MacOSX & Proxy : An error occurred trying to connect: Forbidden

[cfrancois7]

Dear all,

I've many problems with Docker on my OS X. I followed the official instruction but it isn't enough to use docker. Now I virtualized Ubuntu on Virtualbox to use Docker, it's not very useful. Currently docker and Kitematic don't work fine on my OS X.

I suspect a proxy problem because docker works fine on my virtual box and also on my personal Wifi network.

info: Darwin Kernel Version 15.0.0: Sat Sep 19 15:53:46 PDT 2015; root:xnu-3247.10.11~1/RELEASE_X86_64 x86_64 $ docker --version Docker version 1.9.1, build a34a1d5 $ docker-machine env default export DOCKER_TLS_VERIFY="1" export DOCKER_HOST="tcp://192.168.99.100:2376" export DOCKER_CERT_PATH="/Users/francocy/.docker/machine/machines/default" export DOCKER_MACHINE_NAME="default" $ docker-machine ls NAME ACTIVE DRIVER STATE URL SWARM ERRORS default - virtualbox Running tcp://192.168.99.100:2376

My problem:

$ docker run hello-world
An error occurred trying to connect: Post https://192.168.99.100:2376/v1.21/containers/create: Forbidden

And if I open a new terminal tab, I've :

$ docker run hello-world
Cannot connect to the Docker daemon. Is the docker daemon running on this host?

However, if I'm connected to the VM, the commands work:

$ docker-machine ssh default
$ docker run hello-world

That works.

I tried several method but without success:

1. http://mflo.io/2015/08/13/docker-machine-behind-proxy/ but adapted for docker-machine

$ docker-machine create -d virtualbox \
    --engine-env HTTP_PROXY=http://example.com:8080 \
    --engine-env HTTPS_PROXY=https://example.com:8080 \
    --engine-env NO_PROXY=example2.com \
    default

1. https://viget.com/extend/how-to-use-docker-on-os-x-the-missing-guide

I don't understand why it's not working.

Thanks in advance, (docker works fine on my ubuntu virtulabox)

[fsoppelsa]

I tried with 0.5.0 (04cfa58) and --engine-env options create the appropriate exports in /var/lib/boot2docker/profile. Which version are you using, and are those exports there?

[nathanleclaire]

--engine-env should work OK.

Does normal networking commands, e.g. ping, work with HTTP_PROXY etc. set in shell if you docker-machine ssh into the VM?

[cfrancois7]

Thanks for your replies.

For my version:

$ docker-machine --version
docker-machine version 0.5.2 ( 0456b9f )

I re-tested the —engine-env:

$ docker-machine create -d virtualbox --engine-env HTTP_PROXY=http://http://www-cache.ujf-grenoble.fr:3128 --engine-env HTTPS_PROXY=https://www-cache.ujf-grenoble.fr:3128 --engine-env NO_PROXY=localhost test
$ eval "$(docker-machine env test) »
$ docker run hello-world
An error occurred trying to connect: Post https://192.168.99.101:2376/v1.21/containers/create: Forbidden
$ docker-machine ssh test
$ docker run hello-world
—> success

Regarding Ping test, everything is ok, in and out VM:

$ ping -c 1 www.google.fr
PING www.google.fr (216.58.211.99): 56 data bytes
64 bytes from 216.58.211.99: icmp_seq=0 ttl=51 time=15.040 ms

--- www.google.fr ping statistics ---
1 packets transmitted, 1 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 15.040/15.040/15.040/0.000 ms

$ docker-machine ssh test
$ ping -c 1 www.google.fr
PING www.google.fr (216.58.211.99): 56 data bytes
64 bytes from 216.58.211.99: seq=0 ttl=63 time=15.422 ms

--- www.google.fr ping statistics ---
1 packets transmitted, 1 packets received, 0% packet loss
round-trip min/avg/max = 15.422/15.422/15.422 ms

The results are identical if I config manually HTTP_PROXY with docker command or PING command. Also Kitematic doesn't work behind the proxy but it's ok on my personal home network.

Thanks in advance,

EDIT:

If I want the logs, it's forbidden too:

$ docker log test
An error occurred trying to connect: Get https://192.168.99.100:2376/v1.21/containers/test/json: Forbidden
$ docker volume ls
An error occurred trying to connect: Get https://192.168.99.100:2376/v1.21/volumes: Forbidden
$ docker info
An error occurred trying to connect: Get https://192.168.99.100:2376/v1.21/info: Forbidden

[cfrancois7]

I found the solution to resolve my problem. I suppress the proxy config in my ~/.bash_profile and communicate the proxy config through --engine-env. Same thing with Kitematic, I use http_proxy=http://my-proxy:port https_proxy=http://my-proxy:port open Kitematic\ \(Beta\).app and it works. The problem was the proxy config in ~/.bash_profile.

[cfrancois7]

Dear all,

I've still a problem. My problem is know the server nginx on my docker. And it's still a proxy problem. Docker works well (and Kitematic too): install, management of container, etc. but I've a time (60) Operation timed out.

$ docker-machine env default
export DOCKER_TLS_VERIFY="1"
export DOCKER_HOST="tcp://192.168.99.104:2376"
export DOCKER_CERT_PATH="/Users/myself/.docker/machine/machines/default"
export DOCKER_MACHINE_NAME="default"

$ docker ps
CONTAINER ID        IMAGE                        COMMAND                 CREATED             STATUS              PORTS               NAMES
4bb9b4e7800c        aksw/ontowiki-ubuntu-nginx   "/bin/bash /start.sh"   8 minutes ago       Up 8 minutes        80/tcp              condescending_swartz
$ docker inspect 4bb9b4e7800c
"NetworkSettings": {
        "Bridge": "",
        "SandboxID": "3ee9dd3768e5ef15fb1e3ad2387545257c183046763799eb898197a8db393ca5",
        "HairpinMode": false,
        "LinkLocalIPv6Address": "",
        "LinkLocalIPv6PrefixLen": 0,
        "Ports": {
            "80/tcp": null
        },
        "SandboxKey": "/var/run/docker/netns/3ee9dd3768e5",
        "SecondaryIPAddresses": null,
        "SecondaryIPv6Addresses": null,
        "EndpointID": "4d87ac1ec5f32fabb87547480d68202f3a5f660ef8711e1fb49adc7be750134f",
        "Gateway": "172.17.0.1",
        "GlobalIPv6Address": "",
        "GlobalIPv6PrefixLen": 0,
        "IPAddress": "172.17.0.2",
        "IPPrefixLen": 16,
        "IPv6Gateway": "",
        "MacAddress": "02:42:ac:11:00:02",
        "Networks": {
            "bridge": {
                "EndpointID": "4d87ac1ec5f32fabb87547480d68202f3a5f660ef8711e1fb49adc7be750134f",
                "Gateway": "172.17.0.1",
                "IPAddress": "172.17.0.2",
                "IPPrefixLen": 16,
                "IPv6Gateway": "",
                "GlobalIPv6Address": "",
                "GlobalIPv6PrefixLen": 0,
                "MacAddress": "02:42:ac:11:00:02"
            }
        }

When I tried to go to the website http://192.168.99.104:2376 I received the time out message. Have you an idea?

Thanks in advance

[cfrancois7]

Dear all,

I've still a problem with my proxy config on my MacOsX, but on my nginx server. Despite my container runs right the server gives me (60) Operation timed out.

Just for information my virtual box config is defined as NAT.

Docker told me that it needs tls certs:

$ docker-machine ssh default
$ sudo /etc/init.d/docker restart
Need TLS certs for default,127.0.0.1,10.0.2.15,192.168.99.105

Even if I regenerate certs, nothing works better.

Info:

$ docker info
Containers: 3
Images: 36
Server Version: 1.9.1
Storage Driver: aufs
 Root Dir: /mnt/sda1/var/lib/docker/aufs
 Backing Filesystem: extfs
 Dirs: 42
 Dirperm1 Supported: true
Execution Driver: native-0.2
Logging Driver: json-file
Kernel Version: 4.1.13-boot2docker
Operating System: Boot2Docker 1.9.1 (TCL 6.4.1); master : cef800b - Fri Nov 20 19:33:59 UTC 2015
CPUs: 1
Total Memory: 1.956 GiB
Name: default
ID: 5QOI:6CZ2:AHK3:MMLS:N6X6:QXIN:OWMM:F4OJ:VZNJ:I5LQ:EWEZ:4UYB
Debug mode (server): true
 File Descriptors: 22
 Goroutines: 48
 System Time: 2015-12-09T16:51:16.727337457Z
 EventsListeners: 0
 Init SHA1: 
 Init Path: /usr/local/bin/docker
 Docker Root Dir: /mnt/sda1/var/lib/docker
Labels:
 provider=virtualbox

$ docker ps
CONTAINER ID        IMAGE                        COMMAND                 CREATED             STATUS               PORTS               NAMES
4bb9b4e7800c        aksw/ontowiki-ubuntu-nginx   "/bin/bash /start.sh"   2 hours ago         Up 2 hours          80/tcp              condescending_swart

$ docker inspect 4bb9b4e7800c
"NetworkSettings": {
        "Bridge": "",
        "SandboxID": "3ee9dd3768e5ef15fb1e3ad2387545257c183046763799eb898197a8db393ca5",
        "HairpinMode": false,
        "LinkLocalIPv6Address": "",
        "LinkLocalIPv6PrefixLen": 0,
        "Ports": {
            "80/tcp": null
        },
        "SandboxKey": "/var/run/docker/netns/3ee9dd3768e5",
        "SecondaryIPAddresses": null,
        "SecondaryIPv6Addresses": null,
        "EndpointID": "4d87ac1ec5f32fabb87547480d68202f3a5f660ef8711e1fb49adc7be750134f",
        "Gateway": "172.17.0.1",
        "GlobalIPv6Address": "",
        "GlobalIPv6PrefixLen": 0,
        "IPAddress": "172.17.0.2",
        "IPPrefixLen": 16,
        "IPv6Gateway": "",
        "MacAddress": "02:42:ac:11:00:02",
        "Networks": {
            "bridge": {
                "EndpointID": "4d87ac1ec5f32fabb87547480d68202f3a5f660ef8711e1fb49adc7be750134f",
                "Gateway": "172.17.0.1",
                "IPAddress": "172.17.0.2",
                "IPPrefixLen": 16,
                "IPv6Gateway": "",
                "GlobalIPv6Address": "",
                "GlobalIPv6PrefixLen": 0,
                "MacAddress": "02:42:ac:11:00:02"
            }
        }

and it's not fixed with docker-machine env --no-proxy as 1693

[cfrancois7]

The problem is I haven't defined Ports when I run on my network behind proxy:

network behind proxy where it fails:

$ docker inspect ...
          "Ports": {
            "80/tcp": null
        }

on my network where it works:

$ docker inspect ...
"Ports": {
            "80/tcp": [
                {
                    "HostIp": "0.0.0.0",
                    "HostPort": "32769"
                }

It's the only difference I found between the two case. But I don't understand why this problem and how to solve it. It seems to be pretty easy to resolve but I didn't find.