2

i have my local docker CLI binary connected with a docker daemon on the LAN (or better say on the same machine). for certain duties this daemon needs to connect to the internet via a company firewall/proxy system. (the system is based upon Ubuntu 16.04 LTS - the issue might be relevant for a lot more similar systems.)

the daemon is configured similar to this snippet from Ultimate Guide to Docker HTTP Proxy Configuration as shown in case #2 for the file /etc/systemd/system/docker.service.d/http-proxy.conf:

[Service]
Environment="HTTP_PROXY=http://your.proxy:8080"
Environment="HTTPS_PROXY=http://your.proxy:8080"
Environment="NO_PROXY=127.0.0.1,localhost"

for this config to finally work i have to add (with sudo rights elevation) "username:password@" upfront the "your.proxy" part of the server name.

then i am operating/restarting the systemd and daemon:

sudo systemctl daemon-reload
sudo systemctl restart docker

finally i am checking (as a simple user) the result:

systemctl show --property=Environment docker

It results in something like this (the environment items seemingly listed in a space separated fashion):

Environment=HTTP_PROXY=http://username:password@your.proxy:8080 HTTPS_PROXY=http://username:password@your.proxy:8080 NO_PROXY=127.0.0.1,localhost

As you can see this simple user command unveils the proxy credentials. I definitely dont want that to be.

How can i prevent any ordinary user from retriving these set of proxy credentials? Is there a method that copes with the systemd environment concept? or is some alternate method needed, if yes, which one?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.