Running cockpit/ws container behind nginx-proxy container

[Funky185540]

Hello there,

I'm attempting to run the cockpit container via docker (not podman) on a Debian 10 host. As an additional "challenge" I'd like it to run behind an nginx-based reverse proxy, which is handled by the nginx-proxy container.

To handle the networking I've created a bridged network using docker network create proxy-net which I use to connect all containers to the proxy. Now I have only 2 containers in that network: The proxy and cockpit.

I have seen there are various resources regarding proxies and cockpit:

• https://github.com/cockpit-project/cockpit-container/issues/18
• Proxying cockpit cockpit container through nginx container #10224
• Proxying cockpit cockpit container through nginx container #10224

And in addition there's this great wiki page here:

• https://github.com/cockpit-project/cockpit/wiki/Proxying-Cockpit-over-NGINX

So I have attempted to follow these instructions to make it run - but without success. So far I have managed to establish that when I enter the container running cockpit, I can curl localhost:9090 and get some contents. If, however, I enter the proxy container and attempt to curl cockpit:9090 I receive a "Connection refused". This is entirely regardless of how I try it:

[root@proxy]$ curl cockpit:9090
[root@proxy]$ curl http://cockpit:9090
[root@proxy]$ curl https://cockpit:9090
[root@proxy]$ curl -k https://cockpit:9090

It really doesn't matter much. On the cockpit side of things I have played with these options: AllowUnencrypted, Origins and ProtocolHeader. Here's the cockpit.conf I work with:

[WebService]
AllowUnencrypted = true
Origins = 0.0.0.0
# ProtocolHeader = X-Forwarded-Proto
# Origins = https://cockpit.<HOST> wss://cockpit.<HOST>

The Origins = 0.0.0.0 was my last desperate attempt to make it work, inspired by this comment.

So the short version of the story is: I can't even curl the cockpit UI from another container, much less from an external host through my TLS-terminated proxy. I'd like to have some guidance here on what exactly is going wrong.

I'll provide a MWE after I have scraped all unrelated stuff from my configs. In the meantime you can see from this PCAP (
cockpit.zip) that the cockpit ws doesn't even bother to setup a TCP connection.

For clarification:

• 172.23.0.2 is the proxy
• 172.23.0.3 is the cockpit container

And here's the docker-compose.yml for the cockpit-ws container:

version: "3.6"

# ------------------------------------------------------------------------------
# Cockpit (Monitoring service)
# ------------------------------------------------------------------------------
services:
  cockpit:
    image: cockpit/ws:latest
    networks: 
      - "proxy-net"
    expose:
      - "9090"
    # Needs acces to the underlying host
    privileged: true
    pid: "host"
    environment:
      - VIRTUAL_HOST=cockpit.biomech.fh-bielefeld.de
      - VIRTUAL_PORT=9090
      - CERT_NAME=default
    volumes:
      - "/:/host"
# Tried overriding the startup commands, but that had no apparent effect...
#    command: ["/container/atomic-run", "--for-tls-proxy"]
#    command: ["/container/atomic-run", "--no-tls"]
# ------------------------------------------------------------------------------


# ------------------------------------------------------------------------------
# Shared network for all services
# ------------------------------------------------------------------------------
networks:
  proxy-net:
    external: true
    driver: bridge
# ------------------------------------------------------------------------------

Hope this helps!

[MartinX3]

See #5239 (comment)

Working with podman 4.3, a native cockpit and a container nginx.
(With a 4th level domain.)