Home / server / Questions / 1166819
Accepted
friendly joe
Asked: 2024-10-20 10:11:54 +0800 CST

dynamic nginx-config for proxy_pass with many dockers

  • 772

I want my nginx docker to be able to proxy_pass dynamically if anyhow using one simple config..

I currently use this config for three apps, but I would like to make it work dynamically that I could also use it with /xyz_987 which automatically passes to http://xyz_987:3000:

server {
    listen 3000;
    server_name _;

    location /user1/ {
        proxy_pass http://user1:3000;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
    }

    location /user2/ {
        proxy_pass http://user2:3000;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
    }

    location /user3/ {
        proxy_pass http://user3:3000;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
    }
}

I tried this but it always results in a 502 Bad Gateway:

server {
    listen 3000;
    server_name _;

    location ~ ^/(?<username>[\w]+)/ {
        proxy_pass http://$username:3000;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
    }

    # Fallback for root path
    location / {
        return 404;
    }
}
nginx

2 Answers

  1. Best Answer

    The configuration you came up with is almost correct. The only thing you missed is a resolver directive, which is needed when your proxy hostname specified via variable(s). You may ask, why wouldn't nginx use the host's DNS facility? Here is a pretty good explanation:

    ...let's figure out why we need a resolver. Well, Linux, POSIX and the like offer only one way to get an IP from a name: gethostbyname. If you take time to read the man page (always a safe thing to do... ;)) you'll realise there is a lot to do to resolve a name: open files, ask NIS or YP what they think about it, ask a DNS server (may be in a few different ways). And all this is synchronous. Now that you are used to the nginx way, you know how bad this is and you don't want to go down the ugly synchronous way. So Igor, faithful to himself, reimplemented a DNS lookup (with an in-memory cache, mind you) just to avoid calling this ugly blocking gethostbyname... And that's why we have this extra resolver directive. Yes, coding the fastest web server comes at a price...

    To use docker internal DNS, you need to use the user-defined network (see Networking overview - User-defined networks, Networking with standalone containers - Use user-defined bridge networks documentation pages). Another article I can recommend is Understanding Docker DNS. Docker daemon’s embedded DNS resolver listens on the IP address 127.0.0.11 by default, so you need to change your nginx configuration to

    server {
    listen 3000;
    server_name _;
    resolver 127.0.0.11 ipv6=off;

    location ~ ^/(?<username>[\w]+)/ {
        proxy_pass http://$username:3000;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
    }

    # Fallback for root path
    location / {
        return 404;
    }
}

    and ensure your docker containers use the user-defined network.

    • 1

  2. Try this:

    location ~ ^/(user[a-z0-9]+)/ {
    proxy_pass http://$1:3000;
    ...
}

    The ~ specifies a Perl compatible regular expression match. Then, we match the string that starts with user and any numbers or letters, and captures that into the $1 variable.

    We cannot allow all characters here, because that would make the server an open proxy which malicious people will use to attack different targets.

    • 0