Test HTTPS Proxy with OpenShell and Podman driver

openshell-podman-proxy.md

Related issue: NVIDIA/OpenShell#1792

Run a mitmproxy with HTTPS connection:

$ mkdir -p $HOME/.mitmproxy
$ podman run -d --name mitmproxy -p 8080:8080 \        
    -v "$HOME/.mitmproxy:/home/mitmproxy/.mitmproxy" \
    mitmproxy/mitmproxy mitmdump -p 8080

Get OpenShell branch with proxy support:

$ git clone -b fix-1792-corporate-proxy-podman-https-prxoy git@github.com:feloy/OpenShell.git openshell-proxy
$ cd openshell-proxy

# check prerequisites for building OpenShell (https://github.com/NVIDIA/OpenShell/blob/main/CONTRIBUTING.md), 
# then prepare project
$ mise trust
$ source .venv/bin/activate

then run patched gateway and configure the proxy settings

$ OPENSHELL_SANDBOX_PROXY_CA_BUNDLE=$HOME/.mitmproxy/mitmproxy-ca-cert.pem \
  OPENSHELL_SANDBOX_HTTPS_PROXY=https://host.containers.internal:8080 \
  mise run gateway

From another terminal, create a sandbox:

# be sure to be in the sources directory, so openshell is built from source
$ pwd
.../openshell-proxy
# create a sandbox
$ openshell sandbox create --name proxy -- true

# give permission for host behind proxy
$ openshell policy update proxy --add-endpoint www.example.com:443 --binary /usr/bin/curl

# connect to the sandbox
$ openshell sandbox connect proxy

# From the sandbox prompt, make an HTTPS request to the host
$ curl https://www.example.com
<html>...</html>

$ exit

Verify in the mitmproxy logs that the request has been intercepted by proxy

$ podman logs mitmproxy
[12:33:53.075] HTTP(S) proxy listening at *:8080.
[12:53:41.271][192.168.127.1:63413] client connect
[12:53:41.302][192.168.127.1:63413] server connect www.example.com:443 (172.66.147.243:443)
192.168.127.1:63413: GET https://www.example.com/
                  << 200 OK 559b

You can now test with your own proxy, by stopping the gateway started before, and restart it with your own CA certificate and HTTPS_PROXY.