Skip to content

Add iptables to http-proxy docker images #658

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
AGMETEOR wants to merge 10 commits into
base: main
Choose a base branch
from
Open

Add iptables to http-proxy docker images #658

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
c7c060f
Add iptables to http-proxy docker images
AGMETEOR Jul 4, 2025
611aefe
Add servermasq set up script
AGMETEOR Jul 4, 2025
53cb841
Add servermasq set up script comment
AGMETEOR Jul 4, 2025
4e0dd49
.
AGMETEOR Jul 7, 2025
bbc9046
Fix permissions for iptables
AGMETEOR Jul 10, 2025
2cd8a3a
Fix permissions for iptables
AGMETEOR Jul 10, 2025
c147d5e
Fix iptables commands
AGMETEOR Jul 10, 2025
80c44cd
Fix perms
AGMETEOR Jul 24, 2025
22275da
Fix servermasq rules
AGMETEOR Jul 26, 2025
53780c4
Fix typo
AGMETEOR Jul 26, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,8 +16,14 @@ FROM --platform=$BUILDPLATFORM alpine as user
RUN adduser -S -u 10000 lantern

FROM alpine

Copilot AI Jul 4, 2025

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Consider adding a comment explaining why iptables is required in this image to help future maintainers understand this dependency.

Suggested change
FROM alpine
FROM alpine
# iptables is required for managing network traffic and firewall rules in the application.

Copilot uses AI. Check for mistakes.
RUN apk add --no-cache iptables

Copilot AI Jul 4, 2025

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[nitpick] You may want to pin the iptables version or reference a specific Alpine image digest to ensure reproducible builds.

Copilot uses AI. Check for mistakes.

COPY --from=user /etc/passwd /etc/passwd
COPY --from=builder /usr/local/bin/http-proxy /usr/local/bin/http-proxy

COPY servermasq.sh /servermasq.sh
RUN chmod +x /servermasq.sh

USER lantern
ENTRYPOINT ["/servermasq.sh"]
Comment on lines 22 to +30

Copilot AI Jul 4, 2025

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The servermasq.sh entrypoint executes iptables commands, which require root privileges, but the container switches to the unprivileged lantern user before running the script. Consider moving USER lantern below the entrypoint or running the iptables setup as root and then dropping privileges before starting the proxy.

Suggested change
USER lantern
ENTRYPOINT ["/servermasq.sh"]
ENTRYPOINT ["/servermasq.sh"]
USER lantern

Copilot uses AI. Check for mistakes.
CMD ["/usr/local/bin/http-proxy"]
18 changes: 18 additions & 0 deletions servermasq.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,18 @@
#!/bin/sh
set -e

echo "[+] Setting up LANTERN_SERVERMASQ iptables chain..."

if [ -z "$PROXY_ADDR" ] || [ -z "$PROXY_PORT" ] || [ -z "$MASQ_ADDR" ]; then
echo "[~] Required environment variables not set, skipping iptables setup"
exec "$@"
fi

iptables -t nat -N LANTERN_SERVERMASQ 2>/dev/null || true
iptables -t nat -F LANTERN_SERVERMASQ 2>/dev/null || true

iptables -t nat -A LANTERN_SERVERMASQ -d "$PROXY_ADDR" ! --dport "$PROXY_PORT" -j DNAT --to-destination "$MASQ_ADDR"
iptables -t nat -A PREROUTING -d "$PROXY_ADDR" -j LANTERN_SERVERMASQ

echo "[+] LANTERN_SERVERMASQ setup complete: $@"
exec "$@"