Run NGINX in its own container, attach it to the same Docker network as your application, publish the host ports you need, and route requests with proxy_pass to the application’s service name and port. Mount the configuration read-only or bake it into a custom image, then add forwarded headers, TLS, WebSocket handling, and buffering changes only when your application requires them.
Antihost offers VPS plans with one-click Docker, NVMe storage and a 14-day free trial.
What a Dockerized NGINX reverse proxy does
A reverse proxy accepts a client request, selects an upstream application, forwards the request, and returns the upstream response. In Docker, NGINX and the application normally run as separate containers on one Compose-created network. NGINX is the public entry point; the application can remain reachable only inside the Docker network.
As an Amazon Associate I earn from qualifying purchases.
Recommended Free Tools
Inside an NGINX location block, proxy_pass identifies the upstream. Use the Docker service name and listening port, such as http://app:8080. Do not use localhost to reach another container: inside the NGINX container, localhost means NGINX itself.
- Publish
80:80for HTTP traffic. - Publish
443:443only when a TLS server block and certificates are mounted. - Use
exposefor an application port that should be available to other containers without being published directly on the host. - Keep the NGINX configuration and TLS key material persistent outside the ephemeral container filesystem.
Choose how to supply the NGINX configuration
Read-only bind mount
A bind mount is convenient during development and for deployments where configuration is managed on the Docker host. Mount a file such as ./nginx.conf at /etc/nginx/conf.d/default.conf with read-only mode (:ro). A mounted file replaces the default site configuration at that path, so remove or replace any default server block that could catch requests unexpectedly.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
Custom image
A custom image puts the configuration under version control and makes the image self-contained. The NGINX Docker guidance documents copying configuration into the image with a Dockerfile. This is useful when the same tested configuration must move through multiple environments.
| Approach | Configuration location | Typical reason to use it |
|---|---|---|
| Bind mount | Host file mounted at /etc/nginx/conf.d/default.conf |
Fast edits and environment-specific deployment files |
| Custom image | File copied into the image during build | Reproducible, versioned releases |
Build a minimal two-container setup
1. Create the project files
Create a directory containing compose.yaml and an NGINX site file. Compose creates a service network by default; verify the actual network in your deployment if you override that behavior.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
mkdir docker-reverse-proxy
cd docker-reverse-proxy
touch compose.yaml nginx.conf2. Define the application and NGINX services
The application listens on port 8080 inside its container. The expose entry documents and shares that port with other services without publishing it directly to the host. NGINX publishes port 80.
services:
app:
image: your-app-image
expose:
- "8080"
nginx:
image: nginx:stable
ports:
- "80:80"
volumes:
- ./nginx.conf:/etc/nginx/conf.d/default.conf:ro
depends_on:
- appReplace your-app-image with the image and internal port used by your application. The service name app becomes the Docker DNS name that NGINX uses.
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
3. Add the HTTP server block
server {
listen 80;
server_name example.com;
location / {
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_pass http://app:8080;
}
}Change example.com to the hostname clients will send and change app:8080 to the real Compose service name and container port. If you are testing by IP address or a local hostname, use that value in server_name or choose a matching default server deliberately.
4. Start the stack
docker compose up -dThen request the published host port. The request reaches NGINX on port 80, and NGINX resolves app through Docker’s service discovery and forwards it to port 8080.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallUnderstand proxy_pass path behavior
The most common routing surprise is the difference between a proxy_pass with a URI and one without a URI. NGINX’s documented rule is that including a URI replaces the part of the request URI that matched the location. Omitting the URI passes the original, or normalized, request URI.
Preserve the incoming path
location /api/ {
proxy_pass http://app:8080;
}A request for /api/users is sent upstream with /api/users. Use this when the application itself expects the public prefix.
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
Replace the matched prefix
location /api/ {
proxy_pass http://app:8080/;
}Here the trailing slash supplies a URI. The matched /api/ prefix is replaced, so /api/users is sent upstream as /users. This is appropriate when the public URL has a prefix that the backend does not know about.
Test slash combinations explicitly
Check requests such as /api, /api/, and /api/users. A location ending in a slash and a proxy_pass URI ending in a slash produce different results from their no-slash counterparts. Confirm the final upstream path in application logs before deploying a path rewrite.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesForward the headers your application needs
NGINX changes the Host and Connection headers by default. Forward the original host and client context explicitly when the application uses them for routing, absolute URLs, logging, redirects, authentication callbacks, rate limits, or scheme detection.
Host $hostpreserves the requested hostname without an appended port in the usual case.X-Real-IP $remote_addrpasses the address of the client that connected to this NGINX instance.X-Forwarded-For $proxy_add_x_forwarded_forappends the current client address to an existing proxy chain.X-Forwarded-Proto $schemetells the application whether the client-to-NGINX request used HTTP or HTTPS.
location / {
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_pass http://app:8080;
}Decide which proxy hops your application trusts before enabling IP-based access controls or redirect logic. An application should not blindly trust client-supplied forwarding headers when an untrusted network can reach it directly. Restrict direct access to the backend where possible and configure the framework’s trusted-proxy setting to match the actual chain.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
Add HTTPS termination at NGINX
For TLS termination, NGINX listens on port 443, loads a certificate and private key, and forwards decrypted HTTP to the application. The current nginx.org HTTPS guidance documents TLS 1.2 and TLS 1.3 defaults.
Mount the certificate files
Store the certificate and key outside the container and mount them read-only at the paths used by the server block. Protect the private key; the official guidance notes that it must be restricted but readable by the NGINX master process.
Free tools Windows power users keep installed
One-click scans. No signup required.
services:
nginx:
image: nginx:stable
ports:
- "80:80"
- "443:443"
volumes:
- ./nginx.conf:/etc/nginx/conf.d/default.conf:ro
- ./tls:/etc/nginx/tls:roConfigure the TLS virtual server
server {
listen 443 ssl;
server_name example.com;
ssl_certificate /etc/nginx/tls/example.com.crt;
ssl_certificate_key /etc/nginx/tls/example.com.key;
location / {
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto https;
proxy_pass http://app:8080;
}
}Set the key file permissions so only the intended operators and the NGINX master process can read it. Publish 443 only after the certificate paths exist and the TLS configuration passes validation. If you also keep an HTTP server, use it for the behavior you intentionally want, such as redirecting HTTP to HTTPS; do not assume a redirect exists unless you configure one.
Support WebSocket routes
A plain HTTP reverse-proxy block is not sufficient for WebSockets because the protocol switches from HTTP to a persistent upgraded connection. Add upgrade handling for only the routes that need it.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
http {
map $http_upgrade $connection_upgrade {
default upgrade;
'' close;
}
server {
listen 80;
server_name example.com;
location /socket/ {
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade;
proxy_pass http://app:8080;
}
}
}The map directive belongs in the http context, not inside a location. Keep the path, service name, and port aligned with the application’s WebSocket endpoint. If ordinary requests work but the socket handshake fails, inspect the upgrade headers and the backend route first.
Understand buffering before changing it
NGINX proxy buffering is enabled by default. Buffering can help NGINX handle upstream responses efficiently, so do not disable it merely because a proxy is present.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →When to consider a change
- Streaming or server-sent output must reach the client incrementally.
- A large response creates a measurable memory, latency, or temporary-file problem.
- The application’s protocol requires different response-flow behavior.
Make a targeted change
location /stream/ {
proxy_buffering off;
proxy_set_header Host $host;
proxy_pass http://app:8080;
}Apply buffering changes to the affected location rather than globally unless you have a measured reason to do so. Tune buffer sizes only after observing a concrete response-size or latency requirement.
Validate configuration and reachability
Check the rendered NGINX configuration
docker compose exec nginx nginx -tRun this check inside the image that will serve traffic. Fix syntax errors, missing certificate files, invalid directives, and include-path mistakes before reloading or recreating the service.
Check service-name resolution
docker compose exec nginx getent hosts appThe command should resolve the application service on the shared Docker network. If it does not, inspect the Compose project network, service names, and any custom network declarations.
Inspect logs and the upstream response
docker compose logs nginx
docker compose logs app
docker compose exec nginx curl -i http://app:8080/These are operational checks rather than guarantees that every application supports curl or that the utility is installed in the image. If the last command is unavailable, use an equivalent HTTP client in a temporary diagnostic container on the same network.
Troubleshoot common failures
502 Bad Gateway or connection refused
- Confirm the application is listening on the container port named in
proxy_pass, not merely on a host-published port. - Use the Compose service name, such as
app, instead oflocalhost. - Verify both services share a Docker network and that the application is running.
- Read NGINX and application logs for connection, startup, and crash messages.
The backend receives the wrong path
- Compare
proxy_pass http://app:8080;withproxy_pass http://app:8080/;. - Check whether the
locationends in a slash. - Test the exact public paths with and without trailing slashes and inspect backend access logs.
Redirects point to HTTP or the wrong hostname
- Forward
HostandX-Forwarded-Proto. - Configure the application to trust those headers only from your NGINX proxy.
- For TLS termination, set
X-Forwarded-Proto httpsin the HTTPS server block.
WebSocket handshakes fail
- Add
UpgradeandConnectionheaders and the supportingmap. - Route the WebSocket path to the correct application endpoint.
- Check that another proxy or load balancer in front of NGINX also permits connection upgrades.
NGINX serves an unexpected page
A default server block may be matching the request before your intended site. Replace the default configuration, set an explicit server_name, and verify which server block is loaded with the configuration test.
Quick Recap
Choose a routing design that matches the application
| Design choice | Configuration pattern | Important consideration |
|---|---|---|
| One upstream | location / forwarding to one service |
Simple entry point for a single application |
| Path-based services | Separate locations such as /api/ and /media/ |
Decide independently whether each prefix is preserved or replaced |
| HTTP only | listen 80 |
No certificate files are required, but traffic is unencrypted |
| TLS termination | listen 443 ssl with certificate directives |
Protect the key and forward the HTTPS scheme to the application |
| Streaming-oriented route | Targeted proxy_buffering off |
Change buffering only for a demonstrated streaming requirement |
| WebSocket route | Upgrade headers plus an http-level map |
A normal HTTP proxy block alone will not complete the upgrade |
Production checklist
- NGINX and the application use the same verified Docker network.
proxy_passnames the application service and its internal listening port.- The intended configuration is mounted read-only or copied into a versioned custom image.
- Unwanted default server blocks have been removed or replaced.
- Published host ports match the listeners configured in NGINX.
- Host, client-IP, forwarding-chain, and scheme headers match the application’s trusted-proxy policy.
- Every path-based route has been tested with its trailing-slash behavior.
- TLS certificates are mounted at the configured paths, and the private key has restricted access.
- WebSocket routes include upgrade handling where required.
- Buffering changes are tied to an observed streaming or response-size requirement.
nginx -tpasses inside the running image before a reload.- NGINX and upstream logs have been checked after deployment.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
