langgenius/dify
1
0
Fork 0
mirror of https://github.com/langgenius/dify.git synced 2026-08-28 05:20:07 -04:00
Code Issues 775 Packages Projects Releases 10 Wiki Activity

NO_PROXY does not work on docker-api-1 #4300

New Issue
Closed
opened 2026-02-21 18:05:39 -05:00 by yindo · 4 comments
yindo commented 2026-02-21 18:05:39 -05:00
Owner
Copy Link
Copy Source

Originally created by @potofo on GitHub (Jun 27, 2024).

Originally assigned to: @Yeuoly on GitHub.

Self Checks

  • This is only for bug report, if you would like to ask a question, please head to Discussions.
  • I have searched for existing issues search for existing issues, including closed ones.
  • I confirm that I am using English to submit this report (我已阅读并同意 Language Policy).
  • 请务必使用英文提交 Issue，否则会被关闭。谢谢！:）
  • Please do not modify this template :) and fill in all the required fields.

Dify version

0.6.11

Cloud or Self Hosted

Self Hosted (Docker)

Steps to reproduce

Since the problem does not recur once the NO_PROXY environment variable is set in the Docker container, it is assumed that the problem is during the creation of the Docker image.
It is reproduced by following the steps below:

1. Remode Docker image for docker-api-1

docker rmi <IMAGE ID>

2. Setting corporate proxy for Docker Daemon

# vi /etc/systemd/system/docker.service.d/http-proxy.conf

-----
[Service]
Environment="HTTP_PROXY=http://hogehoge:hogepage@proxy.corporate.co.jp:8080"
Environment="HTTPS_PROXY=http://hogehoge:hogepage@proxy.corporate.co.jp:8080"
Environment="NO_PROXY=localhost, 127.0.0.1, aoai.corporate.co.jp, ollama.corporate.co.jp"
-----

# ​systemctl daemon-reload
# systemctl restart docker

confirm proxy for Docker Daemon 

# systemctl show --property=Environment docker
Environment=HTTP_PROXY=http://hogehoge:hogepage@proxy.corporate.co.jp:8080 HTTPS_PROXY=http://hogehoge:hogepage@proxy.corporate.co.jp:8080 "NO_PROXY=localhost, 127.0.0.1, aoai.corporate.co.jp, ollama.corporate.co.jp"

3. Confirm proxy setting in container

# docker exec -it docker-api-1 bash
root@b4e1b418b30c:/app/api# env | grep PROXY
SSRF_PROXY_HTTP_URL=http://ssrf_proxy:3128
HTTPS_PROXY=http://hogehoge:hogepage@proxy.corporate.co.jp:8080
HTTP_PROXY=http://hogehoge:hogepage@proxy.corporate.co.jp:8080
SSRF_PROXY_HTTPS_URL=http://ssrf_proxy:3128
root@b4e1b418b30c:/app/api#

=> No NO_PROXY environment variable found in docker-api-1 container

4. Confirm error message on curl command

curl "https://aoai.corporate.co.jp/openai/deployments/gpt-35-turbo-16k/chat/completions?api-version=2024-02-15-preview" \
 -H "Content-Type: application/json" \
 -H "api-key: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" \
 -d "{
 \"messages\": [{\"role\":\"system\",\"content\":\"You are an AI assistant that helps people find information.\"}],
 \"max_tokens\": 800,
 \"temperature\": 0.7,
 \"frequency_penalty\": 0,
 \"presence_penalty\": 0,
 \"top_p\": 0.95,
 \"stop\": null
 }"
 ```
=> Result message:
   Error code:403:　-{'error':{'code':'403',"messages': 'Access denied due to Virtual Network Network/Firewall rules.'}}

This message is the same as what is displayed on the GUI screen.

5. Workaround
As a workaround, you can avoid this issue by setting NO_PROXY in the api section of docker-compose.yaml.

Since the Docker version does not include a Docker file, we suspect that there is a NO_PROXY issue with the distributed Docker image.
I would like this bug fixed.
Thank you.

✔️ Expected Behavior

No response

❌ Actual Behavior

As a workaround, you can avoid this issue by setting NO_PROXY in the api section of docker-compose.yaml.

Originally created by @potofo on GitHub (Jun 27, 2024). Originally assigned to: @Yeuoly on GitHub. ### Self Checks - [X] This is only for bug report, if you would like to ask a question, please head to [Discussions](https://github.com/langgenius/dify/discussions/categories/general). - [X] I have searched for existing issues [search for existing issues](https://github.com/langgenius/dify/issues), including closed ones. - [X] I confirm that I am using English to submit this report (我已阅读并同意 [Language Policy](https://github.com/langgenius/dify/issues/1542)). - [X] 请务必使用英文提交 Issue，否则会被关闭。谢谢！:） - [X] Please do not modify this template :) and fill in all the required fields. ### Dify version 0.6.11 ### Cloud or Self Hosted Self Hosted (Docker) ### Steps to reproduce Since the problem does not recur once the NO_PROXY environment variable is set in the Docker container, it is assumed that the problem is during the creation of the Docker image. It is reproduced by following the steps below: **1. Remode Docker image for docker-api-1** ``` docker rmi <IMAGE ID> ``` **2. Setting corporate proxy for Docker Daemon** ``` # vi /etc/systemd/system/docker.service.d/http-proxy.conf ----- [Service] Environment="HTTP_PROXY=http://hogehoge:hogepage@proxy.corporate.co.jp:8080" Environment="HTTPS_PROXY=http://hogehoge:hogepage@proxy.corporate.co.jp:8080" Environment="NO_PROXY=localhost, 127.0.0.1, aoai.corporate.co.jp, ollama.corporate.co.jp" ----- # ​systemctl daemon-reload # systemctl restart docker confirm proxy for Docker Daemon # systemctl show --property=Environment docker Environment=HTTP_PROXY=http://hogehoge:hogepage@proxy.corporate.co.jp:8080 HTTPS_PROXY=http://hogehoge:hogepage@proxy.corporate.co.jp:8080 "NO_PROXY=localhost, 127.0.0.1, aoai.corporate.co.jp, ollama.corporate.co.jp" ``` **3. Confirm proxy setting in container** ``` # docker exec -it docker-api-1 bash root@b4e1b418b30c:/app/api# env | grep PROXY SSRF_PROXY_HTTP_URL=http://ssrf_proxy:3128 HTTPS_PROXY=http://hogehoge:hogepage@proxy.corporate.co.jp:8080 HTTP_PROXY=http://hogehoge:hogepage@proxy.corporate.co.jp:8080 SSRF_PROXY_HTTPS_URL=http://ssrf_proxy:3128 root@b4e1b418b30c:/app/api# ``` => No NO_PROXY environment variable found in docker-api-1 container **4. Confirm error message on curl command** ``` curl "https://aoai.corporate.co.jp/openai/deployments/gpt-35-turbo-16k/chat/completions?api-version=2024-02-15-preview" \ -H "Content-Type: application/json" \ -H "api-key: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" \ -d "{ \"messages\": [{\"role\":\"system\",\"content\":\"You are an AI assistant that helps people find information.\"}], \"max_tokens\": 800, \"temperature\": 0.7, \"frequency_penalty\": 0, \"presence_penalty\": 0, \"top_p\": 0.95, \"stop\": null }" ``` => Result message: Error code:403:　-{'error':{'code':'403',"messages': 'Access denied due to Virtual Network Network/Firewall rules.'}} This message is the same as what is displayed on the GUI screen. ``` **5. Workaround** As a workaround, you can avoid this issue by setting NO_PROXY in the api section of docker-compose.yaml. **Since the Docker version does not include a Docker file, we suspect that there is a NO_PROXY issue with the distributed Docker image. I would like this bug fixed. Thank you.** ### ✔️ Expected Behavior _No response_ ### ❌ Actual Behavior As a workaround, you can avoid this issue by setting NO_PROXY in the api section of docker-compose.yaml.
yindo added the 🐞 bug label 2026-02-21 18:05:39 -05:00
yindo closed this issue 2026-02-21 18:05:39 -05:00
yindo commented 2026-02-21 18:05:40 -05:00
Author
Owner
Copy Link
Copy Source

@dosubot[bot] commented on GitHub (Jun 27, 2024):

Hey @potofo! I'm here to help you with any bugs, questions, or contributions you have in mind. Let's get to the bottom of this docker-api-1 issue together!

To fix the issue with the NO_PROXY environment variable not working on the docker-api-1 container in a self-hosted Docker setup using Dify version 0.6.11, you need to ensure that the NO_PROXY environment variable is correctly set in the docker-compose.yaml file for the api service.

Here is an example of how you can set the NO_PROXY environment variable:

api:
  image: langgenius/dify-api:0.6.11
  restart: always
  environment:
    CONSOLE_WEB_URL: ''
    MODE: api
    LOG_LEVEL: INFO
    SECRET_KEY: sk-9f73s3ljTXVcMT3Blb3ljTqtsKiGHXVcMT3BlbkFJLK7U
    DB_USERNAME: postgres
    DB_PASSWORD: difyai123456
    DB_HOST: db
    DB_PORT: 5432
    DB_DATABASE: dify
    REDIS_HOST: redis
    REDIS_PORT: 6379
    REDIS_USERNAME: ''
    REDIS_PASSWORD: difyai123456
    REDIS_DB: 0
    REDIS_USE_SSL: 'false'
    CELERY_BROKER_URL: redis://:difyai123456@redis:6379/1
    STORAGE_TYPE: local
    STORAGE_LOCAL_PATH: storage
    S3_USE_AWS_MANAGED_IAM: 'false'
    S3_ENDPOINT: 'https://xxx.r2.cloudflarestorage.com'
    S3_BUCKET_NAME: 'difyai'
    S3_ACCESS_KEY: 'ak-difyai'
    S3_SECRET_KEY: 'sk-difyai'
    S3_REGION: 'us-east-1'
    AZURE_BLOB_ACCOUNT_NAME: 'difyai'
    AZURE_BLOB_ACCOUNT_KEY: 'difyai'
    AZURE_BLOB_CONTAINER_NAME: 'difyai-container'
    AZURE_BLOB_ACCOUNT_URL: 'https://<your_account_name>.blob.core.windows.net'
    GOOGLE_STORAGE_BUCKET_NAME: 'your-bucket-name'
    NO_PROXY: 'localhost,127.0.0.1,.yourdomain.com'
  volumes:
    - ./volumes/app/storage:/app/api/storage
  networks:
    - ssrf_proxy_network
    - default

Make sure to replace .yourdomain.com with the actual domain or IP addresses that should bypass the proxy. This configuration will ensure that the NO_PROXY environment variable is set correctly for the api service [1][2].

To continue talking to Dosu, mention @dosu.

@dosubot[bot] commented on GitHub (Jun 27, 2024): <!-- Greeting --> Hey @potofo! I'm here to help you with any bugs, questions, or contributions you have in mind. Let's get to the bottom of this docker-api-1 issue together! <!-- Answer --> To fix the issue with the `NO_PROXY` environment variable not working on the `docker-api-1` container in a self-hosted Docker setup using Dify version 0.6.11, you need to ensure that the `NO_PROXY` environment variable is correctly set in the `docker-compose.yaml` file for the `api` service. Here is an example of how you can set the `NO_PROXY` environment variable: ```yaml api: image: langgenius/dify-api:0.6.11 restart: always environment: CONSOLE_WEB_URL: '' MODE: api LOG_LEVEL: INFO SECRET_KEY: sk-9f73s3ljTXVcMT3Blb3ljTqtsKiGHXVcMT3BlbkFJLK7U DB_USERNAME: postgres DB_PASSWORD: difyai123456 DB_HOST: db DB_PORT: 5432 DB_DATABASE: dify REDIS_HOST: redis REDIS_PORT: 6379 REDIS_USERNAME: '' REDIS_PASSWORD: difyai123456 REDIS_DB: 0 REDIS_USE_SSL: 'false' CELERY_BROKER_URL: redis://:difyai123456@redis:6379/1 STORAGE_TYPE: local STORAGE_LOCAL_PATH: storage S3_USE_AWS_MANAGED_IAM: 'false' S3_ENDPOINT: 'https://xxx.r2.cloudflarestorage.com' S3_BUCKET_NAME: 'difyai' S3_ACCESS_KEY: 'ak-difyai' S3_SECRET_KEY: 'sk-difyai' S3_REGION: 'us-east-1' AZURE_BLOB_ACCOUNT_NAME: 'difyai' AZURE_BLOB_ACCOUNT_KEY: 'difyai' AZURE_BLOB_CONTAINER_NAME: 'difyai-container' AZURE_BLOB_ACCOUNT_URL: 'https://<your_account_name>.blob.core.windows.net' GOOGLE_STORAGE_BUCKET_NAME: 'your-bucket-name' NO_PROXY: 'localhost,127.0.0.1,.yourdomain.com' volumes: - ./volumes/app/storage:/app/api/storage networks: - ssrf_proxy_network - default ``` Make sure to replace `.yourdomain.com` with the actual domain or IP addresses that should bypass the proxy. This configuration will ensure that the `NO_PROXY` environment variable is set correctly for the `api` service <sup>[[1]](https://github.com/langgenius/dify/blob/main/docker/docker-compose.yaml)</sup><sup>[[2]](https://github.com/langgenius/dify-docs/blob/main/zh_CN/getting-started/install-self-hosted/environments.md)</sup>. <!-- Dosu Comment Footer --> *To continue talking to [Dosu](https://dosu.dev), mention @dosu.*
yindo commented 2026-02-21 18:05:40 -05:00
Author
Owner
Copy Link
Copy Source

@zhangzw16 commented on GitHub (Jun 28, 2024):

maybe this would help https://github.com/langgenius/dify/issues/5669#issuecomment-2195052423

@zhangzw16 commented on GitHub (Jun 28, 2024): maybe this would help https://github.com/langgenius/dify/issues/5669#issuecomment-2195052423
yindo commented 2026-02-21 18:05:40 -05:00
Author
Owner
Copy Link
Copy Source

@potofo commented on GitHub (Jun 28, 2024):

Thank you for your swift reply and good advice.
The issue was solved by setting NO_PROXY in Docker Client according to #5669

@potofo commented on GitHub (Jun 28, 2024): Thank you for your swift reply and good advice. The issue was solved by setting NO_PROXY in Docker Client according to #5669
yindo commented 2026-02-21 18:05:40 -05:00
Author
Owner
Copy Link
Copy Source

@crazywoola commented on GitHub (Jun 29, 2024):

I checked this with @Yeuoly once, you could also leave these two environments blank. Then it will not use this proxy while sending requests.

SSRF_PROXY_HTTP_URL=
SSRF_PROXY_HTTPS_URL=

https://github.com/langgenius/dify/blob/843280f82be614f1ed47e2aee3fba986b50c30a9/api/core/extension/api_based_extension_requestor.py#L32-L38

@crazywoola commented on GitHub (Jun 29, 2024): I checked this with @Yeuoly once, you could also leave these two environments blank. Then it will not use this proxy while sending requests. ``` SSRF_PROXY_HTTP_URL= SSRF_PROXY_HTTPS_URL= ``` https://github.com/langgenius/dify/blob/843280f82be614f1ed47e2aee3fba986b50c30a9/api/core/extension/api_based_extension_requestor.py#L32-L38
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
Knowledge Pipeline
Proposal
WIP
cloud
dependencies
feat:webapp
good first issue
outdated
performance
pull-request
Mirrored from GitHub Pull Request
 python:uv
refactor
size:L
stale
status: accepting prs
status: blocked
status: in discussion
stt & tts
vulnerablity
web
wont-fix
🌊 feat:workflow
🌚 invalid
🐞 bug
👻 feat:rag
💪 enhancement
📚 documentation
🔨 feat:tools
🙋‍♂️ question
🙏 help wanted
🤔 cant-reproduce
🤖 feat:agent
No Label 🐞 bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: langgenius/dify#4300
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?