If you don't have docker installed, follow the steps in the article below to install docker https://qiita.com/m-tmatma/items/06eb40514306e09142c4
Prepare a proxy as in the following article. https://qiita.com/m-tmatma/items/7b5ce812c85f30546209
This article assumes that the proxy IP is 192.168.11.61 and the port number is 3128.
Emulate an environment that can only be accessed via a proxy. As a result, it is possible to detect when the setting is incorrect.
sudo iptables -A OUTPUT -j REJECT -p tcp --dport 80
sudo iptables -A OUTPUT -j REJECT -p tcp --dport 443
sudo iptables -A OUTPUT -j REJECT -p tcp --dport 9418
sudo iptables -A OUTPUT -j REJECT -p tcp --dport 22
apt
I thought that apt can be used inside the docker container, but since the environment settings set in ~ / .docker / config.json are valid, no settings are required for use inside the container.
Not required even in the host environment if http_proxy`` https_proxy is set in the environment variable.
sudo nano /etc/apt/apt.conf
Save with the following contents.
Acquire::http::Proxy "http://192.168.11.61:3128";
Acquire::https::Proxy "http://192.168.11.61:3128";
Set the proxy variables as follows.
test@test-vmware:~$ cat /etc/apt/apt.conf
Acquire::http::Proxy "http://192.168.11.61:3128";
Acquire::https::Proxy "http://192.168.11.61:3128";
sudo apt update -y
sudo apt upgrade -y
Install docker by referring to https://qiita.com/m-tmatma/items/06eb40514306e09142c4.
sudo apt install -y docker.io docker-compose
This step is only needed if you want to run the docker command without sudo.
It's convenient to run docker without sudo, so add the current user to the docker group. Reboot to reflect.
sudo usermod -aG docker $USER
sudo reboot
If you restart here, re-execute [iptables procedure](#emulate an environment that can only be accessed via a proxy).
Execute the following command.
sudo systemctl edit docker
Enter the following contents in the editor started by sudo systemctl edit docker, save and exit.
[Service]
Environment="HTTP_PROXY=http://192.168.11.61:3128"
Environment="HTTPS_PROXY=http://192.168.11.61:3128"
In the editor started by sudo systemctl edit docker, specify NO_PROXY additionally.
Enter the following contents, save and exit.
[Service]
Environment="HTTP_PROXY=http://192.168.11.61:3128"
Environment="HTTPS_PROXY=http://192.168.11.61:3128"
Environment="NO_PROXY=localhost,127.0.0.1"
Saved in /etc/systemd/system/docker.service.d/override.conf.
The following is an example when the excluded IP is not specified.
$ cat /etc/systemd/system/docker.service.d/override.conf
[Service]
Environment="HTTP_PROXY=http://192.168.11.61:3128" "HTTPS_PROXY=http://192.168.11.61:3128"
Reflect the settings.
sudo systemctl daemon-reload
Check the settings.
sudo systemctl show docker --property Environment
Restart docker.
sudo systemctl restart docker
Execute the following to check that it is reflected in HTTP Proxy and HTTPS Proxy.
docker info
reference http://docs.docker.jp/engine/articles/systemd.html#http https://docs.docker.com/config/daemon/systemd/
Create a folder to save the configuration file.
mkdir -p ~/.docker
Edit ~ / .docker / config.json.
nano ~/.docker/config.json
Enter the following contents in ~ / .docker / config.json and save.
{
"proxies": {
"default": {
"httpProxy": "http://192.168.11.61:3128",
"httpsProxy": "http://192.168.11.61:3128"
}
}
}
To specify the exclusion condition for the proxy, specify it with noProxy in ~ / .docker / config.json.
{
"proxies": {
"default": {
"httpProxy": "http://192.168.11.61:3128",
"httpsProxy": "http://192.168.11.61:3128",
"noProxy": "localhost,127.0.0.1"
}
}
}
reference https://docs.docker.com/network/proxy/ https://docs.docker.com/network/proxy/#configure-the-docker-client
You can do docker pull as follows.
$ docker pull alpine
Using default tag: latest
latest: Pulling from library/alpine
df20fa9351a1: Pull complete
Digest: sha256:185518070891758909c9f839cf4ca393ee977ac378609f700f60a771a2dfe321
Status: Downloaded newer image for alpine:latest
docker.io/library/alpine:latest
As a precaution, direct access to http and https is prohibited even if you check with iptables.
$ sudo iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain FORWARD (policy DROP)
target prot opt source destination
DOCKER-USER all -- anywhere anywhere
DOCKER-ISOLATION-STAGE-1 all -- anywhere anywhere
ACCEPT all -- anywhere anywhere ctstate RELATED,ESTABLISHED
DOCKER all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
REJECT tcp -- anywhere anywhere tcp dpt:https reject-with icmp-port-unreachable
REJECT tcp -- anywhere anywhere tcp dpt:http reject-with icmp-port-unreachable
REJECT tcp -- anywhere anywhere tcp dpt:git reject-with icmp-port-unreachable
REJECT tcp -- anywhere anywhere tcp dpt:ssh reject-with icmp-port-unreachable
Chain DOCKER (1 references)
target prot opt source destination
Chain DOCKER-ISOLATION-STAGE-1 (1 references)
target prot opt source destination
DOCKER-ISOLATION-STAGE-2 all -- anywhere anywhere
RETURN all -- anywhere anywhere
Chain DOCKER-ISOLATION-STAGE-2 (1 references)
target prot opt source destination
DROP all -- anywhere anywhere
RETURN all -- anywhere anywhere
Chain DOCKER-USER (1 references)
target prot opt source destination
RETURN all -- anywhere anywhere
Recommended Posts