This article does not have a corresponding language version

Server Operations Tips: SSH Tunnels and Docker Network Configuration

This post records how to temporarily use a local proxy through an SSH reverse tunnel when maintaining a remote Linux server, for code downloads, dependency installation, and Docker image pulls.

The examples use the forwarded port 127.0.0.1:7890 on the server, configure network proxies separately for the shell and Docker daemon, and remove the temporary settings when the task is complete.

I. Preparing Your Local Computer or Cloud Server (Clash/Password-Protected SSH Allowed)

Open the Clash interface.

  1. Write down the port : Verify that the Mixed Port is set to 7890 (default).
  2. Check the server’s SSH configuration : If you have never connected before, please make sure /etc/ssh/sshd_config Password login is allowed in China (PasswordAuthentication yes), otherwise the tunnel may not be established.

II. Establishing a Tunnel (Execute on the Local Terminal)

Open Windows PowerShell (or CMD) and run the following command to establish a connection. Note: Do not close this window; closing it will disconnect you from the Internet.

ssh -N -R 远程端口:本地IP:本地端口 用户名@服务器IP
  • If you encounter Permission denied, please check your username and password, and verify that the SSH configuration described above has been loaded (service ssh restart)。
  • Sign of Success: After entering the password and pressing Enter, the cursor freezes and does not move, and no error message appears.

III. Server-Side Configuration (Execute on the server terminal)

Scenario A: Everyday Downloads (curl, wget, git, Python pip)

This setting is temporary and will be reset when you close the window. You’ll need to re-enter it each time you log in.

Method 1: Manual Configuration

export http_proxy=http://127.0.0.1:7890
export https_proxy=http://127.0.0.1:7890

You can write the configuration above into a .sh file in a directory you can remember, so you can load and use it directly (for example, ~/ops-scripts/ ）：

  • Enable Proxy: source ~/ops-scripts/proxy_on.sh
  • Turn Off Proxy: source ~/ops-scripts/proxy_off.sh

Verification command:

curl -I https://www.google.com

(Should return 200 OK)

Docker requires additional configuration for the following reasons: Shell’s environment variable proxy (export ...) Does not apply to the Docker daemon process , which prevents the image from being pulled.

Scenario B: Docker Image Acceleration

We recommend using Alibaba Cloud’s official mirror acceleration service (which is more reliable than using an SSH proxy).

  1. Log in to Alibaba Cloud to get your exclusive acceleration address: Alibaba Cloud Container Image Service Console (Get similar https://xxxx.mirror.aliyuncs.com (the address)

  2. Modify the configuration file: Configuration file path:/etc/docker/daemon.json

{
  "registry-mirrors": ["https://xxxx.mirror.aliyuncs.com"]
}

Scenario C: Docker Using an SSH Proxy (Advanced: Pulling Images Through an SSH Tunnel)

Use this when an Alibaba Cloud image is unavailable and you need to temporarily pull a Docker image via an SSH tunnel (127.0.0.1:7890).

1. Principle: Why don’t shell proxies work with Docker?

  • Shell (Terminal)：export http_proxy I just set up a proxy for the front-end terminal,curl / wget Valid.
  • Docker Daemon (Running in the Background) : Pulling images is a background service dockerd When it’s running, it can’t access the terminal’s environment variables, so you have to configure them separately.

2. Configuration Steps (Enabling the Proxy)

Step 1: Create the configuration directory

sudo mkdir -p /etc/systemd/system/docker.service.d

Step 2: Enter the proxy settings

sudo tee /etc/systemd/system/docker.service.d/http-proxy.conf <<-'EOF'
[Service]
Environment="HTTP_PROXY=http://127.0.0.1:7890"
Environment="HTTPS_PROXY=http://127.0.0.1:7890"
Environment="NO_PROXY=localhost,127.0.0.1,.aliyuncs.com"
EOF

Note：NO_PROXY To prevent Docker from taking a detour when accessing local or Alibaba Cloud images.

Step 3: Reload the configuration and restart Docker

sudo systemctl daemon-reload
sudo systemctl restart docker

Step 4: Verification

sudo docker info | grep Proxy
# 应输出：
# HTTP Proxy: http://127.0.0.1:7890
# HTTPS Proxy: http://127.0.0.1:7890

Once verification is complete, the process can proceed as normal. sudo docker pull。

Note 🚨：

  1. As long as this file is configured, Docker will always rely on the SSH proxy on your local computer. . If you close the local SSH tunnel or shut down your computer, Docker will return a “Timeout” error when pulling images.
  2. Permissions Issues : The Docker daemon has high privileges, so regular users may encounter issues when executing commands Permission Denied, please add sudo。
  3. Therefore, you need to clean up after the download is complete. ↓↓↓

3. Cleanup Steps (Disable the proxy—we recommend deleting it after use)

Once the download is complete, we recommend clearing the configuration so that Docker can be restored to its default state.

# 1. 删除配置文件
sudo rm -f /etc/systemd/system/docker.service.d/http-proxy.conf

# 2. 重载配置
sudo systemctl daemon-reload

# 3. 重启 Docker
sudo systemctl restart docker

Verification: Run again sudo docker info | grep Proxy, there should be no output.