gortium/openconcho
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(docker): derive nginx resolver from container DNS

Browse Source 
Hardcoded resolver 127.0.0.11 only exists on user-defined networks, so a plain
docker run on the default bridge 502'd (DNS connection refused). Render the
resolver from /etc/resolv.conf at start so per-request proxy_pass resolves on
both the default bridge (host DNS) and compose networks (embedded DNS).
This commit is contained in:
Offending Commit
2026-06-02 13:33:50 -05:00
parent 6b602c05bb
commit 66b299a28e
2 changed files with 11 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
docker/40-openconcho-config.sh
View File

@@ -11,6 +11,14 @@ cat > /usr/share/nginx/html/config.js <<EOF
window.__OPENCONCHO_DEFAULT_HONCHO_URL__ = "${OPENCONCHO_DEFAULT_HONCHO_URL:-}"; window.__OPENCONCHO_DEFAULT_HONCHO_URL__ = "${OPENCONCHO_DEFAULT_HONCHO_URL:-}";
EOF EOF
# Derive nginx's resolver from the container's own DNS so the runtime-variable
# proxy_pass resolves on BOTH user-defined networks (Docker embedded DNS at
# 127.0.0.11) and the default bridge (host nameservers from /etc/resolv.conf).
# Hardcoding 127.0.0.11 breaks `docker run` on the default bridge (no embedded DNS).
RESOLVERS=$(awk '/^nameserver/ { print $2 }' /etc/resolv.conf | tr '\n' ' ' | sed 's/ *$//')
[ -z "$RESOLVERS" ] && RESOLVERS=127.0.0.11
printf 'resolver %s ipv6=off valid=10s;\n' "$RESOLVERS" > /etc/nginx/conf.d/00-resolver.conf
# Render the SSRF allowlist into an nginx map for $allow_upstream. # Render the SSRF allowlist into an nginx map for $allow_upstream.
# Unset/empty OPENCONCHO_UPSTREAM_ALLOWLIST → open (default 1), fine for the # Unset/empty OPENCONCHO_UPSTREAM_ALLOWLIST → open (default 1), fine for the
# localhost-bound default. Set it (comma-separated host globs) before exposing # localhost-bound default. Set it (comma-separated host globs) before exposing

5
docker/nginx.conf.template
View File

@@ -12,8 +12,9 @@ server {
# Don't leak the nginx version. # Don't leak the nginx version.
server_tokens off; server_tokens off;
# Resolver required for per-request DNS when proxy_pass targets a runtime variable. # The resolver (required for per-request DNS with a runtime-variable proxy_pass)
resolver 127.0.0.11 ipv6=off valid=10s; # is rendered by the entrypoint into conf.d from the container's own DNS, so it
# works on both user-defined networks (127.0.0.11) and the default bridge.
# Header-driven same-origin proxy: the browser names the Honcho upstream per # Header-driven same-origin proxy: the browser names the Honcho upstream per
# request via X-Honcho-Upstream, so the browser never makes a cross-origin call. # request via X-Honcho-Upstream, so the browser never makes a cross-origin call.