title: Docker redsocks proxy behind HTTP proxy with no internet DNS
body: <h1>Network Environment</h1>
  
  <ul>
  <li>No internet DNS available</li>
  <li>Corporate squid proxy allowing HTTP and HTTPS traffic on port 3128</li>
  </ul>
  
  <h1>Docker Environment</h1>
  
  <p>Docker is running on an Ubuntu 15.04 guest inside VirtualBox on OS X.</p>
  
  <p>A container <code>docker-forgetproxy</code> (<a href="https://github.com/k-labs/docker-forgetproxy" rel="nofollow">https://github.com/k-labs/docker-forgetproxy</a>) which is running <code>redsocks</code> on top of the host's network infrastructure, run with: </p>
  
  <pre><code>$ docker run -it --rm --net=host --privileged \
                   -e http_proxy=$http_proxy \
                   -e https_proxy=$https_proxy \
                   klabs/docker-forgetproxy
  </code></pre>
  
  <p>This modifies the host's iptables rules by issuing the following commands where <code>$1</code> is set to <code>A</code>:</p>
  
  <pre><code>iptables -t nat -$1 PREROUTING -i docker0 -d 127.0.0.0/8 -j RETURN
  iptables -t nat -$1 PREROUTING -i docker0 -d 169.254.0.0/16 -j RETURN
  iptables -t nat -$1 PREROUTING -i docker0 -d 172.16.0.0/12 -j RETURN
  iptables -t nat -$1 PREROUTING -i docker0 -d 192.168.0.0/16 -j RETURN
  iptables -t nat -$1 PREROUTING -i docker0 -d 224.0.0.0/4 -j RETURN
  iptables -t nat -$1 PREROUTING -i docker0 -d 240.0.0.0/4 -j RETURN
  
  iptables -t nat -$1 PREROUTING -p tcp --dport 80   -i docker0 -j REDIRECT --to 12345 2&gt;/dev/null
  iptables -t nat -$1 PREROUTING -p tcp --dport 8080 -i docker0 -j REDIRECT --to 12345 2&gt;/dev/null
  iptables -t nat -$1 PREROUTING -p tcp --dport 53   -i docker0 -j REDIRECT --to 5300
  iptables -t nat -$1 PREROUTING -p tcp -i docker0 -j REDIRECT --to 12346
  </code></pre>
  
  <p>and launches <code>redsocks</code> is launched with the </p>
  
  <pre><code>base {
    log_debug = off;
    log_info = on;
    log = "stderr";
    daemon = off;
    user = redsocks;
    group = redsocks;
    redirector = iptables;
  }
  
  redsocks {
    type = http-relay;
    ip = http://my-proxy;
    port = 3128;
    local_ip = 0.0.0.0;
    local_port = 12345;
  }
  
  redsocks {
    type = http-connect;
    ip = http://my-proxy;
    port = 3128;
    local_ip = 0.0.0.0;
    local_port = 12346;
  }
  
  dnstc {
      local_ip = 127.0.0.1;
      local_port = 5300;
  }
  </code></pre>
  
  <h1>Problem</h1>
  
  <p>When I launch a new docker container with <code>docker run -it --rm ubuntu apt-get update</code> it seems the container's requests aren't getting rerouted to the <code>redsocks</code> container.</p>
  
  <p>Watching the packets on wireshark it appears the DNS resolution for archive.ubuntu.com from the <code>apt-get</code> container tries to go to my domain DNS server (which can't perform internet look ups) if I set the DNS server to that of the <code>docker0</code> iface it seems it gets captured by the 172.16.0.0/12 iptables rule since today it was 172.17.42.1</p>