Hi, I’ve set both core.proxy_http and core.proxy_https to a proxy in my lab as every host must use it to access internet so I can monitor who goes where. Even by setting images.auto_update_cached=false and images.auto_update_interval=0, every time Incus service is restarted, there are exactly 4 connections to https://images.linuxcontainers.org.
Is there a way to prevent that?
That’s most likely the cloud instance type definition files being refreshed on startup which come from that image server. Just to confirm, that traffic is correctly going through your proxy, correct?
We don’t currently have a way to turn off that mechanism and are actually likely to expand it somewhat with our planned work to implement OCI VMs as for that, we’ll need to have Incus pull in a minimal kernel and initrd from our image servers regardless of the source of the OCI image.
In any case, it’s fine for you to block that particular traffic, if Incus was ever allowed to download the data, it will have something on disk, just potentially outdated. If not, then in this case, it will just act as if it didn’t know about particular public cloud instance types or in the future, won’t be able to launch OCI images as VMs.
Yes, Incus is using the proxy. I don’t really need to block the request at it is totally harmless (ie: my main use of the proxy is to spot apps that try to phone home). I merely asked in case there was a switch I missed in the config 
One thing though I just noticed : Using the command incus image info images:<TAB> to use the Bash completion, it tries to connect to the images server but directly, not respecting the proxy settings. The proxy does not get any request but the firewall blocks the same 4 connections.
That’s normal. The concept of remotes is purely a CLI concept, so when you do incus image list images: or incus image info images:FOO, there is zero interact with the Incus daemon, it’s just the CLI talking to a remote image server.
The CLI does respect the usual environment variables for the proxy (http_proxy and https_proxy) so as long as you have those set correctly on your system, the CLI will be fine.
Noted! So I’ll create a small wrapper which will set the env vars for proxy before calling Incus then. I don’t want to make these variables globally available.