[Starlingx-discuss] [Container] docker daemon proxy issue clarification

[Wensley, Barton]

Thanks Mingyuan for looking into this.

I have done my own testing and can confirm your findings:

*         Configuring an http and https proxy at the same time is supported.

*         Configuring both proxies in the same config file is also OK.

Based on that, the only fix required in [0] is to configure the default NO_PROXY settings when they are not specified.

We are testing with Tinyproxy (https://tinyproxy.github.io) here in Ottawa, which acts as both an http and https proxy. Our config is different than what you specified below.

For http proxy only:
docker_http_proxy: http://<proxy IP>:<proxy port>

For https proxy only:
docker_https_proxy: http://<proxy IP>:<proxy port>

For http and https proxy:
docker_http_proxy: http://<proxy IP>:<proxy port>
docker_https_proxy: http://<proxy IP>:<proxy port>

The difference from your email below is that we never specify https to access our proxy - doing that causes TLS handshake timeouts. I suspect that is just a difference in the proxies we are using? In any case, I see that in many of the on-line articles (e.g. [3]), http is always used to access the proxy itself.

Bart

From: Qi, Mingyuan [mailto:mingyuan.qi at intel.com]
Sent: May 30, 2019 12:59 AM
To: starlingx-discuss at lists.starlingx.io; Ngo, Tee; Wensley, Barton
Cc: Miller, Frank
Subject: [Container] docker daemon proxy issue clarification

Hi Bart and Tee,

To clarify the docker daemon proxy issue discussed in review comments[0], I move the discussion here for a clear view.

The question is, docker daemon proxy setting in starlingx is not the same as current docker doc[1]. The difference is we in starlingx only create http-proxy.conf for HTTP_PROXY, HTTPS_PROXY, NO_PROXY setting, while the document suggests http-proxy.conf for HTTP_PROXY and https-proxy for HTTPS_PROXY. Does it impact the docker daemon proxy setting?

That might be a little confused of the terminology of above file name and environment variable name. HTTP_PROXY means all the target url requests go via this proxy server if the request type is http, and the same meaning as HTTPS_PROXY, not the proxy server type itself is http or https.

Through my test of docker daemon proxy and golang net lib (used by docker daemon proxy connection) code[2] , the http-proxy.conf and https-proxy.conf have the same target just to set HTTP_PROXY/HTTPS_PROXY/NO_PROXY environment variables to golang net lib. The file name of the conf does not impact the proxy setting. I even renamed http-proxy.conf to test.conf and got a successful pulling from http registry and both https registry through proxy. So I don't think following current docker proxy setting doc is a must.

Moreover, as I said in the review comments[0], starlingx docker daemon proxy setting was the official approach(only one http-proxy.conf file) at some time in 2018, but it's disappeared. Some technical articles[3][4][5] indicates that this setting approach is valid. Therefore, I think current starlingx approach for docker daemon proxy setting is valid and no changes needed.

The remaining question from Tee to test https proxy is not the same as above. To use a https proxy server, the setting should be:
HTTP_PROXY=https://proxy.url:port
HTTPS_PROXY=https://proxy.url:port
No matter these environment variables are set in http-proxy.conf or https-proxy.conf or test.conf.
If test team has a https proxy server, this can be tested by current config mechanism.

[0] https://review.opendev.org/#/c/661825/
[1] https://docs.docker.com/config/daemon/systemd/#httphttps-proxy
[2] https://github.com/golang/net/blob/master/http/httpproxy/proxy.go#L28
[3] https://www.ibm.com/support/knowledgecenter/en/SSBS6K_3.1.2/installing/install_proxy.html
[4] https://elegantinfrastructure.com/docker/ultimate-guide-to-docker-http-proxy-configuration/
[5] https://www.thegeekdiary.com/how-to-configure-docker-to-use-proxy/

Best Regards,
Mingyuan

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.starlingx.io/pipermail/starlingx-discuss/attachments/20190530/d26e6bf9/attachment.html>