From a6f4aedd7e505e4f2938d1470add5a7e69e1056c Mon Sep 17 00:00:00 2001 From: Daniel Fox Franke Date: Sat, 10 Oct 2026 15:04:56 -0400 Subject: [PATCH 1/2] Fix Docker build to support current Ubuntu Ubuntu since 26.04 no longer packages Apache Traffic Server, so we have to build it ourselves now. This commit also fixes Squid's configuration, because Ubuntu ships default rules that prevent access via Podman's 169.254.x.x bridge. This was causing all tests to fail with 403 errors. --- docker/Dockerfile | 46 +++++-- docker/entrypoint.sh | 4 +- docker/serve.sh | 2 +- docker/trafficserver/ip_allow.config | 1 - docker/trafficserver/ip_allow.yaml | 10 ++ docker/trafficserver/records.config | 181 --------------------------- docker/trafficserver/records.yaml | 97 ++++++++++++++ test-docker.sh | 6 +- 8 files changed, 154 insertions(+), 193 deletions(-) delete mode 100644 docker/trafficserver/ip_allow.config create mode 100644 docker/trafficserver/ip_allow.yaml delete mode 100644 docker/trafficserver/records.config create mode 100644 docker/trafficserver/records.yaml diff --git a/docker/Dockerfile b/docker/Dockerfile index afdb529e..34fb5792 100644 --- a/docker/Dockerfile +++ b/docker/Dockerfile @@ -1,3 +1,29 @@ +FROM --platform=linux/amd64 ubuntu:rolling AS trafficserver-build + +# Rolling Ubuntu no longer packages ATS. Build a verified upstream release in a +# separate stage so its compiler and development dependencies stay out of the image. +ARG ATS_VERSION=10.2.0 +ARG ATS_SHA512=afdd02ea6b37dc344e24e985727add89e26d0bbce4ac7f91f2c51134c8219484d6739d9b5c7c4c177f913cd0a9f756cbc0c89bcb06ee21bc159c32046e38379e +ARG ATS_BUILD_JOBS=4 + +RUN apt-get update \ + && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \ + build-essential ca-certificates cmake curl ninja-build pkg-config \ + libcap-dev libpcre2-dev libssl-dev zlib1g-dev \ + && rm -rf /var/lib/apt/lists/* + +WORKDIR /usr/src/trafficserver +RUN curl -fL --retry 3 "https://archive.apache.org/dist/trafficserver/trafficserver-${ATS_VERSION}.tar.bz2" -o ats.tar.bz2 \ + && echo "${ATS_SHA512} ats.tar.bz2" | sha512sum -c - \ + && tar -xjf ats.tar.bz2 --strip-components=1 \ + && cmake -S . -B build -G Ninja \ + -DCMAKE_BUILD_TYPE=Release \ + -DCMAKE_INSTALL_PREFIX=/opt/trafficserver \ + -DWITH_USER=trafficserver -DWITH_GROUP=trafficserver \ + -DBUILD_REGRESSION_TESTING=OFF -DBUILD_TESTING=OFF \ + && cmake --build build --parallel "${ATS_BUILD_JOBS}" \ + && DESTDIR=/opt/ats-install cmake --install build + FROM --platform=linux/amd64 ubuntu:rolling LABEL maintainer="Mark Nottingham " @@ -9,7 +35,7 @@ RUN apt-get update \ nodejs npm git openssh-client telnet \ squid \ nginx \ - trafficserver \ + libcap2 libpcre2-8-0 libssl3t64 zlib1g \ apache2 \ varnish \ golang \ @@ -20,7 +46,9 @@ RUN apt-get update \ # squid -COPY squid/squid.conf /etc/squid/conf.d/cache-test.conf +# Use the test configuration directly. Ubuntu's default access rules run before +# conf.d and reject the link-local origin address used by rootless Podman. +COPY squid/squid.conf /etc/squid/squid.conf ENV SQUID_CACHE_DIR=/var/spool/squid ENV SQUID_LOG_DIR=/var/log/squid @@ -37,12 +65,16 @@ EXPOSE 8002 # trafficserver -COPY trafficserver/ip_allow.config /etc/trafficserver/ip_allow.config -COPY trafficserver/records.config /etc/trafficserver/records.config -COPY trafficserver/remap.config /etc/trafficserver/remap.config +COPY --from=trafficserver-build /opt/ats-install/opt/trafficserver/ /opt/trafficserver/ +RUN groupadd --system trafficserver \ + && useradd --system --gid trafficserver --home-dir /opt/trafficserver/var/trafficserver \ + --shell /usr/sbin/nologin trafficserver +COPY trafficserver/ip_allow.yaml /opt/trafficserver/etc/trafficserver/ip_allow.yaml +COPY trafficserver/records.yaml /opt/trafficserver/etc/trafficserver/records.yaml +COPY trafficserver/remap.config /opt/trafficserver/etc/trafficserver/remap.config -ENV TS_CACHE_DIR=/var/run/trafficserver -ENV TS_LOG_DIR=/var/log/trafficserver +ENV TS_CACHE_DIR=/opt/trafficserver/var/trafficserver +ENV TS_LOG_DIR=/opt/trafficserver/var/log/trafficserver ENV TS_USER=trafficserver EXPOSE 8003 diff --git a/docker/entrypoint.sh b/docker/entrypoint.sh index 4bc3abc0..e8abca90 100755 --- a/docker/entrypoint.sh +++ b/docker/entrypoint.sh @@ -5,14 +5,14 @@ if [[ ! -z $1 ]] ; then # squid - sed -i s/localhost/$1/g /etc/squid/conf.d/cache-test.conf + sed -i s/localhost/$1/g /etc/squid/squid.conf # nginx sed -i s/localhost/$1/g /etc/nginx/sites-enabled/cache-test.conf sed -i s/worker_connections 768/worker_connections 2048/ /etc/nginx/nginx.conf # trafficserver - sed -i s/localhost:8000/$1:8000/g /etc/trafficserver/remap.config + sed -i s/localhost:8000/$1:8000/g /opt/trafficserver/etc/trafficserver/remap.config # apache sed -i s/localhost/$1/g /etc/apache2/sites-enabled/cache-test.conf diff --git a/docker/serve.sh b/docker/serve.sh index 265e29ee..46164f27 100755 --- a/docker/serve.sh +++ b/docker/serve.sh @@ -7,7 +7,7 @@ echo "* Starting nginx" /usr/sbin/nginx -g "daemon off;" & echo "* starting TrafficServer" -/usr/bin/traffic_manager & +/opt/trafficserver/bin/traffic_server & echo "* Starting Apache" source /etc/apache2/envvars diff --git a/docker/trafficserver/ip_allow.config b/docker/trafficserver/ip_allow.config deleted file mode 100644 index 7c6c93ab..00000000 --- a/docker/trafficserver/ip_allow.config +++ /dev/null @@ -1 +0,0 @@ -src_ip=0.0.0.0-255.255.255.255 action=ip_allow diff --git a/docker/trafficserver/ip_allow.yaml b/docker/trafficserver/ip_allow.yaml new file mode 100644 index 00000000..b4f5d138 --- /dev/null +++ b/docker/trafficserver/ip_allow.yaml @@ -0,0 +1,10 @@ +# Allow the test harness to exercise every HTTP method through the reverse proxy. +ip_allow: + - apply: in + ip_addrs: 0/0 + action: allow + methods: ALL + - apply: in + ip_addrs: ::/0 + action: allow + methods: ALL diff --git a/docker/trafficserver/records.config b/docker/trafficserver/records.config deleted file mode 100644 index 1e9bca06..00000000 --- a/docker/trafficserver/records.config +++ /dev/null @@ -1,181 +0,0 @@ -############################################################################## -# *NOTE*: All options covered in this file should be documented in the docs: -# -# https://docs.trafficserver.apache.org/records.config -############################################################################## - -############################################################################## -# Thread configurations. Docs: -# https://docs.trafficserver.apache.org/records.config#thread-variables -############################################################################## -CONFIG proxy.config.exec_thread.autoconfig INT 1 -CONFIG proxy.config.exec_thread.autoconfig.scale FLOAT 1.5 -CONFIG proxy.config.exec_thread.limit INT 2 -CONFIG proxy.config.accept_threads INT 1 -CONFIG proxy.config.task_threads INT 2 -CONFIG proxy.config.cache.threads_per_disk INT 8 -CONFIG proxy.config.exec_thread.affinity INT 1 - -############################################################################## -# Specify server addresses and ports to bind for HTTP and HTTPS. Docs: -# https://docs.trafficserver.apache.org/records.config#proxy.config.http.server_ports -############################################################################## -CONFIG proxy.config.http.server_ports STRING 8003 - -############################################################################## -# Via: headers. Docs: -# https://docs.trafficserver.apache.org/records.config#proxy-config-http-insert-response-via-str -############################################################################## -CONFIG proxy.config.http.insert_request_via_str INT 1 -CONFIG proxy.config.http.insert_response_via_str INT 0 - -############################################################################## -# Parent proxy configuration, in addition to these settings also see parent.config. Docs: -# https://docs.trafficserver.apache.org/records.config#parent-proxy-configuration -# https://docs.trafficserver.apache.org/en/latest/admin-guide/files/parent.config.en.html -############################################################################## -CONFIG proxy.config.http.parent_proxy_routing_enable INT 0 -CONFIG proxy.config.http.parent_proxy.retry_time INT 300 -CONFIG proxy.config.http.parent_proxy.connect_attempts_timeout INT 30 -CONFIG proxy.config.http.forward.proxy_auth_to_parent INT 0 -CONFIG proxy.config.http.uncacheable_requests_bypass_parent INT 1 - -############################################################################## -# HTTP connection timeouts (secs). Docs: -# https://docs.trafficserver.apache.org/records.config#http-connection-timeouts -############################################################################## -CONFIG proxy.config.http.keep_alive_no_activity_timeout_in INT 120 -CONFIG proxy.config.http.keep_alive_no_activity_timeout_out INT 120 -CONFIG proxy.config.http.transaction_no_activity_timeout_in INT 30 -CONFIG proxy.config.http.transaction_no_activity_timeout_out INT 30 -CONFIG proxy.config.http.transaction_active_timeout_in INT 900 -CONFIG proxy.config.http.transaction_active_timeout_out INT 0 -CONFIG proxy.config.http.accept_no_activity_timeout INT 120 -CONFIG proxy.config.net.default_inactivity_timeout INT 86400 - -############################################################################## -# Origin server connect attempts. Docs: -# https://docs.trafficserver.apache.org/records.config#origin-server-connect-attempts -############################################################################## -CONFIG proxy.config.http.connect_attempts_max_retries INT 3 -CONFIG proxy.config.http.connect_attempts_max_retries_dead_server INT 1 -CONFIG proxy.config.http.connect_attempts_rr_retries INT 3 -CONFIG proxy.config.http.connect_attempts_timeout INT 30 -CONFIG proxy.config.http.post_connect_attempts_timeout INT 1800 -CONFIG proxy.config.http.down_server.cache_time INT 60 -CONFIG proxy.config.http.down_server.abort_threshold INT 10 - -############################################################################## -# Negative response caching, for redirects and errors. Docs: -# https://docs.trafficserver.apache.org/records.config#negative-response-caching -############################################################################## -CONFIG proxy.config.http.negative_caching_enabled INT 0 -CONFIG proxy.config.http.negative_caching_lifetime INT 1800 - -############################################################################## -# Proxy users variables. Docs: -# https://docs.trafficserver.apache.org/records.config#proxy-user-variables -############################################################################## -CONFIG proxy.config.http.insert_client_ip INT 1 -CONFIG proxy.config.http.insert_squid_x_forwarded_for INT 1 - -############################################################################## -# Security. Docs: -# https://docs.trafficserver.apache.org/records.config#security -############################################################################## -CONFIG proxy.config.http.push_method_enabled INT 0 - -############################################################################## -# Enable / disable HTTP caching. Useful for testing, but also as an -# overridable (per remap) config -############################################################################## -CONFIG proxy.config.http.cache.http INT 1 - -############################################################################## -# Cache control. Docs: -# https://docs.trafficserver.apache.org/records.config#cache-control -# https://docs.trafficserver.apache.org/en/latest/admin-guide/files/cache.config.en.html -############################################################################## -CONFIG proxy.config.http.cache.ignore_client_cc_max_age INT 1 -CONFIG proxy.config.http.normalize_ae INT 1 -CONFIG proxy.config.http.cache.cache_responses_to_cookies INT 1 -CONFIG proxy.config.http.cache.cache_urls_that_look_dynamic INT 1 - # https://docs.trafficserver.apache.org/records.config#proxy-config-http-cache-when-to-revalidate -CONFIG proxy.config.http.cache.when_to_revalidate INT 0 - # https://docs.trafficserver.apache.org/records.config#proxy-config-http-cache-required-headers -CONFIG proxy.config.http.cache.required_headers INT 2 - -############################################################################## -# Heuristic cache expiration. Docs: -# https://docs.trafficserver.apache.org/records.config#heuristic-expiration -############################################################################## -CONFIG proxy.config.http.cache.heuristic_min_lifetime INT 3600 -CONFIG proxy.config.http.cache.heuristic_max_lifetime INT 86400 -CONFIG proxy.config.http.cache.heuristic_lm_factor FLOAT 0.10 - -############################################################################## -# Network. Docs: -# https://docs.trafficserver.apache.org/records.config#network -############################################################################## -CONFIG proxy.config.net.connections_throttle INT 30000 -CONFIG proxy.config.net.max_connections_in INT 30000 -CONFIG proxy.config.net.max_connections_active_in INT 10000 - -############################################################################## -# RAM and disk cache configurations. Docs: -# https://docs.trafficserver.apache.org/records.config#ram-cache -# https://docs.trafficserver.apache.org/en/latest/admin-guide/files/storage.config.en.html -############################################################################## -CONFIG proxy.config.cache.ram_cache.size INT -1 -CONFIG proxy.config.cache.ram_cache_cutoff INT 4194304 - # https://docs.trafficserver.apache.org/records.config#proxy-config-cache-limits-http-max-alts -CONFIG proxy.config.cache.limits.http.max_alts INT 5 - # https://docs.trafficserver.apache.org/records.config#proxy-config-cache-max-doc-size -CONFIG proxy.config.cache.max_doc_size INT 0 -CONFIG proxy.config.cache.min_average_object_size INT 8000 - -############################################################################## -# Logging Config. Docs: -# https://docs.trafficserver.apache.org/records.config#logging-configuration -# https://docs.trafficserver.apache.org/en/latest/admin-guide/files/logging.yaml.en.html -############################################################################## -CONFIG proxy.config.log.logging_enabled INT 3 -CONFIG proxy.config.log.max_space_mb_for_logs INT 25000 -CONFIG proxy.config.log.max_space_mb_headroom INT 1000 -CONFIG proxy.config.log.rolling_enabled INT 1 -CONFIG proxy.config.log.rolling_interval_sec INT 86400 -CONFIG proxy.config.log.rolling_size_mb INT 10 -CONFIG proxy.config.log.auto_delete_rolled_files INT 1 -CONFIG proxy.config.log.periodic_tasks_interval INT 5 - -############################################################################## -# These settings control remapping, and if the proxy allows (open) forward proxy or not. Docs: -# https://docs.trafficserver.apache.org/records.config#url-remap-rules -# https://docs.trafficserver.apache.org/en/latest/admin-guide/files/remap.config.en.html -############################################################################## -CONFIG proxy.config.url_remap.remap_required INT 1 - # https://docs.trafficserver.apache.org/records.config#proxy-config-url-remap-pristine-host-hdr -CONFIG proxy.config.url_remap.pristine_host_hdr INT 1 - # https://docs.trafficserver.apache.org/records.config#reverse-proxy -CONFIG proxy.config.reverse_proxy.enabled INT 1 - -############################################################################## -# SSL Termination. Docs: -# https://docs.trafficserver.apache.org/records.config#client-related-configuration -# https://docs.trafficserver.apache.org/en/latest/admin-guide/files/ssl_multicert.config.en.html -############################################################################## -CONFIG proxy.config.ssl.client.verify.server INT 0 -CONFIG proxy.config.ssl.client.CA.cert.filename STRING NULL -CONFIG proxy.config.ssl.server.cipher_suite STRING ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-DSS-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-DSS-AES256-SHA:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA - -############################################################################## -# Debugging. Docs: -# https://docs.trafficserver.apache.org/records.config#diagnostic-logging-configuration -############################################################################## -CONFIG proxy.config.diags.debug.enabled INT 0 -CONFIG proxy.config.diags.debug.tags STRING http|dns -# ToDo: Undocumented -CONFIG proxy.config.dump_mem_info_frequency INT 0 -CONFIG proxy.config.http.slow.log.threshold INT 0 - -CONFIG proxy.config.admin.user_id STRING trafficserver diff --git a/docker/trafficserver/records.yaml b/docker/trafficserver/records.yaml new file mode 100644 index 00000000..a164796d --- /dev/null +++ b/docker/trafficserver/records.yaml @@ -0,0 +1,97 @@ +# ATS 10 configuration; retain the test settings from records.config. +# Container runtimes put host.docker.internal in /etc/hosts, not DNS. +records: + exec_thread: + autoconfig: + enabled: 1 + scale: 1.5 + limit: 2 + affinity: 1 + accept_threads: 1 + task_threads: 2 + cache: + threads_per_disk: 8 + ram_cache: + size: -1 + ram_cache_cutoff: 4194304 + limits: + http: + max_alts: 5 + max_doc_size: 0 + min_average_object_size: 8000 + http: + server_ports: "8003" + insert_request_via_str: 1 + insert_response_via_str: 0 + parent_proxy: + retry_time: 300 + forward: + proxy_auth_to_parent: 0 + uncacheable_requests_bypass_parent: 1 + keep_alive_no_activity_timeout_in: 120 + keep_alive_no_activity_timeout_out: 120 + transaction_no_activity_timeout_in: 30 + transaction_no_activity_timeout_out: 30 + transaction_active_timeout_in: 900 + transaction_active_timeout_out: 0 + accept_no_activity_timeout: 120 + connect_attempts_max_retries: 3 + connect_attempts_max_retries_suspect_server: 1 + connect_attempts_rr_retries: 3 + connect_attempts_timeout: 30 + down_server: + cache_time: 60 + negative_caching_enabled: 0 + negative_caching_lifetime: 1800 + insert_client_ip: 1 + insert_squid_x_forwarded_for: 1 + push_method_enabled: 0 + cache: + http: 1 + ignore_client_cc_max_age: 1 + cache_responses_to_cookies: 1 + cache_urls_that_look_dynamic: 1 + when_to_revalidate: 0 + required_headers: 2 + heuristic_min_lifetime: 3600 + heuristic_max_lifetime: 86400 + heuristic_lm_factor: 0.1 + normalize_ae: 1 + slow: + log: + threshold: 0 + hostdb: + host_file: + path: "/etc/hosts" + net: + default_inactivity_timeout: 86400 + connections_throttle: 30000 + max_connections_in: 30000 + log: + logging_enabled: 3 + max_space_mb_for_logs: 25000 + max_space_mb_headroom: 1000 + rolling_enabled: 1 + rolling_interval_sec: 86400 + rolling_size_mb: 10 + auto_delete_rolled_files: 1 + periodic_tasks_interval: 5 + url_remap: + remap_required: 1 + pristine_host_hdr: 1 + reverse_proxy: + enabled: 1 + ssl: + client: + CA: + cert: + filename: null + server: + cipher_suite: "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-DSS-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-DSS-AES256-SHA:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA" + diags: + debug: + enabled: 0 + tags: "http|dns" + dump_mem_info_frequency: 0 + admin: + user_id: "trafficserver" diff --git a/test-docker.sh b/test-docker.sh index c4cd3863..36bdc1c9 100755 --- a/test-docker.sh +++ b/test-docker.sh @@ -84,7 +84,11 @@ function test_proxy { ;; esac - echo "* ${PKG} $(docker container exec tmp_proxies /usr/bin/apt-cache show ${PKG} | grep Version)" + if [[ ${PKG} == trafficserver ]]; then + docker container exec tmp_proxies /opt/trafficserver/bin/traffic_server --version + else + echo "* ${PKG} $(docker container exec tmp_proxies /usr/bin/apt-cache show ${PKG} | grep Version)" + fi if [[ -z "${TEST_ID}" ]]; then npm run --silent cli --base=http://localhost:${PROXY_PORT} > "results/${PROXY}.json" From e7e1a5980df83879ba9e0287335988abffb0b486 Mon Sep 17 00:00:00 2001 From: Daniel Fox Franke Date: Tue, 13 Oct 2026 10:03:14 -0400 Subject: [PATCH 2/2] fixup! Fix Docker build to support current Ubuntu --- docker/Dockerfile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docker/Dockerfile b/docker/Dockerfile index 34fb5792..b00b6d72 100644 --- a/docker/Dockerfile +++ b/docker/Dockerfile @@ -1,4 +1,4 @@ -FROM --platform=linux/amd64 ubuntu:rolling AS trafficserver-build +FROM ubuntu:rolling AS trafficserver-build # Rolling Ubuntu no longer packages ATS. Build a verified upstream release in a # separate stage so its compiler and development dependencies stay out of the image. @@ -24,7 +24,7 @@ RUN curl -fL --retry 3 "https://archive.apache.org/dist/trafficserver/trafficser && cmake --build build --parallel "${ATS_BUILD_JOBS}" \ && DESTDIR=/opt/ats-install cmake --install build -FROM --platform=linux/amd64 ubuntu:rolling +FROM ubuntu:rolling LABEL maintainer="Mark Nottingham "