Repository navigation
Basic Authentication parameters for DockerClient ? #162
Description
Dears,
I am using a simple nginx server as proxy to the docker socket, instead of enabling the remote API directly on Docker. Reason is: I would like some access restrictions, but simpler than the whole certificate thing.
Here is the nginx configuration:
upstream docker {
server unix:/var/run/docker.sock;
}
server {
listen 2375 default_server;
location / {
proxy_pass http://docker;
auth_basic_user_file /etc/nginx/.htpasswd;
auth_basic "Access restricted";
}
}
Say my server is http://docker-server:2735/
For any HTTP GET request initiated by the multiple commands, it succeeds if I set the URL as http://user:pass@docker-server:2735/
However, it fails when it comes to POST requests or DELETE requests. You'll find the full stack trace below.
I know this isn't how things should be done so ... Could you please advise me a possible alternative, or consider this as a feature request ?
Many thanks for your help.
Cheers from Belgium,
Eric
Feb 27, 2015 1:55:08 PM org.glassfish.jersey.filter.LoggingFilter log
INFO: 1 * Sending client request on thread http-nio-8080-exec-6
1 > GET http://maestro:maestro@192.168.252.187:2375/containers/PROD_TOMCAT_ebis/json
1 > Accept: application/json
Feb 27, 2015 1:55:08 PM org.glassfish.jersey.filter.LoggingFilter log
INFO: 2 * Client response received on thread http-nio-8080-exec-6
2 < 200
2 < Connection: keep-alive
2 < Content-Length: -1
2 < Content-Type: application/json
2 < Date: Fri, 27 Feb 2015 12:54:52 GMT
2 < Server: nginx/1.4.6 (Ubuntu)
2 < Transfer-Encoding: chunked
--- response hidden for privacy reasons ;)
Feb 27, 2015 1:55:08 PM org.glassfish.jersey.filter.LoggingFilter log
INFO: 3 * Sending client request on thread http-nio-8080-exec-6
3 > POST http://maestro:maestro@192.168.252.187:2375/containers/PROD_TOMCAT_ebis/start
3 > Accept: application/json
3 > Content-Type: application/json
{"Binds":["/srv/ebis/requests:/srv/ebis/requests:rw"],"PortBindings":{"8009/tcp":[{"HostIp":"","HostPort":"8009"}],"8080/tcp":[{"HostIp":"","HostPort":"8080"}]}}
Feb 27, 2015 1:55:08 PM org.apache.catalina.core.StandardWrapperValve invoke
SEVERE: Servlet.service() for servlet [be.informex.docker.manager.servlets.AjaxActionServlet] in context with path [/docker-manager] threw exception
javax.ws.rs.ProcessingException: org.apache.http.client.ClientProtocolException
at org.glassfish.jersey.apache.connector.ApacheConnector.apply(ApacheConnector.java:513)
at org.glassfish.jersey.client.ClientRuntime.invoke(ClientRuntime.java:246)
at org.glassfish.jersey.client.JerseyInvocation$1.call(JerseyInvocation.java:667)
at org.glassfish.jersey.client.JerseyInvocation$1.call(JerseyInvocation.java:664)
at org.glassfish.jersey.internal.Errors.process(Errors.java:315)
at org.glassfish.jersey.internal.Errors.process(Errors.java:297)
at org.glassfish.jersey.internal.Errors.process(Errors.java:228)
at org.glassfish.jersey.process.internal.RequestScope.runInScope(RequestScope.java:424)
at org.glassfish.jersey.client.JerseyInvocation.invoke(JerseyInvocation.java:664)
at org.glassfish.jersey.client.JerseyInvocation$Builder.method(JerseyInvocation.java:424)
at org.glassfish.jersey.client.JerseyInvocation$Builder.post(JerseyInvocation.java:333)
at com.github.dockerjava.jaxrs.StartContainerCmdExec.execute(StartContainerCmdExec.java:26)
at com.github.dockerjava.jaxrs.StartContainerCmdExec.execute(StartContainerCmdExec.java:13)
at com.github.dockerjava.jaxrs.AbstrDockerCmdExec.exec(AbstrDockerCmdExec.java:47)
at com.github.dockerjava.core.command.AbstrDockerCmd.exec(AbstrDockerCmd.java:28)
at com.github.dockerjava.core.command.StartContainerCmdImpl.exec(StartContainerCmdImpl.java:287)
at be.informex.docker.manager.requesters.DockerRequester.startTomcatContainer(DockerRequester.java:125)
at be.informex.docker.manager.actions.containers.StartContainerAction.executeValidRequest(StartContainerAction.java:56)
at be.informex.docker.manager.actions.containers.StartContainerAction.executeValidRequest(StartContainerAction.java:1)
at be.informex.docker.manager.AbstractDockerManagerAction.execute(AbstractDockerManagerAction.java:75)
at be.informex.docker.manager.AbstractAjaxHandler.executeAction(AbstractAjaxHandler.java:55)
at be.informex.docker.manager.AbstractAjaxHandler.executeAction(AbstractAjaxHandler.java:43)
at be.informex.docker.manager.ajax.StartContainerAjaxHandler.handleRequest(StartContainerAjaxHandler.java:39)
at be.informex.docker.manager.servlets.AjaxActionServlet.executeAction(AjaxActionServlet.java:164)
at be.informex.docker.manager.servlets.AjaxActionServlet.doPost(AjaxActionServlet.java:53)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:644)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:725)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:291)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:239)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:219)
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:106)
at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:501)
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:142)
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:79)
at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:610)
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:88)
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:537)
at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1085)
at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:658)
at org.apache.coyote.http11.Http11NioProtocol$Http11ConnectionHandler.process(Http11NioProtocol.java:222)
at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1556)
at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.run(NioEndpoint.java:1513)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
at java.lang.Thread.run(Thread.java:745)
Caused by: org.apache.http.client.ClientProtocolException
at org.apache.http.impl.client.InternalHttpClient.doExecute(InternalHttpClient.java:186)
at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:72)
at org.glassfish.jersey.apache.connector.ApacheConnector.apply(ApacheConnector.java:465)
... 48 more
Caused by: org.apache.http.client.NonRepeatableRequestException: Cannot retry request with a non-repeatable request entity.
at org.apache.http.impl.execchain.MainClientExec.execute(MainClientExec.java:208)
at org.apache.http.impl.execchain.ProtocolExec.execute(ProtocolExec.java:195)
at org.apache.http.impl.execchain.RetryExec.execute(RetryExec.java:86)
at org.apache.http.impl.execchain.RedirectExec.execute(RedirectExec.java:108)
at org.apache.http.impl.client.InternalHttpClient.doExecute(InternalHttpClient.java:184)
... 50 more
Activity
marcuslinke commented on Feb 28, 2015
@ericfjosne Looks to me more like a redirection problem. See last two rows of the stacktrace:
Maybe your nginx proxy does not handle POST / DELETE requests in a transparent way?
ericfjosne commented on Mar 2, 2015
@marcuslinke Thanks for your response.
When I comment the 2 following lines from my nginx configuration, I do not get any error at all:
In addition, I can guarantee the nginx proxy does handle the POST/DELETE requests as it should.
Tested it with POSTMAN in a Chrome Browser.
I checked this further and found the following link, matching the exact same issue, with a fix description:
android-async-http/android-async-http#186
From your experience, do you believe it is something that can be handled at your code level or is it deeper in the dependencies?
Thanks for your support. Much appreciated.
marcuslinke commented on Mar 3, 2015
According to the stack trace there must be a redirection somewhere. As i understand the problem the request is streamed by the underlying apache connector and can't be repeated as the stream is consumed already when the redirect occurs. With GET requests there is nothing to stream to the server so it just works.
Just found http://stackoverflow.com/questions/19681965/reuse-authorization-header-to-prevent-multiple-407-proxy-authentication-challeng
There is a good explanation of what's going on. Please test if the mentioned configuration works for you as I'm not able to reproduce your problem here locally.
marcuslinke commented on Jul 31, 2015
Related: #282