Lxc config device add proxy: connect=tcp: vs connect=tcp:

When defining a new proxy device to connect a host IP:port to a container…
What is the difference between using vs the actual IP of the container?

I see in all the tutorials and blogs you should use, however, by accident, I used the container IP instead and both seem to work the same…

@Yosu_Cadilla because the proxy switches into the container’s namespace before trying to connect to the service, you are able to use respective of which container you are connecting to (that is assuming the service you want to connect to is actually listening on inside the container).

There isn’t necessarily a problem using the external IP for the proxy connect, however it means that you are potentially (depending on your network setup) exposing that service via the container’s IP as well as via the proxy (which may not be desirable).

It is also means that if your container change’s its IP then the proxy will need to be reconfigured.

1 Like

It is less likely to make a mistake if there are fewer moving parts in a command such as

lxc config device add mycontainer myport80 proxy listen=tcp: connect=tcp: 

In documentation, it is easier to explain that the only two items that you may need to change, are the container name and the name of the proxy device.

Thank you very much @tomp and @simos.

I always thought of the proxy device of something living in the host, now I realize it really lives on the container (obvious really, it’s a container device, but this wasn’t clear to me until now).

You’re welcome :slight_smile:

Proxy is kind of unusual in that it lives on both the host and the container (because it switches namespaces from the host to the container after initially listening on the host).

This is what allows it to both listen on one of the host’s IPs and connect to inside the container.

LXD is amazing, and so is this community. I’m happy to have gone this route instead of the more hyped K8S.