Skip to content

fix: strip IPv6 http_port listeners when IPv6 is disabled in Squid container #2203

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
lpcox merged 2 commits into from
Apr 25, 2026
Merged

fix: strip IPv6 http_port listeners when IPv6 is disabled in Squid container #2203

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
6fd9372
Initial plan
Copilot Apr 24, 2026
c819438
fix: strip IPv6 http_port listeners when IPv6 is disabled in Squid co…
Copilot Apr 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 13 additions & 0 deletions containers/squid/entrypoint.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,5 +9,18 @@ if [ -d "/var/spool/squid_ssl_db" ]; then
echo "[squid-entrypoint] SSL Bump mode detected - SSL database ready"
fi

# Check if IPv6 is available in this container namespace.
# On Docker daemons with `ipv6: false` (the default on most Linux distros), the kernel
# sets net.ipv6.conf.all.disable_ipv6=1 inside every container network namespace.
# Squid treats `http_port [::]:3128` as a FATAL error when IPv6 is unavailable, aborting
# before opening log files and causing the container to exit(1) immediately.
# If IPv6 is disabled we strip the dual-stack listener lines so Squid can start normally.
# The defense-in-depth intent is preserved on runners that do have IPv6 enabled.
IPV6_DISABLED="$(cat /proc/sys/net/ipv6/conf/all/disable_ipv6 2>/dev/null || echo 1)"
if [ "$IPV6_DISABLED" = "1" ]; then
echo "[squid-entrypoint] IPv6 is disabled in this namespace - removing http_port [::]: listeners to prevent fatal startup error"
sed -i '/^http_port \[::\]:/d' /etc/squid/squid.conf

Copilot AI Apr 24, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The sed deletion only removes a single http_port [::]:... line. In SSL Bump mode, the generated squid.conf has an IPv6 http_port [::]:3128 ssl-bump \\ line followed by indented continuation lines (cert=..., key=..., etc.); deleting just the http_port line would leave those continuation lines behind and break config parsing. Also, the SSL-bump http_port [::]:... line in the generated config is prefixed by whitespace, so the current ^http_port anchor likely won’t match and won’t prevent the original fatal error. Update the removal logic to (1) match optional leading whitespace and (2) remove the entire multi-line stanza for IPv6 http_port directives (the header line plus its continuation lines).

Suggested change
sed -i '/^http_port \[::\]:/d' /etc/squid/squid.conf
tmp_conf="$(mktemp)"
awk '
skip && /^[[:space:]]+/ { next }
skip { skip = 0 }
/^[[:space:]]*http_port \[::\]:/ { skip = 1; next }
{ print }
' /etc/squid/squid.conf > "$tmp_conf"
mv "$tmp_conf" /etc/squid/squid.conf

Copilot uses AI. Check for mistakes.
fi

# Start Squid directly (already running as proxy user via Dockerfile USER directive)
exec squid -N -d 1
Loading