Unable to download external templates when portainer is behind a forward proxy.

[Hugh----]

Description
Unable to download external templates when portainer is behind a forward proxy.

Steps to reproduce the issue:

1. Deploy portainer behind a corporate network. And outgoing traffic need to be authenticated first.
2. You will get a "Failure: Unable to retrieve templates" error.
3. And there is no place to configure these settings in the "Settings" section.

Any other info e.g. Why do you consider this to be a bug? What did you expect to happen instead?

Technical details:

• Portainer version: 1.14.0
• Target Docker version (the host/cluster you manage): 17.06.0
• Platform (windows/linux): Linux(CentOS 7)
• Command used to start Portainer (docker run -p 9000:9000 portainer/portainer):
• Target Swarm version (if applicable):
• Browser: Google Chrome

[WTFKr0]

Hey you just have to set environment variables to container :

docker run .... -e http_proxy=http://user:pass@myproxy.org -e https_proxy=http://user:pass@myproxy.org -e no_proxy=my.org .....

[Hugh----]

Yeah, thanks very much and this is what I know that I can achieve, but passwords may expire after a certain time. Still tend to request for such a setting in Web UI so that it can be masked and updated. What do you think?

[deviantony]

I'm thinking that this is part of your Docker setup and should not be integrated in Portainer. You should either manage to do it using the *_proxy env vars as specified by @WTFKr0 or you can host the templates next to Portainer (http://portainer.readthedocs.io/en/stable/templates.html#build-and-host-your-own-templates) and then update Portainer settings to point at these templates.

@ncresswell what's your view on this?

[ncresswell]

Authenticating proxy servers are quite common in corp environments, so my pref is that we add this support into the UI.

[Madko]

I'm also trying to run portainer behind a proxy, but as soon as I add the env http_proxy, the portainer container doesn't start anymore. It looks like it's trying to join the docker endpoint thru the proxy. Which doesn't make sense since it's a socket file.

Connecting to the Docker endpoint...

and in the log:
janv. 23 09:15:00 docker0-s285 dockerd[7187]: time="2018-01-23T09:15:00.873558191Z" level=info msg="ignoring event" module=libcontainerd namespace=moby topic=/containers/delete type="*events.ContainerDelete"
janv. 23 09:15:00 docker0-s285 dockerd[7187]: time="2018-01-23T09:15:00.889727690Z" level=error msg="fatal task error" error="task: non-zero exit (1)" module=node/agent/taskmanager node.id=rv5d88pmui4nxyannpgrdgxay service.id=rod4bvighwnxbgzhsqwvzhzm1 task.id=to7n2wrpqmtnj481ruq5xesyc

That's all I have.

I try docker run and docker service, same results. If I remove the -e (or --env-file) it's starting fine, I can use the interface until I hit something that tryes to grab data from the outside world.

So how can I pass proxy address to the portainer service ? Is it sure to be working ? How can I have more debug information ?

best regards,
Edouard

[deviantony]

@Madko are these the logs of the Docker daemon? Can you paste the logs of the Portainer container?

[Madko]

How can I get them ?

Meanwhile, I've found a workaround:

• Create portainer service without env about proxy
• Use portainer to add env variable for https_proxy to the portainer service
• with docker cli, scale down to 0 and then to 1 to update it.
• Then it works (I have the app templates etc)

[deviantony]

You can use docker logs <portainer_container_name> to retrieve the logs from the container.

[Madko]

Here is the command I use to start portainer:

docker service create --name portainer --publish 9000:9000 --replicas=1 --constraint 'node.role == manager' --mount type=bind,src=//var/run/docker.sock,dst=/var/run/docker.sock --mount type=bind,src=//opt/portainer,dst=/data portainer/portainer -H unix:///var/run/docker.sock --env https_proxy=http://10.156.0.1:8080

If I try to docker logs on the portainer container created by this command it doesn't return anything (container stays in starting state). But I can see some traffic on the proxy server.

[root@docker0-s287 ~]# docker ps --all
CONTAINER ID        IMAGE                        COMMAND                  CREATED             STATUS                             PORTS               NAMES
83e280d7491e        portainer/portainer:latest   "/portainer -H unix:…"   30 seconds ago      Up 24 seconds (health: starting)   9000/tcp            portainer2.1.50onqpp7mj1vnr7tpidb8ps6m

after a few seconds, the container is removed and recreated by docker service.

So is this correct to use --env to pass my proxy settings to the docker service ?

[deviantony]

@Madko no, you need to pass the -e flag to the docker command, not to the portainer command:

docker service create --name portainer \
--publish 9000:9000 \
--replicas=1 \
--env https_proxy=http://10.156.0.1:8080 \
--constraint 'node.role == manager' \
--mount type=bind,src=//var/run/docker.sock,dst=/var/run/docker.sock \
--mount type=bind,src=//opt/portainer,dst=/data \
portainer/portainer -H unix:///var/run/docker.sock 

Basically, everything before the image name is related to the Docker command while everything located after the image name is related to the binary inside the image (here, the -H unix:///var/run/docker.sock is a Portainer flag).

[Madko]

@deviantony thanks this was as stupid as that. Now everything is working fine.