Bug 2178953

Summary: RHEL9-UBI based Squid container
Product: Red Hat Enterprise Linux 9 Reporter: Apurbita Mukherjee <apmukher>
Component: squid-containerAssignee: Tomas Korbar <tkorbar>
Status: MODIFIED --- QA Contact: Petr Sklenar <psklenar>
Severity: medium Docs Contact: Lenka Špačková <lkuprova>
Priority: medium    
Version: 9.1CC: jorton, lkuprova, luhliari, pkubat, psklenar, riehecky
Target Milestone: rcKeywords: FutureFeature, RFE, Triaged
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: squid-container-5.5-4 Doc Type: Enhancement
Doc Text:
Squid container image is now accessible for Red Hat customers. Please refer to the documentation as to how to configure and use it.
Story Points: ---
Clone Of: Environment:
Last Closed: Type: Story
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Deadline: 2023-06-12   
Attachments:
Description Flags
Dockerfile
none
Dockerfile none

Description Apurbita Mukherjee 2023-03-16 09:31:52 UTC
Description of problem:
Business Case:
HTTP caching and HTTPS proxy work is becoming increasingly helpful with the abundance of private networks in containerized spaces.  It turns out there isn't a well maintained community container for Squid proxy.

Quick benefits:
* cache container images locally
* quickly deploy a SOCKS proxy to allow strong Kubernetes NetworkPolicies on egress
* quickly deploy a SOCKS proxy to debug network issues internal to Kubernetes

Technical requirements:
A UBI9+ container with squid proxy installed and ready to configure

Comment 2 Joe Orton 2023-03-17 15:56:36 UTC
Thanks for the request, we are looking into providing this.

Pat, to help us understand the requirements properly - is this something you expect to use/integrate with OpenShift, or more of a standalone container?

Comment 3 Pat Riehecky 2023-03-17 15:59:11 UTC
My primary goal is to drop it into some type of kubernetes.  Not necessarily OpenShift, but I do have a small openshift I might play with it in.

I'm not super interested in running it as a stand alone container, but it might be handy for some folks.

Comment 4 Tomas Korbar 2023-03-29 11:03:23 UTC
Hi Pat,
I will be working on this. I will prepare testing version of container
and then will contact you whether the testing version suits your needs.

Thanks for your cooperation.

Comment 5 Tomas Korbar 2023-04-02 08:37:49 UTC
Hi Pat,
i created initial version of container and i would like you to
verify that it suits your needs. You can get the image by executing:
$ podman pull quay.io/tkorbar/squid_testing

I will attach the Dockerfile so you can see all aspects of the image.

Image has exposed ports 3128 and 3130.
3128 port provides cache service and 3130 is reserved for ICP communication
between cache servers should you decide to enable it.
Thus you can start the container with podman run -d --name squid -p 3128:3128 tkorbar/squid_testing

Should you decide to overwrite configuration then simply mount volume to /etc/squid and provide
your own configuration files.

Looking forward to your response.

Comment 6 Tomas Korbar 2023-04-02 08:38:47 UTC
Created attachment 1955244 [details]
Dockerfile

Comment 7 Pat Riehecky 2023-04-03 14:53:36 UTC
My local tests show this works the way I'd want it to.  I'd say this is just about perfect for me.

You may want to s/master/primary/ in the Dockerfile.

Comment 8 Tomas Korbar 2023-04-05 14:47:03 UTC
Hi Pat,
Thanks for your review. I am glad that this fulfills your expectation.
Will inform you about the progress that we will make.

Comment 9 Tomas Korbar 2023-04-06 13:19:40 UTC
Created attachment 1956081 [details]
Dockerfile

Final version of dockerfile.

Comment 10 Tomas Korbar 2023-04-06 13:28:05 UTC
Hi Pat,
I am sorry to disturb you again but along the way, i found 2 more improvements
that could be done and i wanted to implement them.
So there are 2 new features:
1. Container is now able to receive additional command line parameters that
   will be supplied to the squid process. For example:
   $ podman run -p 3128:3128 quay.io/tkorbar/squid_testing -u 0

2. Container will now build cache directory if configuration demands so.
   (cache_dir ufs /run/squid/cachedir 100 16 256)
   With this configuration squid would require the cachedir to exist and
   you would have to mount some storage there or rebuild the image.
   Now it is no longer necessary.

As before you can get the container with:
$ podman pull quay.io/tkorbar/squid_testing

I would really appreciate if you could verify that these changes did not
disturb your usecase.

Looking forward to your response.

Comment 11 Pat Riehecky 2023-04-06 13:37:39 UTC
This works great for me!

Comment 14 Petr Sklenar 2023-05-02 19:47:29 UTC
(In reply to Pat Riehecky from comment #7)
> My local tests show this works the way I'd want it to.  I'd say this is just
> about perfect for me.
> 
> You may want to s/master/primary/ in the Dockerfile.

Hello,
is it possible to share your local test with us ?  - if it's suitable for upstreaming.
I would add into the upstream testsuite for squid https://src.fedoraproject.org/tests/squid

Comment 15 Pat Riehecky 2023-05-03 13:28:06 UTC
For testing I just mounted my production squid config into the container and made sure it routed traffic.  I'm not sure how I'd clean it up for public consumption.

Comment 17 Pat Riehecky 2023-06-12 13:34:44 UTC
Is https://catalog.redhat.com/software/containers/search?q=squid&p=1 supposed to return results?

Comment 18 Tomas Korbar 2023-06-12 13:48:34 UTC
(In reply to Pat Riehecky from comment #17)
> Is https://catalog.redhat.com/software/containers/search?q=squid&p=1
> supposed to return results?

Hi Pat,
It is not. Squid container is planned for release of RHEL 9.3