What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers VPS plans with one-click Docker, NVMe storage and a 14-day free trial.
Run NGINX in its own container, place it on the same Docker network as your application, publish the host ports you need, and mount a site configuration into /etc/nginx/conf.d/default.conf. In that configuration, point proxy_pass at the application’s Docker service name and port—not localhost. Add forwarded headers, deliberate URI rules, TLS settings, or WebSocket upgrade handling only where your application requires them.
This guide builds that setup from a minimal HTTP proxy through HTTPS termination, path-based routing, WebSockets, validation, and troubleshooting.
What a reverse proxy does in Docker
A reverse proxy accepts a client connection and sends the request to an upstream application. NGINX then returns the upstream response to the client. The browser sees the NGINX address, while the application can remain private on the Docker network.
In a typical deployment, the NGINX container publishes port 80 (and possibly 443) on the host. The application container exposes an internal port such as 8080. NGINX reaches that port through Docker’s service DNS name, for example http://app:8080.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
- Client: connects to the host name and published port.
- NGINX: matches a
serverandlocation, applies headers and proxy rules, and forwards the request. - Application: listens on its container port and does not need to publish that port publicly.
Compose creates a project network by default, but verify the actual network when combining Compose projects or manually created containers. Containers can communicate by service name only when they share a network.
Choose a Docker layout
Bind-mounted configuration
For a small deployment or frequent configuration changes, use the official nginx image and bind-mount a local configuration file read-only into /etc/nginx/conf.d/default.conf. The image supplies the NGINX binary and entrypoint; your project supplies the site configuration.
Custom NGINX image
Build an image when the configuration should be versioned and released with the deployment. A Dockerfile can start from an NGINX image and use COPY to place a configuration under /etc/nginx or /etc/nginx/conf.d. This avoids depending on a host path at runtime, but every configuration change requires a new image build and deployment.
| Approach | Best fit | Trade-off |
|---|---|---|
| Read-only bind mount | Local development and independently managed configuration | The file and its path must exist on every host running the container |
Custom image with COPY |
Repeatable releases and image-based promotion | Configuration changes require a rebuild and new image tag |
Whichever layout you choose, remove or replace the image’s default server block if it could catch a request before your intended server does.
Minimal HTTP reverse proxy with Compose
Create a project directory with a Compose file and an NGINX configuration:
project/
├── compose.yml
└── nginx.confThe following is an illustrative pattern. Replace the application image, host name, and backend port with values from your deployment.
services:
app:
image: your-app-image
expose:
- "8080"
nginx:
image: nginx:stable
ports:
- "80:80"
volumes:
- ./nginx.conf:/etc/nginx/conf.d/default.conf:ro
depends_on:
- appexpose makes the application port available to other containers on the network without publishing it on the host. NGINX alone publishes host port 80. If the application must also be reachable directly from outside the Docker host, that is a separate decision and should not be confused with proxy connectivity.
Save this site configuration as nginx.conf:
server {
listen 80;
server_name example.com;
location / {
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_pass http://app:8080;
}
}Start the stack from the directory containing compose.yml:
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
docker compose up -dPoint DNS for example.com at the Docker host, then request http://example.com/. NGINX resolves app through Docker’s internal DNS and forwards the request to port 8080.
Connect NGINX to another container correctly
Use the service name, not localhost
Inside the NGINX container, localhost refers to that NGINX container itself. It does not refer to the application container or the Docker host. Use the Compose service name and the application’s listening port:
proxy_pass http://app:8080;If your service is named backend and listens on 9000, use proxy_pass http://backend:9000;. The name must be resolvable on a shared Docker network, and the port must be the container port, not necessarily a host-published port.
Check network and listening-port assumptions
- Confirm both services are attached to the same Docker network.
- Confirm the application listens on the expected interface and container port.
- Use the service name exactly as declared in Compose.
- Do not add a host-port mapping merely to let NGINX reach the application.
A proxy error caused by a wrong service name or port is different from an application-level 4xx or 5xx response. The former prevents a connection; the latter proves NGINX reached an upstream that returned an HTTP response.
Understand proxy_pass path behavior
The URI form of proxy_pass determines whether NGINX preserves the location prefix. This is one of the most common causes of an apparently “changed” URL path.
Preserve the requested URI
When proxy_pass has no URI component, NGINX passes the original request URI (or its normalized form) to the upstream:
Recommended Free Tools
location /api/ {
proxy_pass http://app:8080;
}A request for /api/users is sent upstream as /api/users.
Replace the matched location prefix
When proxy_pass includes a URI, NGINX replaces the part that matched the location with that URI:
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
location /api/ {
proxy_pass http://app:8080/;
}Here, /api/users is sent as /users. The trailing slash after the upstream port is significant.
Test slash combinations deliberately
| Location | Proxy target | Request /api/users becomes |
|---|---|---|
location /api/ |
http://app:8080 |
/api/users |
location /api/ |
http://app:8080/ |
/users |
location /api |
http://app:8080/v1/ |
The matched /api portion is replaced by /v1/ |
Decide whether the upstream application routes with the public prefix or without it. Then test the root, a nested path, a path containing a query string, and a trailing-slash variant. Do not infer the result from the browser’s address bar: the client URL can remain unchanged while the upstream receives a different path.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteForward host and client context headers
NGINX changes some proxy headers by default. Set the headers your application uses for absolute URLs, logging, authentication callbacks, redirects, rate limits, or scheme detection.
location / {
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_pass http://app:8080;
}Host $hostpasses the requested host name rather than an NGINX-generated upstream host.X-Real-IP $remote_addrsupplies the address seen by this proxy.X-Forwarded-For $proxy_add_x_forwarded_forappends this client address to an existing forwarding chain.X-Forwarded-Proto $schemetells the application whether the client-facing request used HTTP or HTTPS.
Forwarded headers are assertions, not proof. Configure the application to trust them only from the proxy hops you control. If another proxy sits in front of Docker, document which hop adds or replaces each header and avoid allowing arbitrary clients to spoof trusted values.
Add HTTPS termination at NGINX
For TLS termination, publish port 443, mount a certificate and private key into the container, and add a server block that listens with SSL.
server {
listen 443 ssl;
server_name example.com;
ssl_certificate /etc/nginx/tls/example.com.crt;
ssl_certificate_key /etc/nginx/tls/example.com.key;
location / {
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto https;
proxy_pass http://app:8080;
}
}Mount the TLS directory read-only and publish 443 only when the files and server block are present:
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →services:
nginx:
image: nginx:stable
ports:
- "80:80"
- "443:443"
volumes:
- ./nginx.conf:/etc/nginx/conf.d/default.conf:ro
- ./tls:/etc/nginx/tls:roThe certificate path must match the mounted path. Restrict access to the private-key file on the host; it must nevertheless be readable by the NGINX master process inside the container. The current nginx.org guidance documents TLS 1.2 and TLS 1.3 defaults. Do not copy a key into a public image layer or commit it to source control.
Redirect HTTP to HTTPS
Once HTTPS works, use a separate port-80 server for redirection if every request should be secure:
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
server {
listen 80;
server_name example.com;
return 301 https://$host$request_uri;
}Keep the TLS server’s X-Forwarded-Proto value as https so the application does not generate HTTP links or redirect an already secure request back to itself.
Proxy WebSocket routes
WebSockets begin as HTTP requests and then upgrade the connection. A normal HTTP proxy block does not automatically provide the required hop-by-hop upgrade headers.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteDefine a connection map in the top-level http context, then apply the headers to the WebSocket location:
http {
map $http_upgrade $connection_upgrade {
default upgrade;
'' close;
}
server {
listen 80;
server_name example.com;
location /socket/ {
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_pass http://app:8080;
}
}
}The map directive belongs in the http context, not inside a server or location. Match the location to the route used by the WebSocket client, preserve or replace its prefix deliberately, and keep ordinary HTTP routes in their own locations when they need different behavior.
Buffering, streaming, and large responses
Proxy response buffering is enabled by default. Buffering lets NGINX read data from the upstream and serve it to the client efficiently, but it is not automatically right for every workload.
- Keep the default while ordinary pages and API responses behave correctly.
- Investigate buffering when a streaming endpoint delivers data in bursts, when latency-sensitive events are delayed, or when response sizes exceed available buffer or temporary-file capacity.
- Change buffering only for the affected route and only after identifying the requirement.
For a route that must stream directly, a common targeted setting is:
Free tools Windows power users keep installed
One-click scans. No signup required.
location /events/ {
proxy_buffering off;
proxy_set_header Host $host;
proxy_pass http://app:8080;
}Disabling buffering globally can increase resource pressure and is not a substitute for diagnosing an upstream that emits data slowly. Tune related timeout and buffer settings only when the application’s response pattern justifies them.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Validate and reload safely
Validate the rendered configuration inside the running image before relying on it:
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
- Start or recreate the NGINX service with the intended mounts:
docker compose up -d nginx. - Run the syntax check:
docker compose exec nginx nginx -t. - If the test reports success, reload NGINX without replacing the container:
docker compose exec nginx nginx -s reload. - Inspect recent logs:
docker compose logs nginx. - Exercise an HTTP route, a nested path, and—if configured—a WebSocket or HTTPS route.
If the container exits before you can exec into it, run the image with the configuration mounted and inspect its startup output, or temporarily start an interactive shell to run nginx -t. A successful syntax check does not prove that the upstream name resolves, the application is healthy, the certificate matches the host, or the path behavior is what you intended.
Troubleshoot common failures
502 Bad Gateway or connection refused
- Check that
proxy_passuses the Compose service name, notlocalhost. - Verify the container port; a host mapping such as
8080:80does not mean the application listens on 8080 internally. - Confirm both services share a Docker network.
- Read the application and NGINX error logs for connection and DNS details.
404 from the application after adding a location
Compare the path the application expects with the path NGINX sends. A URI in proxy_pass replaces the matched location prefix; omitting the URI preserves it. Test both trailing-slash forms and adjust the location or upstream URI accordingly.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Redirects point to HTTP or the wrong host
Pass Host and X-Forwarded-Proto. On the TLS server, set the latter to https. Then configure the application’s proxy trust settings so it accepts those values from the NGINX hop.
WebSocket handshake fails or closes immediately
Use proxy_http_version 1.1, pass Upgrade and Connection, and apply them to the exact WebSocket location. Confirm that an intervening proxy is not removing the upgrade headers.
NGINX serves the wrong site
Check server_name, the request’s Host header, and whether the default server block remains enabled. Remove or replace an unintended default configuration so unmatched requests cannot silently land on the wrong upstream.
HTTPS fails to start
Run nginx -t and check certificate and key paths inside the container. Ensure the key is mounted, readable by the NGINX master process, and protected on the host. Confirm that port 443 is published and not already occupied on the Docker host.
Configuration choices at a glance
| Decision | Use this when | Important consequence |
|---|---|---|
| HTTP only | TLS is terminated by another trusted layer or the service is intentionally internal | Clients connect to port 80; no certificate is configured in NGINX |
| TLS at NGINX | NGINX is the public TLS endpoint | Mount certificates, protect the key, publish 443, and set the forwarded scheme |
| One upstream | All requests belong to one application | A single location / is usually sufficient |
| Path-based routing | Different URL prefixes map to different services | Each location needs an intentional prefix-preservation or replacement rule |
| Default buffering | Normal pages and API responses | NGINX buffers upstream responses |
| Streaming-oriented buffering | An endpoint needs prompt incremental delivery | Disable or tune buffering for that route after observing the requirement |
| Plain HTTP proxy | Standard request/response traffic | WebSocket upgrades are not covered automatically |
| WebSocket location | The application upgrades HTTP connections | Add HTTP/1.1 and upgrade headers, preferably only on the required route |
Production checklist
- Use a pinned, approved NGINX image tag rather than changing images unexpectedly.
- Keep application services on a private Docker network and publish only the NGINX ports that clients need.
- Mount configuration read-only and choose either a versioned custom image or a controlled host path.
- Use service names and container ports in
proxy_pass. - Decide and test whether each location preserves or replaces its URL prefix.
- Forward
Host, client IP, forwarding chain, and scheme according to the application’s trust model. - Protect TLS private keys and verify certificate paths from inside the container.
- Configure WebSocket upgrades only for routes that need them.
- Leave buffering at its default until a measured streaming or response-size requirement calls for a change.
- Run
nginx -t, inspect logs, and test representative URLs after every configuration change.
Frequently Asked Questions
Can NGINX in one container proxy to an application in another?
Yes. Put both containers on the same Docker network and use the application’s Compose service name plus its internal listening port, such as http://app:8080. Do not use localhost for a different container.
Why does adding a slash to proxy_pass change my application route?
A URI in proxy_pass replaces the portion matched by the location. With location /api/, proxy_pass http://app:8080/; turns /api/users into /users, while proxy_pass http://app:8080; preserves /api/users.
Do I need a separate NGINX configuration for WebSockets?
Use a dedicated location or shared directives that set proxy_http_version 1.1, Upgrade, and Connection. A plain HTTP proxy block does not provide the upgrade handling automatically.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →
