clearml-server
clearml-server copied to clipboard
nginx proxy forward Host header config is wrong
When running the official clearml docker image with the webserver
argument then an nginx
instance is spun up. The proxy config rewrites /api
paths to forward to the apiserver
instance. As part of that it sets the proxy forward Host
header to $host
which is incorrect because $host
refers to the original Host
header or original server name (http://nginx.org/en/docs/http/ngx_http_core_module.html#var_host). Instead the variable $proxy_host
should be used.
Why is this important: We have ClearML deployed as an Azure Container App and the ingress controller will see a request that goes to the IP of the apiserver
container but with a Host
header of the webserver
and will deny access with a 403.
Setting the header like this instead: proxy_set_header Host $proxy_host;
solves this problem.
I suspect that this wasn't noticed until now because in a docker-compose environment there is no ingress controller that performs sanity checking and the apiserver
doesn't care about the Host
header either.