title: Apache HTTP ProxyPass inside Docker container linked to other containers: Wrong remote IP interpreted by linked container
body: <p>I am migrating an Apache configuration from plain host-based Ubuntu to container-based CoreOS. <strong>I have only one instance of CoreOS</strong> for exploratory purposes and personal use, so I don't really need a cloud infrastructure compatible solution for this task. <strong>Assume all containers are running on the same physical machine.</strong></p>
  
  <p>That Apache configuration was a virtual host ProxyPass with <a href="https://stackoverflow.com/a/962928/4506528"><code>ProxyPreserveHost On</code></a>. On Ubuntu with an Apache installed on the host machine and no Docker, all is well. The objective is to host multiple web services on the same machine, with each web service being on its own subdomain, on port 443.</p>
  
  <p>For instance, I currently have on my CoreOS installation:</p>
  
  <ul>
  <li>example.com (website)</li>
  <li>gitlab.example.com (gitlab)</li>
  <li>jenkins.example.com (jenkins)</li>
  <li>sonar.example.com (sonar)</li>
  <li>monitoring.app.example.com (python)</li>
  <li>event.api.example.com (java)</li>
  <li>legacy.api.example.com (php)</li>
  </ul>
  
  <p>Every one of these web services are running in separate containers, and their ports are <strong>NOT</strong> published (not accessible from the Internet). As for Apache, it's running on its own container, and its ports <strong>are</strong> exposed.</p>
  
  <p>I am using container linking to achieve the virtual hosts to ProxyPass behavior: <code>--link gitlab:gitlab \</code> and <code>ProxyPass / https://gitlab:443/</code></p>
  
  <p>I am now facing a problem: If I watch the Apache Logs, I can see incoming connections are logging with the expected client IP address. However, the recorded incoming connections seen by the target containers are a container's IP address i.e. <code>172.17.0.1</code>.</p>
  
  <p>Due to the diversity of the target container web services (gitlab, python, java, php...), I am NOT able to tweak the implementation of these web services so that they pick the IP from another location let's say <code>X-Forwarded-For</code>.</p>
  
  <p>What would be a way to make it so the target containers see the desired IP address they would have seen if they weren't running in Docker? I am open to solutions that involve throwing away Apache HTTP as long as the desired use case is accomplished (port 443 exposed to Internet: one domain -> one webservice, client IP preserved).</p>
  
  <p>Please note that I was not able to use <code>--net=host</code> on the Apache server, because this option is incompatible with container links.</p>