Skip to content

desktop: fix the air-gapped containers block and allow examples #26607

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
aevesdocker merged 1 commit into from
Nov 12, 2026
Merged

desktop: fix the air-gapped containers block and allow examples #26607

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 9 additions & 2 deletions content/manuals/desktop/enterprise/hardened-desktop/air-gapped-containers.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -77,11 +77,12 @@ The `containersProxy` setting controls network policies applied to `docker image
| `https` | HTTPS proxy server | URL (e.g., `"https://proxy.company.com:8080"`) |
| `exclude` | Bypass proxy for these addresses | Array of hostnames/IPs |
| `pac` | Proxy Auto-Configuration file URL | URL to PAC file |
| `embeddedPac` | Proxy Auto-Configuration script written inline, with precedence over `pac` | PAC script content |
| `transparentPorts` | Ports subject to proxy rules | Comma-separated ports or wildcard (`"*"`) |

### Configuration examples

Block all external access:
Block all external access, including image pulls:

```json
"containersProxy": {
Expand All @@ -90,10 +91,13 @@ Block all external access:
"http": "",
"https": "",
"exclude": [],
"embeddedPac": "function FindProxyForURL(url, host) { return \"PROXY reject.docker.internal:1234\"; }",
"transparentPorts": "*"
}
```

With no PAC script and no proxy set, connections go straight out, so empty `http` and `https` values don't block anything. The PAC script in this example rejects every request.

Allow specific internal services:

```json
Expand All @@ -102,11 +106,14 @@ Allow specific internal services:
"mode": "manual",
"http": "",
"https": "",
"exclude": ["internal.company.com", "10.0.0.0/8"],
"exclude": [],
"embeddedPac": "function FindProxyForURL(url, host) { if (dnsDomainIs(host, 'internal.company.com') || isInNet(host, '10.0.0.0', '255.0.0.0')) { return 'DIRECT'; } return 'PROXY reject.docker.internal:1234'; }",
"transparentPorts": "80,443"
}
```

The PAC script allows the internal domain and the `10.0.0.0/8` addresses, and rejects everything else. Use `dnsDomainIs` to match host names and `isInNet` to match IP addresses. The `exclude` setting can't allow a request that the PAC script rejects, so leave it empty.

Route through corporate proxy:

```json
Expand Down
Loading