Docker: Not able to set proxy ENV variables in docker image for jenkins:2.73.1

[kirhie]

Docker commands that you execute

I have the below docker file and I run "docker build -t jenkins:2.73.1 ."

Dockerfile

FROM jenkins/jenkins:2.73.1

ENV http_proxy http://proxy.my-company-name.net:83/
ENV https_proxy http://proxy.my-company-name.net:83/
ENV JAVA_OPTS -Dhudson.footerURL=https://cm.company-name.biz/ -Djenkins.install.runSetupWizard=false

USER root
RUN echo "Europe/Stockholm" > /etc/timezone && dpkg-reconfigure -f noninteractive tzdata
USER jenkins

RUN /usr/local/bin/install-plugins.sh git

WORKDIR $JENKINS_HOME

Actual result

No plugins are installed. Plugin download fails.

Expected outcome

Plugins downloaded and installed.

Have you tried a non-dockerized Jenkins and get the expected outcome?

Yes

Output of docker version

Docker version 17.05.0-ce, build 89658be

Other relevant information

I think the issue is with setting ENV variables on the jenkins/jenkins:2.73.1 image.
The same docker file works well jenkins:2.46.3

Also, when I use actual IP Address instead of proxy urls, then aslo it works.

ENV http_proxy 10.244.0.10:83/
ENV https_proxy 10.244.0.10:83/

System info:

Linux default-ubuntu-1604

[carlossg]

logs?

[kirhie]

Hi Carlos,

Please find the logs below:

Sending build context to Docker daemon 94.21kB
Step 1/13 : FROM jenkins/jenkins:2.73.1
---> c8a24e6775ea
Step 2/13 : ENV http_proxy http://proxy.my-company-name.net:83/
---> Using cache
---> c90e238bca77
Step 3/13 : ENV https_proxy https://proxy.my-company-name.net:83/
---> Using cache
---> bb75504f2fd1
Step 4/13 : ENV JAVA_OPTS -Dhudson.footerURL=https://cm.my-company-name.biz/ -Djenkins.install.runSetupWizard=false
---> Using cache
---> d2442f68b0e9
Step 5/13 : USER root
---> Using cache
---> e36211d4e499
Step 6/13 : RUN echo "Europe/Stockholm" > /etc/timezone && dpkg-reconfigure -f noninteractive tzdata
---> Using cache
---> 6ebcf027b455
Step 7/13 : USER jenkins
---> Using cache
---> e49767ff8026
Step 8/13 : COPY conf/jenkins_home/ $JENKINS_HOME/
---> e09bd18d91a2
Removing intermediate container b5ab31aebab0
Step 9/13 : COPY conf/executors.groovy /usr/share/jenkins/ref/init.groovy.d/
---> 1fec45b8ef43
Removing intermediate container e058cf827df0
Step 10/13 : COPY conf/jenkins.install.UpgradeWizard.state /usr/share/jenkins/ref/
---> a5c3718629d8
Removing intermediate container 722fa4c2578f
Step 11/13 : COPY conf/plugins.txt /tmp/plugins.txt
---> 3b2aed3f3a24
Removing intermediate container 28b97f1fdeb2
Step 12/13 : RUN install-plugins.sh git
---> Running in 31a1a5d8547d
Creating initial locks...
Analyzing war...
Downloading plugins...
Downloading plugin: git from https://updates.jenkins.io/download/plugins/git/latest/git.hpi
Downloading plugin: git-plugin from https://updates.jenkins.io/download/plugins/git-plugin/latest/git-plugin.hpi
Failed to download plugin: git or git-plugin

WAR bundled plugins:

Installed plugins:
*:
Some plugins failed to download! Not downloaded: git
The command '/bin/sh -c install-plugins.sh git' returned a non-zero code: 1

Thank you!!

[kirhie]

Can someone please help with this issue?

[carlossg]

something is wrong with your proxy probably slow or blocked, change

RUN install-plugins.sh git

to

RUN curl -v --connect-timeout 20 --retry 5 --retry-delay 0 --retry-max-time 60 -f -L  https://updates.jenkins.io/download/plugins/git/latest/git.hpi

-o /tmp/git.hpi

and check the errors. Then increase timeouts if needed

[kirhie]

When I use proxy IP addresses instead of the urls, it does seem to work.

ENV http_proxy 10.244.0.10:83/
ENV https_proxy 10.244.0.10:83/

This works like a charm.

But I cannot use IP address for setting up my proxy and have to use the urls.

The same Dockerfile used to work with jenkins version 2.46.3 which was based on Debian 8.

[carlossg]

you will have to check your docker configuration for dns

[kirhie]

But the same docker engine with same dockerfile works well for jenkins 2.46.3.
Why would it be different for jenkins 2.73.1?

[carlossg]

maybe something changed in the base openjdk/debian official images, you should ask there

[kirhie]

To verify the same I created the below Dockerfile:

FROM openjdk:8-jdk

ENV http_proxy http://proxy.my-company-name.net:83/
ENV https_proxy http://proxy.my-company-name.net:83/

RUN apt-get -y update

And the output was as below which suggests that the proxies were set correctly and apt-get update was able to run properly.

docker build -t jdk8-based-image .

Step 1/4 : FROM openjdk:8-jdk
---> 74c95c985a85
Step 2/4 : ENV http_proxy http://proxy.my-company-name.net:83/
---> Running in 9a6cc68cc84f
---> 3f54dc8ed2ca
Removing intermediate container 9a6cc68cc84f
Step 3/4 : ENV https_proxy http://proxy.my-company-name.net:83/
---> Running in d46df9b6e52b
---> 21fa643a0c5c
Removing intermediate container d46df9b6e52b
Step 4/4 : RUN apt-get -y update
---> Running in b55022ca018d
Get:1 http://security.debian.org stretch/updates InRelease [62.9 kB]
Get:2 http://security.debian.org stretch/updates/main amd64 Packages [219 kB]
Ign:3 http://cdn-fastly.deb.debian.org/debian stretch InRelease
Get:4 http://cdn-fastly.deb.debian.org/debian stretch-updates InRelease [91.0 kB]
Get:5 http://cdn-fastly.deb.debian.org/debian stretch-updates/main amd64 Packages [5841 B]
Get:6 http://cdn-fastly.deb.debian.org/debian stretch Release [118 kB]
Get:7 http://cdn-fastly.deb.debian.org/debian stretch Release.gpg [2479 B]
Get:8 http://cdn-fastly.deb.debian.org/debian stretch/main amd64 Packages [9500 kB]
Fetched 10000 kB in 1s (5827 kB/s)
Reading package lists...
---> 62466e70cf7f
Removing intermediate container b55022ca018d
Successfully built 62466e70cf7f
Successfully tagged jdk8-based-image:latest

So there seems to be something wrong with the Jenkins image which is built on top of jdk8 image.

[carlossg]

can you paste the output of

docker pull openjdk:8-jdk
docker pull jenkins/jenkins:2.73.1
docker run -e  http_proxy=http://proxy.my-company-name.net:83/ -e https_proxy=http://proxy.my-company-name.net:83/ -ti --rm openjdk:8-jdk curl -v --connect-timeout 20 --retry 5 --retry-delay 0 --retry-max-time 60 -f -L  https://updates.jenkins.io/download/plugins/git/latest/git.hpi -o /tmp/git.hpi
docker run -e  http_proxy=http://proxy.my-company-name.net:83/ -e https_proxy=http://proxy.my-company-name.net:83/ -ti --rm jenkins/jenkins:2.73.1 curl -v --connect-timeout 20 --retry 5 --retry-delay 0 --retry-max-time 60 -f -L  https://updates.jenkins.io/download/plugins/git/latest/git.hpi -o /tmp/git.hpi

[kirhie]

Please find below logs:

docker run -e http_proxy=http://proxy.my-company-name.net:83/ -e https_proxy=http://proxy.my-company-name.net:83/ -ti --rm openjdk:8-jdk curl -v --connect-timeout 20 --retry 5 --retry-delay 0 --retry-max-time 60 -f -L https://updates.jenkins.io/download/plugins/git/latest/git.hpi -o /tmp/git.hpi

% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0* Trying 10.244.0.50...

• TCP_NODELAY set
• Connected to (nil) (10.244.0.50) port 83 (#0)
• Establish HTTP proxy tunnel to updates.jenkins.io:443

CONNECT updates.jenkins.io:443 HTTP/1.1
Host: updates.jenkins.io:443
User-Agent: curl/7.52.1
Proxy-Connection: Keep-Alive

< HTTP/1.1 200 Connection established
<

• Proxy replied OK to CONNECT request
• ALPN, offering h2
• ALPN, offering http/1.1
• Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH
• successfully set certificate verify locations:
• CAfile: /etc/ssl/certs/ca-certificates.crt
  CApath: /etc/ssl/certs
• TLSv1.2 (OUT), TLS header, Certificate Status (22):
  } [5 bytes data]
• TLSv1.2 (OUT), TLS handshake, Client hello (1):
  } [512 bytes data]
• TLSv1.2 (IN), TLS handshake, Server hello (2):
  { [98 bytes data]
• TLSv1.2 (IN), TLS handshake, Certificate (11):
  { [2478 bytes data]
• TLSv1.2 (IN), TLS handshake, Server key exchange (12):
  { [333 bytes data]
• TLSv1.2 (IN), TLS handshake, Server finished (14):
  { [4 bytes data]
• TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
  } [70 bytes data]
• TLSv1.2 (OUT), TLS change cipher, Client hello (1):
  } [1 bytes data]
• TLSv1.2 (OUT), TLS handshake, Finished (20):
  } [16 bytes data]
• TLSv1.2 (IN), TLS change cipher, Client hello (1):
  { [1 bytes data]
• TLSv1.2 (IN), TLS handshake, Finished (20):
  { [16 bytes data]
• SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384
• ALPN, server did not agree to a protocol
• Server certificate:
• subject: CN=updates.jenkins.io
• start date: Aug 5 00:55:00 2017 GMT
• expire date: Nov 3 00:55:00 2017 GMT
• subjectAltName: host "updates.jenkins.io" matched cert's "updates.jenkins.io"
• issuer: C=US; O=Let's Encrypt; CN=Let's Encrypt Authority X3
• SSL certificate verify ok.
  } [5 bytes data]
  GET /download/plugins/git/latest/git.hpi HTTP/1.1
  Host: updates.jenkins.io
  User-Agent: curl/7.52.1
  Accept: /

{ [5 bytes data]
< HTTP/1.1 302 Found
< Date: Wed, 11 Oct 2017 09:25:32 GMT
< Server: Apache/2.4.7 (Ubuntu)
< Location: http://mirrors.jenkins-ci.org/plugins/git/latest/git.hpi
< Content-Length: 240
< Content-Type: text/html; charset=iso-8859-1
<
{ [5 bytes data]

• Ignoring the response-body
  { [240 bytes data]
• Curl_http_done: called premature == 0
  100 240 100 240 0 0 546 0 --:--:-- --:--:-- --:--:-- 546
• Connection #0 to host (nil) left intact
• Issue another request to this URL: 'http://mirrors.jenkins-ci.org/plugins/git/latest/git.hpi'
• Found bundle for host mirrors.jenkins-ci.org: 0x2af8f9cfd0 [can pipeline]
• Hostname proxy.my-company-name.net was found in DNS cache
• Trying 10.244.0.50...
• TCP_NODELAY set
• Connected to (nil) (10.244.0.50) port 83 (#1)
  GET http://mirrors.jenkins-ci.org/plugins/git/latest/git.hpi HTTP/1.1
  Host: mirrors.jenkins-ci.org
  User-Agent: curl/7.52.1
  Accept: /
  Proxy-Connection: Keep-Alive

0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0< HTTP/1.1 302 Found
< Date: Wed, 11 Oct 2017 09:25:32 GMT
< Server: Apache/2.4.7 (Ubuntu)
< X-MirrorBrain-Mirror: ftp-nyc.osuosl.org
< X-MirrorBrain-Realm: other
< Link: http://mirrors.jenkins-ci.org/plugins/git/latest/git.hpi.meta4; rel=describedby; type="application/metalink4+xml"
< Link: http://ftp-nyc.osuosl.org/pub/jenkins/plugins/git/3.6.0/git.hpi; rel=duplicate; pri=1; geo=us
< Link: http://ftp-chi.osuosl.org/pub/jenkins/plugins/git/3.6.0/git.hpi; rel=duplicate; pri=2; geo=us
< Location: http://ftp-nyc.osuosl.org/pub/jenkins/plugins/git/3.6.0/git.hpi
< Content-Length: 247
< Content-Type: text/html; charset=iso-8859-1
< Proxy-Connection: Keep-Alive
< Connection: Keep-Alive
<

• Ignoring the response-body
  { [247 bytes data]
• Curl_http_done: called premature == 0
  100 247 100 247 0 0 328 0 --:--:-- --:--:-- --:--:-- 2205
• Connection #1 to host (nil) left intact
• Issue another request to this URL: 'http://ftp-nyc.osuosl.org/pub/jenkins/plugins/git/3.6.0/git.hpi'
• Found bundle for host ftp-nyc.osuosl.org: 0x2af8f9cfd0 [can pipeline]
• Re-using existing connection! (#1) with proxy (nil)
• Connected to (nil) (10.244.0.50) port 83 (#1)
  GET http://ftp-nyc.osuosl.org/pub/jenkins/plugins/git/3.6.0/git.hpi HTTP/1.1
  Host: ftp-nyc.osuosl.org
  User-Agent: curl/7.52.1
  Accept: /
  Proxy-Connection: Keep-Alive

0 0 0 0 0 0 0 0 --:--:-- 0:00:05 --:--:-- 0< HTTP/1.1 200 OK
< Date: Wed, 11 Oct 2017 09:25:38 GMT
< Server: Apache
< Last-Modified: Tue, 03 Oct 2017 00:16:16 GMT
< ETag: "175dd1-55a9966475400"
< Accept-Ranges: bytes
< Content-Length: 1531345
< Content-Type: application/vnd.hp-hpid
< Proxy-Connection: Keep-Alive
< Connection: Keep-Alive
< Age: 0
<
{ [3724 bytes data]

• Curl_http_done: called premature == 0
  100 1495k 100 1495k 0 0 232k 0 0:00:06 0:00:06 --:--:-- 320k
• Connection #1 to host (nil) left intact

docker run -e http_proxy=http://proxy.my-company-name.net:83/ -e https_proxy=http://proxy.my-company-name.net:83/ -ti --rm jenkins/jenkins:2.73.1 curl -v --connect-timeout 20 --retry 5 --retry-delay 0 --retry-max-time 60 -f -L https://updates.jenkins.io/download/plugins/git/latest/git.hpi -o /tmp/git.hpi
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0* Trying 10.244.0.55...

• TCP_NODELAY set
• Connected to (nil) (10.244.0.55) port 83 (#0)
• Establish HTTP proxy tunnel to updates.jenkins.io:443

CONNECT updates.jenkins.io:443 HTTP/1.1
Host: updates.jenkins.io:443
User-Agent: curl/7.52.1
Proxy-Connection: Keep-Alive

< HTTP/1.1 200 Connection established
<

• Proxy replied OK to CONNECT request
• ALPN, offering h2
• ALPN, offering http/1.1
• Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH
• successfully set certificate verify locations:
• CAfile: /etc/ssl/certs/ca-certificates.crt
  CApath: /etc/ssl/certs
• TLSv1.2 (OUT), TLS header, Certificate Status (22):
  } [5 bytes data]
• TLSv1.2 (OUT), TLS handshake, Client hello (1):
  } [512 bytes data]
• TLSv1.2 (IN), TLS handshake, Server hello (2):
  { [98 bytes data]
• TLSv1.2 (IN), TLS handshake, Certificate (11):
  { [2478 bytes data]
• TLSv1.2 (IN), TLS handshake, Server key exchange (12):
  { [333 bytes data]
• TLSv1.2 (IN), TLS handshake, Server finished (14):
  { [4 bytes data]
• TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
  } [70 bytes data]
• TLSv1.2 (OUT), TLS change cipher, Client hello (1):
  } [1 bytes data]
• TLSv1.2 (OUT), TLS handshake, Finished (20):
  } [16 bytes data]
• TLSv1.2 (IN), TLS change cipher, Client hello (1):
  { [1 bytes data]
• TLSv1.2 (IN), TLS handshake, Finished (20):
  { [16 bytes data]
• SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384
• ALPN, server did not agree to a protocol
• Server certificate:
• subject: CN=updates.jenkins.io
• start date: Aug 5 00:55:00 2017 GMT
• expire date: Nov 3 00:55:00 2017 GMT
• subjectAltName: host "updates.jenkins.io" matched cert's "updates.jenkins.io"
• issuer: C=US; O=Let's Encrypt; CN=Let's Encrypt Authority X3
• SSL certificate verify ok.
  0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0} [5 bytes data]
  GET /download/plugins/git/latest/git.hpi HTTP/1.1
  Host: updates.jenkins.io
  User-Agent: curl/7.52.1
  Accept: /

{ [5 bytes data]
< HTTP/1.1 302 Found
< Date: Wed, 11 Oct 2017 09:26:04 GMT
< Server: Apache/2.4.7 (Ubuntu)
< Location: http://mirrors.jenkins-ci.org/plugins/git/latest/git.hpi
< Content-Length: 240
< Content-Type: text/html; charset=iso-8859-1
<
{ [5 bytes data]

• Ignoring the response-body
  { [240 bytes data]
• Curl_http_done: called premature == 0
  100 240 100 240 0 0 264 0 --:--:-- --:--:-- --:--:-- 264
• Connection #0 to host (nil) left intact
• Issue another request to this URL: 'http://mirrors.jenkins-ci.org/plugins/git/latest/git.hpi'
• Found bundle for host mirrors.jenkins-ci.org: 0xd939ce7fe0 [can pipeline]
• Hostname proxy.my-company-name.net was found in DNS cache
• Trying 10.244.0.55...
• TCP_NODELAY set
• Connected to (nil) (10.244.0.55) port 83 (#1)
  GET http://mirrors.jenkins-ci.org/plugins/git/latest/git.hpi HTTP/1.1
  Host: mirrors.jenkins-ci.org
  User-Agent: curl/7.52.1
  Accept: /
  Proxy-Connection: Keep-Alive

< HTTP/1.1 302 Found
< Date: Wed, 11 Oct 2017 09:26:04 GMT
< Server: Apache/2.4.7 (Ubuntu)
< X-MirrorBrain-Mirror: ftp-chi.osuosl.org
< X-MirrorBrain-Realm: other
< Link: http://mirrors.jenkins-ci.org/plugins/git/latest/git.hpi.meta4; rel=describedby; type="application/metalink4+xml"
< Link: http://ftp-chi.osuosl.org/pub/jenkins/plugins/git/3.6.0/git.hpi; rel=duplicate; pri=1; geo=us
< Link: http://ftp-nyc.osuosl.org/pub/jenkins/plugins/git/3.6.0/git.hpi; rel=duplicate; pri=2; geo=us
< Location: http://ftp-chi.osuosl.org/pub/jenkins/plugins/git/3.6.0/git.hpi
< Content-Length: 247
< Content-Type: text/html; charset=iso-8859-1
< Proxy-Connection: Keep-Alive
< Connection: Keep-Alive
<

• Ignoring the response-body
  { [247 bytes data]
• Curl_http_done: called premature == 0
  100 247 100 247 0 0 203 0 0:00:01 0:00:01 --:--:-- 203
• Connection #1 to host (nil) left intact
• Issue another request to this URL: 'http://ftp-chi.osuosl.org/pub/jenkins/plugins/git/3.6.0/git.hpi'
• Found bundle for host ftp-chi.osuosl.org: 0xd939ce7fe0 [can pipeline]
• Re-using existing connection! (#1) with proxy (nil)
• Connected to (nil) (10.244.0.55) port 83 (#1)
  GET http://ftp-chi.osuosl.org/pub/jenkins/plugins/git/3.6.0/git.hpi HTTP/1.1
  Host: ftp-chi.osuosl.org
  User-Agent: curl/7.52.1
  Accept: /
  Proxy-Connection: Keep-Alive

< HTTP/1.1 200 OK
< Date: Wed, 11 Oct 2017 09:26:04 GMT
< Server: Apache
< Last-Modified: Tue, 03 Oct 2017 00:16:16 GMT
< ETag: "175dd1-55a9966475400"
< Accept-Ranges: bytes
< Content-Length: 1531345
< Content-Type: application/vnd.hp-hpid
< Proxy-Connection: Keep-Alive
< Connection: Keep-Alive
< Age: 0
<
{ [3724 bytes data]
0 1495k 0 14661 0 0 9984 0 0:02:33 0:00:01 0:02:32 9984* Curl_http_done: called premature == 0
100 1495k 100 1495k 0 0 990k 0 0:00:01 0:00:01 --:--:-- 35.2M

• Connection #1 to host (nil) left intact

[carlossg]

so both worked, must be temporary issues or issues with the proxies or mirrors

[kirhie]

It still fails when I try to set the ENV variable in Dockerfile,

FROM jenkins/jenkins:2.73.1

ENV http_proxy http://proxy.my-company-name.net:83/
ENV https_proxy http://proxy.my-company-name.net:83/
ENV JAVA_OPTS -Dhudson.footerURL=https://cm.company-name.biz/ -Djenkins.install.runSetupWizard=false

USER root
RUN echo "Europe/Stockholm" > /etc/timezone && dpkg-reconfigure -f noninteractive tzdata
USER jenkins

RUN /usr/local/bin/install-plugins.sh git

WORKDIR $JENKINS_HOME

docker build -t test-jenkins-image .

Sending build context to Docker daemon 96.77kB
Step 1/9 : FROM jenkins/jenkins:2.73.1
---> c8a24e6775ea
Step 2/9 : ENV http_proxy http://my-company-name:83/
---> Using cache
---> c90e238bca77
Step 3/9 : ENV https_proxy https://my-company-name:83/
---> Using cache
---> bb75504f2fd1
Step 4/9 : ENV JAVA_OPTS -Dhudson.footerURL=https://cm.my-company.biz/ -Djenkins.install.runSetupWizard=false
---> Using cache
---> d2442f68b0e9
Step 5/9 : USER root
---> Using cache
---> e36211d4e499
Step 6/9 : RUN echo "Europe/Stockholm" > /etc/timezone && dpkg-reconfigure -f noninteractive tzdata
---> Using cache
---> 6ebcf027b455
Step 7/9 : USER jenkins
---> Using cache
---> e49767ff8026
Step 8/9 : RUN /usr/local/bin/install-plugins.sh git
---> Running in a47cadb74442
Creating initial locks...
Analyzing war...
Downloading plugins...
Downloading plugin: git from https://updates.jenkins.io/download/plugins/git/latest/git.hpi
Downloading plugin: git-plugin from https://updates.jenkins.io/download/plugins/git-plugin/latest/git-plugin.hpi
Failed to download plugin: git or git-plugin

WAR bundled plugins:

Installed plugins:
*:
Some plugins failed to download! Not downloaded: git
The command '/bin/sh -c /usr/local/bin/install-plugins.sh git' returned a non-zero code: 1

[kirhie]

Can we please re-open this issue?

[micc10]

It worked for me when I omitted "http://" / "https://"!

i.e. do not use this:
ENV http_proxy http://proxy.my-company-name.net:83/
ENV https_proxy http://proxy.my-company-name.net:83/

instead, use this:
ENV http_proxy proxy.my-company-name.net:83/
ENV https_proxy proxy.my-company-name.net:83/