Add the ability to use HTTP/HTTPS proxies on Portainer

[DEKHTIARJonathan]

Hello dear friends,

I use portainer behind a corporate proxy which is mandatory to access any outside resource.

Thus, portainer is unable to access necessary json file to use App Templates. I can of course host this file locally to fix the problem, but I tend to believe it might not be super hard to add proxy support in one or two requests.

I don't know if proxy could be useful for "endpoint" usage, it's not my usecase. I only use internal servers.

I drop you here a little screenshot of my container logs produced by the missing proxy configuration :

Thanks a lot for the help dear friends!

[ncresswell]

Makes sense to me to add this. Rgds, Neil Cresswell On 5/01/2017, at 9:32 PM, Jonathan DEKHTIAR <notifications@github.com<mailto:notifications@github.com>> wrote: Hello dear friends, I use portainer behind a corporate proxy which is mandatory to access any outside resource. Thus, portainer is unable to access necessary json file to use App Templates. I can of course host this file locally to fix the problem, but I tend to believe it might not be super hard to add proxy support in one or two requests. I don't know if proxy could be useful for "endpoint" usage, it's not my usecase. I only use internal servers. I drop you here a little screenshot of my container logs produced by the missing proxy configuration : [image]<https://urldefense.proofpoint.com/v2/url?u=https-3A__cloud.githubusercontent.com_assets_10923599_21673550_c7bf1902-2Dd329-2D11e6-2D9dec-2D8328fba157c3.png&d=DQMCaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=0fx0h4vB56iTLpw2McH1ZD6TqG_QGpbggVOB-PfMJpM&m=orw_0jsWUyo2NwweSLUs0z4zvvyIYiKXCyQyzsRCNq4&s=8k-Yfv62UdNIvqfHQRTQfyI7Df-5Y-TrseJi_1CKx0Y&e=> Thanks a lot for the help dear friends! - You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub<https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_portainer_portainer_issues_469&d=DQMCaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=0fx0h4vB56iTLpw2McH1ZD6TqG_QGpbggVOB-PfMJpM&m=orw_0jsWUyo2NwweSLUs0z4zvvyIYiKXCyQyzsRCNq4&s=F_Qu7bvpsJcW9ADbvtv63Xq6uTpmw9vVFuuWQVL4Py4&e=>, or mute the thread<https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_notifications_unsubscribe-2Dauth_AWGrldq616nm9J63HgkGsBGq67Nx02Jiks5rPKqRgaJpZM4LbdDZ&d=DQMCaQ&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=0fx0h4vB56iTLpw2McH1ZD6TqG_QGpbggVOB-PfMJpM&m=orw_0jsWUyo2NwweSLUs0z4zvvyIYiKXCyQyzsRCNq4&s=0U1A8LAS9uycTxb8LmfZBvQ2dWmxNTaE0QzrqGwANqE&e=>.

[Niceplace]

Same issue here, would love to see this implemented !

[WTFKr0]

Have you tried to add HTTP_PROXY and HTTPS_PROXY env var to portainer container ?
We used that to access external network like github and it works

[misery]

Tried it ... sometimes it works and I see the "app template homepage" ... sometimes I will get this error. Strange... without restarting the container!

Passed ENV as HTTPS_PROXY=10.1.0.1:8080

http error: Get https://raw.githubusercontent.com/portainer/templates/master/templates.json: http: error connecting to proxy http://10.1.0.1:8080: dial tcp 10.1.0.1:8080: i/o timeout (code=500)

[WTFKr0]

I can't really help more, I think you should have same problem from your browser with same proxy

[Niceplace]

I just tried it now with HTTP_PROXY variable and it works !! Thanks @WTFKr0 for the simple solution I should have thought of that before !

Full docker command :

Replace $PROXY_HOST with the actual hostname of the proxy and $PROXY_PORT with the actual port of the proxy (if present).

docker run \
-p 9000:9000 \
-v /app/docker-volumes/portainer:/data \
-v /var/run/docker.sock:/var/run/docker.sock \
-e HTTP_PROXY=$PROXY_HOST:$PROXY_PORT

[deviantony]

@WTFKr0 Nice one ;)

@misery this problem might be related to your network.

@DEKHTIARJonathan want to give this solution a try?

I'm going to add this in the docs.

[deviantony]

Added via portainer/portainer-docs@078c04a

[DEKHTIARJonathan]

@deviantony it works perfectly thanks !

[guilhermecgs]

Hi Folks,

It is important that this configuration is done using the Web UI. In many cases, the proxy login/password expire after X months, and then it stops working. In the corporate world, this is the default.

[deviantony]

I'll re-open to consider an evolution to be able to configure any HTTP proxy inside Portainer.

[jrbenito]

I would add that, if you corporate proxy has https it is doing it with a internal signed certificate, hence you have to pass the CA to Portainer container so it will not comply about unknown certificate signer. I did it just by passing my /etc/ssl as volume Portainer container (not agent).

[MITREDan]

@jrbenito makes a good point; in fact it's also necessary in some corporate environments -- specifically those which perform SSL inspection -- to disable strict SSL (i.e. man-in-the-middle attack detection).

[cozappz]

The corporate environment with authentication for proxy, here.
I'd really love to have a UI feature to configure the docker registry proxy with credentials.

[deviantony]

This is something we would like to bring into Portainer in the future, it has been added to our internal backlog but we don't have any ETA on this item at this stage.

[pf-uvonceumer]

So this issue was opened in 2017 and is still at large?

I am evaluating portainer for our company and we use a corporate proxy with SSL inspection. I am having the hardest time finding the correct parameters to configure portainer and/or the agents to be able to pull images from our GitHUb organization.

Here is the connection timeout when I try to browse my docker registry:

2023/06/26 09:29AM INF main.go:568 > encryption key file not present | filename=portainer
2023/06/26 09:29AM INF main.go:602 > proceeding without encryption key |
2023/06/26 09:29AM INF github.com/portainer/portainer-ee/api/database/boltdb/db.go:124 > loading PortainerDB | filename=portainer.db
2023/06/26 09:29AM INF github.com/portainer/portainer-ee/api/cloud/cluster_setup.go:93 > starting cloud cluster setup service |
2023/06/26 09:29:40 server: Reverse tunnelling enabled
2023/06/26 09:29:40 server: Fingerprint 50:fb:6b:b2:15:08:21:fc:b2:8d:19:bb:6e:1a:7f:3b
2023/06/26 09:29:40 server: Listening on 0.0.0.0:8000...
2023/06/26 09:29AM INF main.go:902 > starting Portainer | build_number=30955 go_version=1.19.4 image_tag=linux-amd64-2.18.3 nodejs_version=18.16.0 version=2.18.3 webpack_version=5.65.0 yarn_version=1.22.19
2023/06/26 09:29AM INF github.com/portainer/portainer-ee/api/http/server.go:417 > starting HTTPS server | bind_address=:9443
2023/06/26 09:29AM INF github.com/portainer/portainer-ee/api/http/server.go:402 > starting HTTP server | bind_address=:9000
{"time":1687771962,"message":"http: TLS handshake error from 192.168.244.74:18693: remote error: tls: unknown certificate"}
{"time":1687771962,"message":"http: TLS handshake error from 192.168.244.74:18694: remote error: tls: unknown certificate"}
{"time":1687771962,"message":"http: TLS handshake error from 192.168.244.74:18696: remote error: tls: unknown certificate"}
{"time":1687771962,"message":"http: TLS handshake error from 192.168.244.74:18695: remote error: tls: unknown certificate"}
{"time":1687771998,"message":"http: TLS handshake error from 192.168.244.74:18737: remote error: tls: unknown certificate"}
{"time":1687771998,"message":"http: TLS handshake error from 192.168.244.74:18739: remote error: tls: unknown certificate"}
{"time":1687771998,"message":"http: TLS handshake error from 192.168.244.74:18738: remote error: tls: unknown certificate"}
{"time":1687772157,"message":"http: proxy error: dial tcp 140.82.121.34:443: connect: connection timed out"}
{"time":1687772380,"message":"http: TLS handshake error from 192.168.244.74:19087: remote error: tls: unknown certificate"}
{"time":1687772380,"message":"http: TLS handshake error from 192.168.244.74:19089: remote error: tls: unknown certificate"}
{"time":1687772380,"message":"http: TLS handshake error from 192.168.244.74:19088: remote error: tls: unknown certificate"}
{"time":1687772435,"message":"http: TLS handshake error from 192.168.244.74:19138: remote error: tls: unknown certificate"}
{"time":1687787354,"message":"http: TLS handshake error from 192.168.244.74:1682: remote error: tls: unknown certificate"}
{"time":1687787354,"message":"http: TLS handshake error from 192.168.244.74:1683: remote error: tls: unknown certificate"}
{"time":1687787354,"message":"http: TLS handshake error from 192.168.244.74:1684: remote error: tls: unknown certificate"}
{"time":1687787354,"message":"http: TLS handshake error from 192.168.244.74:1685: remote error: tls: unknown certificate"}

portainer is able to pull images from a public regsitry, e.g. nginx, just fine. But I am unable to deploy a stack using our own GitHub registry.

[iredecent]

Are there any news on this?

Today I had exactly this scenario:

@jrbenito makes a good point; in fact it's also necessary in some corporate environments -- specifically those which perform SSL inspection -- to disable strict SSL (i.e. man-in-the-middle attack detection).

I tried to update a stack and re-pull the images, after that the services stopped beacause the repository wasn't availabile.