Support transparent proxying

[docker-library]

Support transparent proxying

[yosifkit]

The haproxy image does support the "graceful restarts" (since #17), which is now documented in docker-library/docs#534. But as far as the transparent proxying, it seems that requires --net=host and additional security privileges so I think we would be unlikely to add it to this image. @tombull's image seems like a great place to start though (:+1: that it is FROM haproxy).

[tombull]

Transparent proxying is possible in a docker container, but there are various security implications. I've built a docker container for HAProxy that supports transparent proxying that you might want to check out: docker hub and github
Note: it also does zero-downtime reloads... 😄

[tombull]

Yeah, forgot to mention that it's based on this wonderful haproxy container 😄
The 'graceful' reloads thing that haproxy does can drop a few packets in the time between when one process drops the socket and the next takes it up. It's probably not worth worrying about unless the service you're proxying has no error-recovery mechanisms or it's a mega-busy service. Because my container that does transparent proxying requires access to iptables (NET_ADMIN capability) it can do a slightly more advanced reload based on the technique described here that guarantees not to drop any packets. Probably.

[tianon]

Closing since this appears to be resolved. 👍