Docker container traffic routing through proxy
Written by skeirss
So today last.fm stopped working for Russia:
❯ curl -I https://www.last.fm/
HTTP/2 403
So here's the problem: now my dockerized Navidrome server won't scrobble tracks to last.fm, and since there are no proxy options in Navidrome, we have to route all network traffic from the container to a proxy server.
Sometimes I feel like I'm between a rock and a hard place, because the restrictions are coming from both ways... But something good always comes out of every bad situation, and from this situation I'll learn a little more about Docker and proxying. Anyways.
What's my goal: make Navidrome scrobble tracks to last.fm again by routing its traffic though my host machine's Xray proxy.
What's my steps:
- Install and configure xray on my server
- Update docker compose, add proxy variables
So first I need to update my Xray configuration. Basically I need to change Xray to listen on all network interfaces (0.0.0.0) so the Docker container can reach it:
"inbounds": [
{
"listen": "0.0.0.0",
"port": 10808,
"protocol": "socks"
},
{
"listen": "0.0.0.0",
"port": 10809,
"protocol": "http"
}
],
And since my server is local and working behind a router and cg-nat, it is a safe approach.
Now I need to update my docker compose file, so Navidrome can find the host and use the proxy vars:
services:
navidrome:
extra_hosts:
- "host.docker.internal:host-gateway"
environment:
- HTTP_PROXY=http://host.docker.internal:10809
- HTTPS_PROXY=http://host.docker.internal:10809
- ALL_PROXY=socks5://host.docker.internal:10808
- NO_PROXY=localhost,127.0.0.1
Why extra_hosts? It creates a "map" so the container knows host.docker.internal = your host machine's IP. Checking that variables described in the docker file are read within the container:
root@thinkcentre:~# docker exec navidrome-navidrome-1 env | grep -i proxy
no_proxy=localhost,127.0.0.1
http_proxy=http://host.docker.internal:10809
https_proxy=http://host.docker.internal:10809
all_proxy=socks5://host.docker.internal:10809
Looks like it's fine. Too bad we can't test connection inside the container using curl, because there's no such utility in the container. Let's just play a song and see if it is scrobbling or not:
Yes, it is working as intended, yay!
Only what he finds conducive is to his taste; his pleasure, his enjoyment stops when the mark of what is conducive is overstepped. He guesses correctly what will heal harm, he exploits strokes of bad luck to his advantage; what does not kill him makes him stronger.