Repository navigation
desktop: fix the air-gapped containers block and allow examples - #26607
Conversation
✅ Deploy Preview for docsdocker ready!Built without sensitive environment variables
To edit notification comments on pull requests, go to your Netlify project configuration. |
github-actions
Bot
added
the
area/desktop
d9a7d05 to
7420d93
Compare
| "locked": true, | ||
| "mode": "manual", | ||
| "http": "", | ||
| "https": "", |
There was a problem hiding this comment.
@mat007 @aevesdocker we need to add line 94 here as well "embeddedPac": ....
There was a problem hiding this comment.
PAC file doesn't honor exclude list, as the exclusion is specified in the PAC file itself. I am not sure if embededPac honors exclude list specified in the proxy stanza. I will test tomorrow.
There was a problem hiding this comment.
ok, we should add
"embeddedPac": "function FindProxyForURL(url, host) { if (isInNet(host, "10.0.0.0", "255.0.0.0")) {return "DIRECT";} return \"PROXY reject.docker.internal:1234\"; }",
and remove "exclude" setting on line 109 or set the value to empty "exclude": [].
There was a problem hiding this comment.
@karman-docker I updated the doc with a slight variant, after verifying locally. Can you take a look?
The block all example set only empty http/https values and transparentPorts, with no PAC script and no proxy. With nothing to route through, container connections go straight out, so it blocked nothing. The allow specific internal services example had the same problem, as exclude only bypasses a proxy and nothing was restricting the rest. Use an inline PAC script in both. The block all one rejects every request, which also blocks image pulls. The allow one returns DIRECT for the internal domain and addresses and rejects the rest. exclude cannot override a PAC rejection, so it is left empty. Add embeddedPac to the parameters table.
7420d93 to
9c0ce0d
Compare
mat007
changed the title
Description
The "Block all external access" and "Allow specific internal services" examples have no PAC script, so container connections go straight out and nothing is blocked.
This replaces both with an inline PAC script, and notes that image pulls are blocked too.
Related issues or tickets
SEG-1871
Reviews
Checked on Docker Desktop 4.100.0 on Windows: with the old block example, internet and host access from a container still work. With the new one they are blocked, and so is
docker pull. To verify, rundocker run --rm alpine wget -O- https://www.google.com, which should fail.