RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 2178953 - RHEL9-UBI based Squid container
Summary: RHEL9-UBI based Squid container
Keywords:
Status: CLOSED ERRATA
Alias: None
Deadline: 2023-06-12
Product: Red Hat Enterprise Linux 9
Classification: Red Hat
Component: squid-container
Version: 9.1
Hardware: Unspecified
OS: Unspecified
medium
medium
Target Milestone: rc
: ---
Assignee: Tomas Korbar
QA Contact: Petr Sklenar
Lenka Špačková
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2023-03-16 09:31 UTC by Apurbita Mukherjee
Modified: 2023-11-07 11:59 UTC (History)
7 users (show)

Fixed In Version: squid-container-5.5-10
Doc Type: Enhancement
Doc Text:
.A new `rhel9/squid` container image The `rhel9/squid` container image is now available in the Red Hat Container Registry. `Squid` is a high-performance proxy caching server for web clients, supporting FTP, gopher, and HTTP data objects. Unlike traditional caching software, `Squid` handles all requests in a single, non-blocking, I/O-driven process. `Squid` keeps metadata and especially hot objects cached in RAM, caches DNS lookups, supports non-blocking DNS lookups, and implements negative caching of failed requests. To pull the new container image, run: ---- # podman pull registry.redhat.io/rhel9/squid ----
Clone Of:
Environment:
Last Closed: 2023-11-07 11:19:30 UTC
Type: Story
Target Upstream Version:
Embargoed:
pm-rhel: mirror+


Attachments (Terms of Use)
Dockerfile (1.47 KB, text/plain)
2023-04-02 08:38 UTC, Tomas Korbar
no flags Details
Dockerfile (1.53 KB, text/plain)
2023-04-06 13:19 UTC, Tomas Korbar
no flags Details


Links
System ID Private Priority Status Summary Last Updated
Red Hat Issue Tracker RHELPLAN-152031 0 None None None 2023-03-16 09:33:03 UTC
Red Hat Product Errata RHEA-2023:6754 0 None None None 2023-11-07 11:19:34 UTC

Description Apurbita Mukherjee 2023-03-16 09:31:52 UTC
Description of problem:
Business Case:
HTTP caching and HTTPS proxy work is becoming increasingly helpful with the abundance of private networks in containerized spaces.  It turns out there isn't a well maintained community container for Squid proxy.

Quick benefits:
* cache container images locally
* quickly deploy a SOCKS proxy to allow strong Kubernetes NetworkPolicies on egress
* quickly deploy a SOCKS proxy to debug network issues internal to Kubernetes

Technical requirements:
A UBI9+ container with squid proxy installed and ready to configure

Comment 2 Joe Orton 2023-03-17 15:56:36 UTC
Thanks for the request, we are looking into providing this.

Pat, to help us understand the requirements properly - is this something you expect to use/integrate with OpenShift, or more of a standalone container?

Comment 3 Pat Riehecky 2023-03-17 15:59:11 UTC
My primary goal is to drop it into some type of kubernetes.  Not necessarily OpenShift, but I do have a small openshift I might play with it in.

I'm not super interested in running it as a stand alone container, but it might be handy for some folks.

Comment 4 Tomas Korbar 2023-03-29 11:03:23 UTC
Hi Pat,
I will be working on this. I will prepare testing version of container
and then will contact you whether the testing version suits your needs.

Thanks for your cooperation.

Comment 5 Tomas Korbar 2023-04-02 08:37:49 UTC
Hi Pat,
i created initial version of container and i would like you to
verify that it suits your needs. You can get the image by executing:
$ podman pull quay.io/tkorbar/squid_testing

I will attach the Dockerfile so you can see all aspects of the image.

Image has exposed ports 3128 and 3130.
3128 port provides cache service and 3130 is reserved for ICP communication
between cache servers should you decide to enable it.
Thus you can start the container with podman run -d --name squid -p 3128:3128 tkorbar/squid_testing

Should you decide to overwrite configuration then simply mount volume to /etc/squid and provide
your own configuration files.

Looking forward to your response.

Comment 6 Tomas Korbar 2023-04-02 08:38:47 UTC
Created attachment 1955244 [details]
Dockerfile

Comment 7 Pat Riehecky 2023-04-03 14:53:36 UTC
My local tests show this works the way I'd want it to.  I'd say this is just about perfect for me.

You may want to s/master/primary/ in the Dockerfile.

Comment 8 Tomas Korbar 2023-04-05 14:47:03 UTC
Hi Pat,
Thanks for your review. I am glad that this fulfills your expectation.
Will inform you about the progress that we will make.

Comment 9 Tomas Korbar 2023-04-06 13:19:40 UTC
Created attachment 1956081 [details]
Dockerfile

Final version of dockerfile.

Comment 10 Tomas Korbar 2023-04-06 13:28:05 UTC
Hi Pat,
I am sorry to disturb you again but along the way, i found 2 more improvements
that could be done and i wanted to implement them.
So there are 2 new features:
1. Container is now able to receive additional command line parameters that
   will be supplied to the squid process. For example:
   $ podman run -p 3128:3128 quay.io/tkorbar/squid_testing -u 0

2. Container will now build cache directory if configuration demands so.
   (cache_dir ufs /run/squid/cachedir 100 16 256)
   With this configuration squid would require the cachedir to exist and
   you would have to mount some storage there or rebuild the image.
   Now it is no longer necessary.

As before you can get the container with:
$ podman pull quay.io/tkorbar/squid_testing

I would really appreciate if you could verify that these changes did not
disturb your usecase.

Looking forward to your response.

Comment 11 Pat Riehecky 2023-04-06 13:37:39 UTC
This works great for me!

Comment 14 Petr Sklenar 2023-05-02 19:47:29 UTC
(In reply to Pat Riehecky from comment #7)
> My local tests show this works the way I'd want it to.  I'd say this is just
> about perfect for me.
> 
> You may want to s/master/primary/ in the Dockerfile.

Hello,
is it possible to share your local test with us ?  - if it's suitable for upstreaming.
I would add into the upstream testsuite for squid https://src.fedoraproject.org/tests/squid

Comment 15 Pat Riehecky 2023-05-03 13:28:06 UTC
For testing I just mounted my production squid config into the container and made sure it routed traffic.  I'm not sure how I'd clean it up for public consumption.

Comment 17 Pat Riehecky 2023-06-12 13:34:44 UTC
Is https://catalog.redhat.com/software/containers/search?q=squid&p=1 supposed to return results?

Comment 18 Tomas Korbar 2023-06-12 13:48:34 UTC
(In reply to Pat Riehecky from comment #17)
> Is https://catalog.redhat.com/software/containers/search?q=squid&p=1
> supposed to return results?

Hi Pat,
It is not. Squid container is planned for release of RHEL 9.3

Comment 51 errata-xmlrpc 2023-11-07 11:19:30 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Updated rhel9/squid container image), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHEA-2023:6754


Note You need to log in before you can comment on or make changes to this bug.