Transparent TCP proxy container: redirects outbound TCP to Gost, which forwards to an upstream HTTP proxy. Used with network_mode: service:proxy-transparent so apps need no proxy configuration.
- GHCR:
ghcr.io/singgihanggana/transparent-proxy:latest - Production:
docker pull ghcr.io/singgihanggana/transparent-proxy:latest
The image can route selected domains directly from the proxy-transparent container while keeping all other traffic on the upstream proxy.
app/flaresolverr in shared netns
-> iptables REDIRECT
-> embedded transparent router
|- DIRECT_DOMAINS match -> direct socket connect
`- default -> UPSTREAM_PROXY
Configure with environment variables:
| Variable | Default | Meaning |
|---|---|---|
REDIRECT_PORT |
12345 |
Local transparent listener port. In default mode this is GOST; in DIRECT_DOMAINS mode this is the embedded router. |
UPSTREAM_PROXY |
http://proxy:3128 |
Default HTTP proxy for non-direct domains |
DIRECT_DOMAINS |
empty | Comma-separated exact/suffix domain rules to route direct |
SO_MARK |
100 |
Non-zero packet mark used to bypass the iptables redirect loop |
Example for the manga stack:
environment:
- REDIRECT_PORT=12345
- UPSTREAM_PROXY=http://proxy:3128
- DIRECT_DOMAINS=comix.to,.comix.to,static.comix.top,.static.comix.top,mangadot.net,.mangadot.netRules beginning with . are suffix matches (.comix.to matches api.comix.to). *.example.com is normalized to .example.com.
If DIRECT_DOMAINS is empty, the container uses the original behavior and forwards all traffic directly to UPSTREAM_PROXY with no embedded router.
Domain detection in DIRECT_DOMAINS mode is best-effort: the router sniffs TLS SNI or HTTP Host from the first bytes of the connection. If no hostname is detected, the connection safely falls back to UPSTREAM_PROXY.
- Push this repo to GitHub (
main). - The workflow builds and pushes the image to
ghcr.io/<owner>/transparent-proxy:latest. If the repo is undersinggihanggana, the image isghcr.io/singgihanggana/transparent-proxy:latest. - Or run Actions → Build and Push to GHCR → Run workflow.
docker build -t ghcr.io/singgihanggana/transparent-proxy:domain-routing-test .For production, prefer a pinned tag over latest once the staging test is green.