Upgrade HAProxy image tag to lts-alpine #149

niklasteichmann · 2025-06-28T15:55:06Z

This PR includes the following changes:

set Poetry to not run in package-mode
upgraded base image tag from haproxy:2.2-alpine to haproxy:lts-alpine
resolved permission issues cause by user in base image changing from root to haproxy
updated tests
updated documentation

WARNING!
This PR will change how the image is used. An additional parameter --group-add=<docker_group_gid> is required to give the container's user (haproxy) permissions to access the Docker socket.

- upgraded base image tag from haproxy:2.2-alpine to haproxy:lts-alpine - resolved permission issues cause by user in base image changing from root to haproxy - updated tests - updated documentation

niklasteichmann · 2025-06-28T16:03:24Z

haproxy.cfg


 frontend dockerfrontend
-    bind ${BIND_CONFIG}
+    bind "$BIND_PORT" "$BIND_OPTIONS"


To make it possible to disable ipv6 via env I had to make this change in the HAProxy config. It works, but leads to warnings on start.

If someone knows a better way to do this, let me know.

niklasteichmann · 2025-06-30T09:19:50Z

I additionally upgraded the version of the Ubuntu image used for the Github jobs to ubuntu-latest and the version of the actions/cache to v4, so that the workflow runs again.

Let me know if you would prefer something different here.

josep-tecnativa · 2025-06-30T11:08:36Z

Thank you for the update!

The GitHub Actions tweaks look solid.
I think that ubuntu-24.04 should be pinned for LTS stability
Have you run end-to-end tests with the new haproxy:lts-alpine non-root setup—i.e. the socket proxy still forwards correctly and it runs on a default Docker host without extra privileges?

niklasteichmann · 2025-06-30T12:11:27Z

Thanks for the feedback, I pinned the Ubuntu image version to 24.04.

I did some basic end-to-end tests. Running this set of commands:

docker container run \
    -d \
    --group-add "$(getent group docker | cut -d: -f3)" \
    --name dockerproxy \
    -v /var/run/docker.sock:/var/run/docker.sock \
    -p 127.0.0.1:2375:2375 \
    -e CONTAINERS=1 \
    docker-socket-proxy:local
export DOCKER_HOST=tcp://localhost:2375
# wait for container to start
sleep 1
# should work
docker container ls
# should return 403
docker image ls
# should return 403
docker rm --force dockerproxy

I received this output:

CONTAINER ID   IMAGE                       COMMAND                  CREATED         STATUS        PORTS                      NAMES
5adc5cbf7063   docker-socket-proxy:local   "docker-entrypoint.s…"   2 seconds ago   Up 1 second   127.0.0.1:2375->2375/tcp   dockerproxy

Error response from daemon: <html><body><h1>403 Forbidden</h1>
Request forbidden by administrative rules.
</body></html>

Error response from daemon: <html><body><h1>403 Forbidden</h1>
Request forbidden by administrative rules.
</body></html>

Which looks good to me.

josep-tecnativa · 2025-07-01T05:45:47Z

Adding group_add in every docker-compose.yml would break existing setups.
Could the entrypoint script automatically detect the socket’s GID and add the haproxy user to that group? That way the image stays non-root and keeps working out-of-the-box with plain Compose stacks.

niklasteichmann · 2025-07-01T08:53:28Z

Adding the haproxy user to the docker group would require root privileges.

And because the GID of the docker group can vary from system to system, we can't do this during the image build.

What we could do is start the entrypoint script as root, add haproxy to the docker group, switch to the haproxy user and continue from there. I don't know if this is a good idea - what do you think?

josep-tecnativa · 2025-07-02T09:12:36Z

It could be fine for us. If you want, do the change please and I will test if it works properly.

- moved most of docker-entrypoint.sh into start-haproxy.sh - made container run as root initially, assign group of docker socket to haproxy user and execute start-haproxy.sh as haproxy - passthrough positional parameters to start-haproxy - updated documentation

niklasteichmann · 2025-07-02T11:27:31Z

I've implemented your proposed solution. Let me know what you think!

Edit:
I am especially curious how the image behaves on SELinux , but didn't have the time to test it myself. Do you maybe have one set up to test on?

niklasteichmann · 2025-07-14T09:41:05Z

@josep-tecnativa Sorry for pinging you directly, but did you have time to test?

josep-tecnativa · 2025-07-14T09:42:13Z

Sorry, not yet. I will try to test it this week.

niklasteichmann · 2025-07-28T10:38:26Z

Hi @josep-tecnativa, sorry again for being obnoxious, but do you think you will have time to test this week?

niklasteichmann · 2025-08-13T07:12:22Z

I just started using an internal fork including the changes from this PR for my customers. If something comes up, I will document it here.

niklasteichmann · 2025-08-15T10:00:20Z

Practical testing has shown that the solution implemented here (starting the container as root and adding the docker group to the haproxy user) is unreliable. My preferred solution unfortunately breaks existing setups.

So I will instead fork the repo permanently and close this PR.

niklasteichmann added 2 commits June 28, 2025 17:29

Disable poetry package mode

7035de2

Upgrade HAProxy image tag

3622fe8

- upgraded base image tag from haproxy:2.2-alpine to haproxy:lts-alpine - resolved permission issues cause by user in base image changing from root to haproxy - updated tests - updated documentation

niklasteichmann commented Jun 28, 2025

View reviewed changes

niklasteichmann added 2 commits June 30, 2025 11:10

Upgrade job image to ubuntu-latest

b6cac7b

Upgrade version of actions/cache to v4

ebca21e

pedrobaeza requested a review from josep-tecnativa June 30, 2025 09:16

niklasteichmann force-pushed the master branch from 4b0fac0 to ebca21e Compare June 30, 2025 09:16

Pinned job image version to ubuntu-24.04

c6e73c0

Fixed typo in ubuntu image version

593f180

Merge branch 'master' into master

c1558e5

fix formatting

a6b2b52

niklasteichmann closed this Aug 15, 2025

pedrobaeza mentioned this pull request Aug 21, 2025

Updated the underlying haproxy version from 2.2 to 3.2.4 #156

Merged

Upgrade HAProxy image tag to lts-alpine #149

Upgrade HAProxy image tag to lts-alpine #149

Uh oh!

Conversation

niklasteichmann commented Jun 28, 2025

Uh oh!

niklasteichmann Jun 28, 2025

Choose a reason for hiding this comment

Uh oh!

niklasteichmann commented Jun 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

josep-tecnativa commented Jun 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

niklasteichmann commented Jun 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

josep-tecnativa commented Jul 1, 2025

Uh oh!

niklasteichmann commented Jul 1, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

josep-tecnativa commented Jul 2, 2025

Uh oh!

niklasteichmann commented Jul 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

niklasteichmann commented Jul 14, 2025

Uh oh!

josep-tecnativa commented Jul 14, 2025

Uh oh!

niklasteichmann commented Jul 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

niklasteichmann commented Aug 13, 2025

Uh oh!

niklasteichmann commented Aug 15, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

niklasteichmann commented Jun 30, 2025 •

edited

Loading

josep-tecnativa commented Jun 30, 2025 •

edited

Loading

niklasteichmann commented Jun 30, 2025 •

edited

Loading

niklasteichmann commented Jul 1, 2025 •

edited

Loading

niklasteichmann commented Jul 2, 2025 •

edited

Loading

niklasteichmann commented Jul 28, 2025 •

edited

Loading