Skip to content

Conversation

aevesdocker
Copy link
Contributor

Air-gapped containers (beta) feature. For DD4.29

Related issues or tickets

Reviews

  • Technical review
  • Editorial review
  • Product review

@github-actions github-actions bot added the area/desktop Issue affects a desktop edition of Docker. E.g docker for mac label Mar 27, 2024
Copy link

netlify bot commented Mar 27, 2024

Deploy Preview for docsdocker ready!

Name Link
🔨 Latest commit 5e779cf
🔍 Latest deploy log https://app.netlify.com/sites/docsdocker/deploys/660d144114fc37000816165e
😎 Deploy Preview https://deploy-preview-19698--docsdocker.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify site configuration.

@aevesdocker aevesdocker requested a review from djs55 March 27, 2024 11:22
@aevesdocker aevesdocker requested a review from a team March 27, 2024 14:24
- `mode`: Same meaning as with the existing `proxy` setting. Possible values are `system` and `manual`.
- `http`, `https`, `exclude`: Same meaning as with the `proxy` setting. Only takes effect if `mode` is set to `manual`.
- `pac` : URL for a PAC file. Only takes effect if `mode` is `manual`, and is considered higher priority than `http`, `https`, `exclude`.
- `transparentPorts`: A comma-separated list of ports (e.g. `80`,`443`,`8080`) or a wildcard (`*`) indicating which ports should be proxied.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I guess this should be a single string?

Suggested change
- `transparentPorts`: A comma-separated list of ports (e.g. `80`,`443`,`8080`) or a wildcard (`*`) indicating which ports should be proxied.
- `transparentPorts`: A comma-separated list of ports (for example, `"80,443,8080"`) or a wildcard (`*`) indicating which ports should be proxied.


## Example PAC file

For general information about PAC files, see the [Mozilla documentation](https://developer.mozilla.org/en-US/docs/Web/HTTP/Proxy_servers_and_tunneling/Proxy_Auto-Configuration_PAC_file).
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
For general information about PAC files, see the [Mozilla documentation](https://developer.mozilla.org/en-US/docs/Web/HTTP/Proxy_servers_and_tunneling/Proxy_Auto-Configuration_PAC_file).
For general information about PAC files, see [MDN Web Docs](https://developer.mozilla.org/en-US/docs/Web/HTTP/Proxy_servers_and_tunneling/Proxy_Auto-Configuration_PAC_file).

}
```

The url parameter is either `http://host_or_ip:port` or `https://host_or_ip:port`.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
The url parameter is either `http://host_or_ip:port` or `https://host_or_ip:port`.
The `url` parameter is either `http://host_or_ip:port` or `https://host_or_ip:port`.

- `DIRECT`: Allows this request to go direct, without a proxy
- `PROXY reject.docker.internal:any_port`: Rejects this request

In this particular example HTTP and HTTPS requests for `internal.corp` are sent via the HTTP proxy `10.0.0.1:3128`. Requests to connect to IPs on the subnet `192.168.0.0/24` connect directly. All other requests are blocked.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
In this particular example HTTP and HTTPS requests for `internal.corp` are sent via the HTTP proxy `10.0.0.1:3128`. Requests to connect to IPs on the subnet `192.168.0.0/24` connect directly. All other requests are blocked.
In this particular example, HTTP and HTTPS requests for `internal.corp` are sent via the HTTP proxy `10.0.0.1:3128`. Requests to connect to IPs on the subnet `192.168.0.0/24` connect directly. All other requests are blocked.


In this particular example HTTP and HTTPS requests for `internal.corp` are sent via the HTTP proxy `10.0.0.1:3128`. Requests to connect to IPs on the subnet `192.168.0.0/24` connect directly. All other requests are blocked.

To restrict traffic connecting to ports on the developers local machine, match the special hostname `host.docker.internal`.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think a link here to where we describe host.docker.internal would be helpful


## Configuration

Assuming enforced sign-in and Settings Management are enabled, add the new proxy configuration to the `admin-settings.json` file. For example:
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe we could link to the docs for enforced sign-in and settings management here?


- `locked`: If true, it is not possible for developers to override these settings. If false the settings are interpreted as default values which the developer can change.
- `mode`: Same meaning as with the existing `proxy` setting. Possible values are `system` and `manual`.
- `http`, `https`, `exclude`: Same meaning as with the `proxy` setting. Only takes effect if `mode` is set to `manual`.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These fields are not shown in the example above. I think it would be clearer if they were.

Copy link
Contributor

@djs55 djs55 Apr 2, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If added to the example above they would be

    "http": "",
    "https": "",
    "exclude": "",

(although watch out for the lack of comma on the last entry)

@aevesdocker aevesdocker added this to the 4.29 milestone Apr 8, 2024
@aevesdocker aevesdocker merged commit ad962e0 into docker:main Apr 8, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
area/desktop Issue affects a desktop edition of Docker. E.g docker for mac status/review
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants