HTTP2 cannot be disabled

[pereorga]

I see in https://github.com/varnish/docker-varnish/blob/master/stable/debian/scripts/docker-varnish-entrypoint that HTTP2 is enabled by default, and that can't be disabled.

I have Traefik before Varnish, so I don't need TLS, nor HTTP2 in Varnish. I believe this is a common scenario.

Disabling unnecessary features should help in optimizing the resource usage (albeit in a small way, I guess).

[pereorga]

See also varnishcache/varnish-cache#3996 / http://r.varnish-cache.org/security/VSV00013.html

(mitigations in varnishcache/varnish-cache#4006 and varnishcache/varnish-cache#4008)

[gquintard]

Hi,

Sorry for the delay, things were a bit busy this last week.

So:

• disabling HTTP2 shouldn't yield any measurable gain in resource usage, but I'm willing to be proven wrong
• you can absolutely disable disable HTTP2, if only by starting the container with the full command line (please see the "Extra arguments" section of on the hub page)
• command line arguments are processed sequentially, and the rightmost parameters will override the leftmost ones. so you can easily disable HTTP2 support:

$ sudo docker run -itd --rm --name varnish_test varnish:7.4 -p feature=-http2
ac67143d26778377bf39e5021a7f943d0111294b42cf9af6b3db92918ac80396
$ sudo docker exec varnish_test varnishadm param.show feature
feature
        Value is: +validate_headers,+vcl_req_reset (default)
...

This is a general varnishd behavior rather than a docker-specific one, which is why I opted to not document it here. BUT, you already got bit by this, so maybe there a need for some more explicit documentation, and if you feel the same way, I would encourage you to open a PR to the documentation repository and to tag me, I will gladly review it and push for its inclusion.

I believe this should resolve the original intent of this issue, so I'll close it, but please do reopen it if I missed something