Skip to content

HAProxy HAProxy

Description / nameInput element
Container Registry
Container Configuration Root Path
Timezone
User ID
Group ID
HAProxy Host Port
HAProxy /config Path

Build Status Last Commit OCI Pulls

Reliable, high performance TCP/HTTP load balancer and reverse proxy.
Port 80
Registry ghcr.io/daemonless/haproxy
Daemonless daemonless/haproxy
Source haproxy/haproxy
Website www.haproxy.org

Version Tags

Tag Description Best For
3.4 / 3.4-pkg-latest / <version> / latest / pkg / pkg-latest HAProxy 3.4 release branch installed from FreeBSD latest packages. Most users — recommended.
3.3 / 3.3-pkg-latest / <version> HAProxy 3.3 release branch installed from FreeBSD latest packages. Alternative build.
3.2 / 3.2-pkg-latest / <version> / lts HAProxy 3.2 LTS release branch installed from FreeBSD latest packages. Alternative build.
3.0 / 3.0-pkg-latest / <version> HAProxy 3.0 LTS release branch installed from FreeBSD latest packages. Alternative build.
2.8 / 2.8-pkg-latest / <version> HAProxy 2.8 LTS release branch installed from FreeBSD latest packages. Alternative build.
2.6 / 2.6-pkg-latest / <version> HAProxy 2.6 LTS release branch installed from FreeBSD latest packages. Alternative build.
devel / devel-pkg-latest HAProxy development edge release branch installed from FreeBSD latest packages. Alternative build.
3.4-lua / 3.4-lua-pkg-latest / <version>-lua / lua HAProxy 3.4 release branch with Lua scripting enabled. Alternative build.
3.3-lua / 3.3-lua-pkg-latest / <version>-lua HAProxy 3.3 release branch with Lua scripting enabled. Alternative build.
3.2-lua / 3.2-lua-pkg-latest / <version>-lua HAProxy 3.2 LTS release branch with Lua scripting enabled. Alternative build.
3.0-lua / 3.0-lua-pkg-latest / <version>-lua HAProxy 3.0 LTS release branch with Lua scripting enabled. Alternative build.
2.8-lua / 2.8-lua-pkg-latest / <version>-lua HAProxy 2.8 LTS release branch with Lua scripting enabled. Alternative build.
2.6-lua / 2.6-lua-pkg-latest / <version>-lua HAProxy 2.6 LTS release branch with Lua scripting enabled. Alternative build.
3.4-wolfssl / 3.4-wolfssl-pkg-latest / <version>-wolfssl / wolfssl HAProxy 3.4 release branch built with WolfSSL TLS engine. Alternative build.
3.3-wolfssl / 3.3-wolfssl-pkg-latest / <version>-wolfssl HAProxy 3.3 release branch built with WolfSSL TLS engine. Alternative build.
3.2-wolfssl / 3.2-wolfssl-pkg-latest / <version>-wolfssl HAProxy 3.2 LTS release branch built with WolfSSL TLS engine. Alternative build.
3.0-wolfssl / 3.0-wolfssl-pkg-latest / <version>-wolfssl HAProxy 3.0 LTS release branch built with WolfSSL TLS engine. Alternative build.

Before deploying, ensure your host environment is ready. See the Quick Start Guide for host setup instructions, including the security model for host vs. container privileges.

Deployment

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
services:
  haproxy:
    image: "ghcr.io/daemonless/haproxy:latest"
    container_name: haproxy
    environment:
      - PUID=1000  # User ID for the application process
      - PGID=1000  # Group ID for the application process
      - TZ=UTC  # Timezone for the container
    volumes:
      - "/path/to/containers/haproxy:/config"
    ports:
      - "80:80"
      - "443:443"
      - "8404:8404"
    # always (not unless-stopped) so FreeBSD's podman rc.d auto-starts it at boot
    restart: always

Save as compose.yaml, then run podman-compose up -d.

1
2
3
4
5
6
7
8
9
podman run -d --name haproxy \
  -p 80:80 \
  -p 443:443 \
  -p 8404:8404 \
  -e PUID=1000 \
  -e PGID=1000 \
  -e TZ=UTC \
  -v /path/to/containers/haproxy:/config \
  ghcr.io/daemonless/haproxy:latest

Save as run.sh, then run sh run.sh.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
- name: Deploy haproxy
  containers.podman.podman_container:
    name: haproxy
    image: "ghcr.io/daemonless/haproxy:latest"
    state: started
    restart_policy: always
    env:
      PUID: "1000"
      PGID: "1000"
      TZ: "UTC"
    ports:
      - "80:80"
      - "443:443"
      - "8404:8404"
    volumes:
      - "/path/to/containers/haproxy:/config"

Save as haproxy-deploy.yaml, then run ansible-playbook haproxy-deploy.yaml.

Warning

Exposing ports in AppJail means that your service can be reached from remote hosts. If that is not your intention, do not expose the ports and communicate with the service using the jail's IPv4 address or hostname assigned by the virtual network.

1
2
3
4
5
6
# .env

DIRECTOR_PROJECT=haproxy
PUID=1000
PGID=1000
TZ=UTC

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
# appjail-director.yml

options:
  - virtualnet: ':<random> default'
  - nat:
services:
  haproxy:
    name: haproxy
    options:
      - container: 'args:--pull'
      - expose: '80:80 proto:tcp'
      - expose: '443:443 proto:tcp'
      - expose: '8404:8404 proto:tcp'
    oci:
      user: root
      environment:
        - PUID: !ENV '${PUID}'
        - PGID: !ENV '${PGID}'
        - TZ: !ENV '${TZ}'
    volumes:
      - HAPROXY_CONFIG_PATH: /config
volumes:
  HAPROXY_CONFIG_PATH:
    device: '/path/to/containers/haproxy'

1
2
3
4
5
6
7
# Makejail

ARG tag=latest

OPTION container=boot
OPTION overwrite=force
OPTION from=ghcr.io/daemonless/haproxy:${tag}

Save the files above, then run appjail-director up.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
appjail oci run -Pd \
  -o overwrite=force \
  -o container="args:--pull" \
  -o virtualnet=":<random> default" \
  -o nat \
  -o expose="80:80 proto:tcp" \
  -o expose="443:443 proto:tcp" \
  -o expose="8404:8404 proto:tcp" \
  -e PUID=1000 \
  -e PGID=1000 \
  -e TZ=UTC \
  -o fstab="/path/to/containers/haproxy /config <pseudofs>" \
  ghcr.io/daemonless/haproxy:latest haproxy

Save the files above, then run sh run.sh.

Experimental

Bastille's OCI support is experimental. It requires buildah and shares the host network stack (inherit). Mount volumes with --volume HOST JAIL; without it, image-declared volumes are stored under ${bastille_volumesdir}/${jail}.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
services:
  haproxy:
    name: haproxy
    image: "ghcr.io/daemonless/haproxy:latest"
    network:
      - mode: host
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=UTC
    volumes:
      - "/path/to/containers/haproxy:/config"

Save as bastille-compose.yml, then run bastille up.

1
2
3
4
5
6
bastille create -O \
  --env PUID=1000 \
  --env PGID=1000 \
  --env TZ=UTC \
  --volume /path/to/containers/haproxy /config \
  haproxy ghcr.io/daemonless/haproxy:latest inherit

Interactive Configuration

Parameters

Environment Variables

Variable Default Description
PUID 1000 User ID for the application process
PGID 1000 Group ID for the application process
TZ UTC Timezone for the container

Volumes

Path Description
/config Configuration directory containing haproxy.conf

Ports

Port Protocol Description
80 TCP HTTP Listener
443 TCP HTTPS Listener (optional)
8404 TCP HAProxy Stats Page (optional)

Implementation Details

  • Architectures: amd64
  • User: bsd (UID/GID set via PUID/PGID). Defaults to 1000:1000.
  • Base: Built on ghcr.io/daemonless/base (FreeBSD 15.1).

Need help? Join our Discord community.