com]
<br>
<b>Sent:</b> Friday, May 31, 2019 0:32<br>
<b>To:</b> Wensley, Barton <Barton.Wensley@windriver.com>; Qi, Mingyuan <mingyuan.qi@intel.com>; starlingx-discuss@lists.starlingx.io<br>
<b>Cc:</b> Miller, Frank <Frank.Miller@windriver.com><br>
<b>Subject:</b> RE: [Container] docker daemon proxy issue clarification<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="color:#1F497D">Bart, Mingyuan,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">We got derailed a bit but gained more knowledge in the process. I have reverted back to my original one line fix. With this change, the NO_PROXY IPs are automatically derived from the provided subnets. The user
can also extend the default list by adding <b>docker_no_proxy</b> with additional IPs to the host override file.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Tee<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> Wensley, Barton
<br>
<b>Sent:</b> May-30-19 11:12 AM<br>
<b>To:</b> Qi, Mingyuan; </span><a href="mailto:starlingx-discuss@lists.starlingx.io"><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">starlingx-discuss@lists.starlingx.io</span></a><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">;
Ngo, Tee<br>
<b>Cc:</b> Miller, Frank<br>
<b>Subject:</b> RE: [Container] docker daemon proxy issue clarification<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="color:#1F497D">Thanks Mingyuan for looking into this.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">I have done my own testing and can confirm your findings:<o:p></o:p></span></p>
<p class="MsoListParagraph" style="text-indent:-18.0pt"><span style="font-family:Symbol;color:#1F497D">·</span><span style="font-size:7.0pt;font-family:"Times New Roman","serif";color:#1F497D">
</span><span style="color:#1F497D">Configuring an http and https proxy at the same time is supported.<o:p></o:p></span></p>
<p class="MsoListParagraph" style="text-indent:-18.0pt"><span style="font-family:Symbol;color:#1F497D">·</span><span style="font-size:7.0pt;font-family:"Times New Roman","serif";color:#1F497D">
</span><span style="color:#1F497D">Configuring both proxies in the same config file is also OK.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Based on that, the only fix required in [0] is to configure the default NO_PROXY settings when they are not specified.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">We are testing with Tinyproxy (</span><a href="https://tinyproxy.github.io">https://tinyproxy.github.io</a><span style="color:#1F497D">) here in Ottawa, which acts as both an http and https proxy. Our config
is different than what you specified below.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">For http proxy only:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">docker_http_proxy: </span><a href="http://%3cproxy">http://<proxy</a><span style="color:#1F497D"> IP>:<proxy port><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">For https proxy only:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">docker_https_proxy: </span><a href="http://%3cproxy">http://<proxy</a><span style="color:#1F497D"> IP>:<proxy port><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">For http and https proxy:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">docker_http_proxy: </span><a href="http://%3cproxy">http://<proxy</a><span style="color:#1F497D"> IP>:<proxy port><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">docker_https_proxy: </span><a href="http://%3cproxy">http://<proxy</a><span style="color:#1F497D"> IP>:<proxy port><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">The difference from your email below is that we never specify https to access our proxy - doing that causes TLS handshake timeouts. I suspect that is just a difference in the proxies we are using? In any case,
I see that in many of the on-line articles (e.g. [3]), http is always used to access the proxy itself.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Bart<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> Qi, Mingyuan [</span><a href="mailto:mingyuan.qi@intel.com"><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">mailto:mingyuan.qi@intel.com</span></a><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">]
<br>
<b>Sent:</b> May 30, 2019 12:59 AM<br>
<b>To:</b> </span><a href="mailto:starlingx-discuss@lists.starlingx.io"><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">starlingx-discuss@lists.starlingx.io</span></a><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">; Ngo, Tee;
Wensley, Barton<br>
<b>Cc:</b> Miller, Frank<br>
<b>Subject:</b> [Container] docker daemon proxy issue clarification<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Hi Bart and Tee,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">To clarify the docker daemon proxy issue discussed in review comments[0], I move the discussion here for a clear view.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">The question is, docker daemon proxy setting in starlingx is not the same as current docker doc[1]. The difference is we in starlingx only create http-proxy.conf for HTTP_PROXY, HTTPS_PROXY, NO_PROXY setting, while the document suggests
http-proxy.conf for HTTP_PROXY and https-proxy for HTTPS_PROXY. Does it impact the docker daemon proxy setting?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">That might be a little confused of the terminology of above file name and environment variable name. HTTP_PROXY means all the target url requests go via this proxy server if the request type is http, and the same meaning as HTTPS_PROXY,
not the proxy server type itself is http or https. <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Through my test of docker daemon proxy and golang net lib (used by docker daemon proxy connection) code[2] , the http-proxy.conf and https-proxy.conf have the same target just to set HTTP_PROXY/HTTPS_PROXY/NO_PROXY environment variables
to golang net lib. The file name of the conf does not impact the proxy setting. I even renamed http-proxy.conf to test.conf and got a successful pulling from http registry and both https registry through proxy. So I don’t think following current docker proxy
setting doc is a must.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Moreover, as I said in the review comments[0], starlingx docker daemon proxy setting was the official approach(only one http-proxy.conf file) at some time in 2018, but it’s disappeared. Some technical articles[3][4][5] indicates that this
setting approach is valid. Therefore, I think current starlingx approach for docker daemon proxy setting is valid and no changes needed.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">The remaining question from Tee to test https proxy is not the same as above. To use a https proxy server, the setting should be:<o:p></o:p></p>
<p class="MsoNormal">HTTP_PROXY=https://proxy.url:port<o:p></o:p></p>
<p class="MsoNormal">HTTPS_PROXY=https://proxy.url:port<o:p></o:p></p>
<p class="MsoNormal">No matter these environment variables are set in http-proxy.conf or https-proxy.conf or test.conf.<o:p></o:p></p>
<p class="MsoNormal">If test team has a https proxy server, this can be tested by current config mechanism.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">[0] <a href="https://review.opendev.org/#/c/661825/">https://review.opendev.org/#/c/661825/</a><o:p></o:p></p>
<p class="MsoNormal">[1] <a href="https://docs.docker.com/config/daemon/systemd/#httphttps-proxy">
https://docs.docker.com/config/daemon/systemd/#httphttps-proxy</a><o:p></o:p></p>
<p class="MsoNormal">[2] <a href="https://github.com/golang/net/blob/master/http/httpproxy/proxy.go#L28">
https://github.com/golang/net/blob/master/http/httpproxy/proxy.go#L28</a><o:p></o:p></p>
<p class="MsoNormal">[3] <a href="https://www.ibm.com/support/knowledgecenter/en/SSBS6K_3.1.2/installing/install_proxy.html">
https://www.ibm.com/support/knowledgecenter/en/SSBS6K_3.1.2/installing/install_proxy.html</a><o:p></o:p></p>
<p class="MsoNormal">[4] <a href="https://elegantinfrastructure.com/docker/ultimate-guide-to-docker-http-proxy-configuration/">
https://elegantinfrastructure.com/docker/ultimate-guide-to-docker-http-proxy-configuration/</a><o:p></o:p></p>
<p class="MsoNormal">[5] <a href="https://www.thegeekdiary.com/how-to-configure-docker-to-use-proxy/">
https://www.thegeekdiary.com/how-to-configure-docker-to-use-proxy/</a><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Best Regards,<o:p></o:p></p>
<p class="MsoNormal">Mingyuan<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
</body>
</html>