[{"_1":2,"_177":-5,"_178":-5},"loaderData",{"_3":4,"_13":14,"_21":22,"_156":157},"root",{"_5":-5,"_6":-7,"_7":8,"_9":-7,"_10":11,"_12":-7},"currentUser","primaryEmail","siteVerification","6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI","toast","enableDev",false,"incidentStatus","routes/_layout",{"_15":-5,"_16":17,"_18":17,"_19":11,"_20":11},"username","isAskGordonEnabled",true,"isUsingNewTemplate","showMinimalLanding","showHoneypotTrap","routes/_layout.r.$namespace.$reponame",{"_23":24,"_25":-5,"_26":11,"_27":11,"_28":29,"_30":31,"_32":-5,"_33":11,"_34":35,"_84":85,"_109":110,"_147":-5,"_148":11,"_149":17,"_150":11,"_151":-5,"_152":11,"_153":-5,"_154":155},"canonicalUrl","https://hub.docker.com/r/rainist/nginx_proxy/tags","mcpServer","canSeeDockerfile","canSeeAutobuilds","namespace","rainist","reponame","nginx_proxy","cloudBuildSource","isAutobuildsAvailable","repo",{"_36":37,"_38":39,"_41":42,"_43":44,"_45":11,"_46":47,"_48":49,"_50":51,"_53":31,"_28":29,"_54":55,"_56":40,"_57":58,"_59":58,"_60":61,"_62":-5,"_63":64,"_65":66,"_67":11,"_68":29,"_69":70,"_75":17,"_76":77,"_81":29,"_82":83},"categories",[],"content_types",[40],"image","date_registered","2018-10-30T06:39:27.890697Z","description","Nginx forward proxy","is_private","last_updated","2018-10-30T08:59:06.81185Z","last_modified","2024-10-16T13:48:34.145251Z","media_types",[52],"application/vnd.docker.container.image.v1+json","name","pull_count",258,"repository_type","star_count",1,"status","status_description","active","source","collaborator_count",0,"full_description","# Nginx forward proxy\n\n[Nginx](https://nginx.org/en/) is a very fast HTTP and reverse proxy server. \nUsually, Nginx is used to serve and cache static assets or as proxy or load balancer for incoming traffic to application servers. In this repository, it is used as forward proxy. \n\n## Use Case\n\nAssume you have a network where you want to control outgoing traffic. \nYou either want to: \n\n - Deny all outgoing calls by default and only allow HTTP(S) calls to whitelisted URLs.\n - Allow all outgoing calls by default and only block HTTP(S) calls to blacklisted URLs.\n\nThe Docker daemon can be configured that way that it routes all traffic through an proxy. This proxy can be an Nginx which is configured as forwarding proxying.\n\n## ngx\\_http\\_proxy\\_connect\\_module\n\nNginx is can be configured for forwarding proxying. \nUnfortunately, that doesn't work very well with HTTPS connections. \nAs soon the user is calling a URL via https, Nginx will throw errors. \nThere is a [StackOverflow issue](https://superuser.com/questions/604352/nginx-as-forward-proxy-for-https)\nto that topic. Luckily there is a solution for that problem. \nThe [ngx\\_http\\_proxy\\_connect\\_module](https://github.com/chobits/ngx_http_proxy_connect_module)\nis solving this issue. If Nginx is compiled with that module, \nthe proxying will work with SSL connections as well. \n\n## Docker Build\n\nThe Dockerfile in this repository is assembling an Nginx with the [ngx\\_http\\_proxy\\_connect\\_module](https://github.com/chobits/ngx_http_proxy_connect_module)\nand an nginx.conf file which blocks all outgoing traffic by default, \nbut allows access to some whitelisted domains like google.com.\nThe Docker image can be built like this: \n\n```\ndocker build -t reiz/nginx_proxy:0.0.1 . \n```\n\nOr simply download it from [Docker Hub](https://hub.docker.com/r/reiz/nginx_proxy/) with: \n\n```\ndocker pull reiz/nginx_proxy:latest\n```\n\n## Whitelist certain domains\n\nThis repository contains two nginx configuration files. \nThe `nginx_whitelist.conf` file is built for the use case that you want to deny all outgoing traffic by default and only allow some whitelisted domains. \nIn the first server section domains can be whitelisted by simply adding a \n`server_name *` line for each whitelisted domain. Here an example: \n\n```\n # Whitelist Google\n server {\n listen 8888;\n server_name google.com;\n server_name *.google.com;\n server_name google.de;\n server_name www.google.de;\n proxy_connect;\n proxy_max_temp_file_size 0;\n resolver 8.8.8.8;\n location / {\n proxy_pass http://$http_host;\n proxy_set_header Host $http_host;\n }\n }\n```\n\nRegex can be used to describe a domain. This `*.google.com` for example is whitelisting all subdomains of google.com. In the above example, google.com and all subdomains of it are whitelisted. Beside that google.de and www.google.de are whitelisted. Subdomains of google.de are **not** whitelisted. \nThe proxy would allow outgoing calls to this domains: \n\n - google.com\n - www.google.com\n - mail.google.com\n - api.google.com\n - google.de\n - www.google.de\n \nThis domains are blocked with the above configuration: \n \n - mail.google.de\n - api.google.de\n\nBy starting the Docker container the file can be mounted into the running container. \n\n```\ndocker run -d -p 8888:8888 -v nginx_whitelist.conf:/usr/local/nginx/conf/nginx.conf reiz/nginx_proxy:latest \n```\n\nNow the Docker container is running with the mounted configuration.\n\n## Blacklist certain domains\n\nThis repository contains two nginx configuration files. \nThe `nginx_blacklist.conf` file is built for the use case that you want to allow all outgoing traffic by default and only block traffic to some domains. \nIn the first server section domains can be blacklisted by simply adding a \n`server_name *` line for each blacklisted domain. Here an example: \n\n```\n server {\n listen 8888;\n server_name google.com;\n server_name *.google.com;\n return 404;\n }\n```\n\nIn the example above all pages would be accessible, but google.com and all subdomains of it would be blocked. Regex can be used here in the same way as in the whitelist example. \nBy starting the Docker container the file can be mounted into the running container. \n\n```\ndocker run -d -p 8888:8888 -v nginx_whitelist.conf:/usr/local/nginx/conf/nginx.conf reiz/nginx_proxy:0.0.1 \n```\n\nNow the Docker container is running with the mounted configuration.\n\n## Testing\n\nYou can test your configuration by pointing your Browser to the Nginx proxy in the running Docker container. \nIf you run the Docker container on your localhost, then you can point your Browser to `localhost:8888`. \nHere is an example how it looks like in Firefox: \n\n![Firefox Proxy Settings](images/Firefox-Proxy-Settings.png)\n\n## Configuring Docker and Kubernetes with a Proxy\n\nAssuming you have a cluster of Docker machines (Kubernetes cluster)\nand you would like to route all outgoing traffic to your proxy. \nThat can be achieved by setting some global ENV variables on each Docker machine. \n\nFor RedHat/CentOS version 6:\n\n```shell\ncat <\nEOF\n \nsudo service docker restart\n```\n\nFor RedHat/CentOS version 7, remove export:\n\n```shell\ncat <\nEOF\n \nsudo sed -i '/\\[Service\\]/a EnvironmentFile=/etc/sysconfig/docker' /usr/lib/systemd/system/docker.service\nsudo systemctl daemon-reload\nsudo service docker restart\n```\n\nFor Ubuntu 14.04:\n\n```shell\ncat <\nEOF\n \nsudo restart docker\n```\n\nFor Kubernetes it works the same way. \nThe `http_proxy` ENV has to be set before the K8S processes are starting.\nMinikube can be started with proxy params directly.\nHere an example: \n\n```shell\nhttps_proxy=http://:80 minikube start --docker-env HTTP_PROXY=http://:80 --docker-env HTTPS_PROXY=http://:80 --docker-env NO_PROXY=192.168.99.0/24\n```\n\nAlternatively the Proxy can be set by Container start as well: \n\n```shell\ndocker run -e \"http_proxy=http://myproxy.example.com:8888\" \\\n -e \"https_proxy=https://myproxy.example.com:8888\" \\\n -d liveperson\\app run.sh\n```\n\n","has_starred","hub_user","immutable_tags_settings",{"_71":11,"_72":73},"enabled","rules",[74],".*","is_automated","permissions",{"_78":17,"_79":11,"_80":11},"read","write","admin","user","storage_size",178660405,"orgData",{"_86":87,"_88":89,"_90":91,"_92":29,"_93":94,"_95":96,"_97":98,"_99":100,"_101":102,"_103":104,"_105":106,"_107":106,"_108":17},"id","9238e093ca50487288b6100dff39f465","uuid","9238e093-ca50-4872-88b6-100dff39f465","type","organization","orgname","full_name","Rainist","location","Seoul, Korea","company","Banksalad Co., Ltd.","profile_url","https://banksalad.com","date_joined","2016-11-09T08:01:02.501426Z","gravatar_url","https://www.gravatar.com/avatar/7fbf9d3b4be2048194b3679a5ee114a6?s=80&r=g&d=mm","gravatar_email","","badge","is_active","recentTags",[111],{"_112":40,"_113":114,"_115":116,"_86":117,"_118":119,"_46":136,"_137":114,"_138":29,"_139":52,"_53":140,"_141":142,"_143":127,"_144":136,"_145":61,"_146":17},"content_type","creator",1235959,"full_size",178652121,38738043,"images",[120],{"_121":122,"_123":124,"_125":106,"_126":127,"_128":129,"_130":131,"_132":106,"_133":-5,"_134":116,"_59":61,"_135":-5},"architecture","amd64","digest","sha256:054cfaa2fd1d6e7067c81e0a4bfd8698462e35575d6b0185b64dc2b64f8c4591","features","last_pulled","2026-09-24T00:41:22.39359501Z","last_pushed","2018-10-30T08:58:58Z","os","linux","os_features","os_version","size","variant","2018-10-30T08:58:57.775984Z","last_updater","last_updater_username","media_type","latest","repository",6218704,"tag_last_pulled","tag_last_pushed","tag_status","v2","sbxKitMetadata","isPotentialSpam","isHubSbxKitsEnabled","showSbxLogoOverride","sbxTrademarkText","displaySecurityMetadata","tagAttestations","tagsHaveAttestations",[],"routes/_layout.r.$namespace.$reponame.tags",{"_34":158,"_165":166,"_154":175,"_176":11},{"_36":159,"_38":160,"_41":42,"_43":44,"_45":11,"_46":47,"_48":49,"_50":161,"_53":31,"_28":29,"_54":55,"_56":40,"_57":58,"_59":58,"_60":61,"_62":-5,"_63":64,"_65":66,"_67":11,"_68":29,"_69":162,"_75":17,"_76":164,"_81":29,"_82":83},[],[40],[52],{"_71":11,"_72":163},[74],{"_78":17,"_79":11,"_80":11},"tags",{"_167":58,"_168":-5,"_169":-5,"_170":171},"count","next","previous","results",[172],{"_112":40,"_113":114,"_115":116,"_86":117,"_118":173,"_46":136,"_137":114,"_138":29,"_139":52,"_53":140,"_141":142,"_143":127,"_144":136,"_145":61,"_146":17},[174],{"_121":122,"_123":124,"_125":106,"_126":127,"_128":129,"_130":131,"_132":106,"_133":-5,"_134":116,"_59":61,"_135":-5},[],"canDeleteTags","actionData","errors"]

rainist/nginx_proxy

Tags for rainist/nginx_proxy