{"record":{"id":"eaca453089392cff","repo":"k3s-io/k3s","slug":"unsupported-proxy-scheme-s","errorCode":null,"errorMessage":"unsupported proxy scheme: %s","messagePattern":"unsupported proxy scheme: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/agent/loadbalancer/httpproxy.go","lineNumber":69,"sourceCode":"\t\treturn errors.WithMessagef(err, \"failed to create proxy dialer for %s\", proxyURL)\n\t}\n\n\tdefaultDialer = dialer\n\tlogrus.Debugf(\"Using proxy %s for agent connection to %s\", proxyURL, serverURL)\n\treturn nil\n}\n\n// proxyDialer creates a new proxy.Dialer that routes connections through the specified proxy.\nfunc proxyDialer(proxyURL *url.URL, forward proxy.Dialer) (proxy.Dialer, error) {\n\tif proxyURL.Scheme == \"http\" || proxyURL.Scheme == \"https\" {\n\t\t// Create a new HTTP proxy dialer\n\t\thttpProxyDialer := httpdialer.New(proxyURL, httpdialer.WithConnectionTimeout(10*time.Second), httpdialer.WithDialer(forward.(*net.Dialer)))\n\t\treturn httpProxyDialer, nil\n\t} else if proxyURL.Scheme == \"socks5\" {\n\t\t// For SOCKS5 proxies, use the proxy package's FromURL\n\t\treturn proxy.FromURL(proxyURL, forward)\n\t}\n\treturn nil, fmt.Errorf(\"unsupported proxy scheme: %s\", proxyURL.Scheme)\n}\n","sourceCodeStart":51,"sourceCodeEnd":71,"githubUrl":"https://github.com/k3s-io/k3s/blob/6ba341e396edc16b8dcae978a7c5e3ac7ee5606e/pkg/agent/loadbalancer/httpproxy.go#L51-L71","documentation":"The agent's embedded load balancer builds a proxy.Dialer from the environment proxy URL: http/https go through httpdialer.New (10s connect timeout), socks5 through proxy.FromURL. Every other scheme falls into this error — only those three are implemented.","triggerScenarios":"HTTPS_PROXY/HTTP_PROXY/ALL_PROXY set to a URL whose scheme is not http, https or socks5: socks5h://, socks4://, ftp://, a typo like 'htps://', or a bare 'proxyhost:3128' that url.Parse treats as schemeless.","commonSituations":"Corporate environments standardizing on socks5h:// (DNS resolution through the proxy); env var typos; bare host:port values without a scheme.","solutions":["Change the proxy URL scheme to http://, https:// or socks5:// (note: socks5 resolves DNS locally)","Prefix bare host:port values with a scheme: http://proxy.corp:3128","Fix env var typos and re-export before starting the agent"],"exampleFix":"# before\nexport HTTPS_PROXY=\"socks5h://proxy.corp:1080\"\n\n# after\nexport HTTPS_PROXY=\"socks5://proxy.corp:1080\"","handlingStrategy":"validation","validationCode":"u, err := url.Parse(os.Getenv(\"HTTPS_PROXY\"))\nif err == nil && u.Host != \"\" {\n    switch u.Scheme {\n    case \"http\", \"https\", \"socks5\":\n    default:\n        log.Fatalf(\"unsupported proxy scheme %q (use http, https or socks5)\", u.Scheme)\n    }\n}","typeGuard":"func supportedProxyScheme(raw string) bool {\n    u, err := url.Parse(raw)\n    return err == nil && (u.Scheme == \"http\" || u.Scheme == \"https\" || u.Scheme == \"socks5\")\n}","tryCatchPattern":null,"preventionTips":["Use http://, https:// or socks5:// proxy URLs only; socks5h is not accepted","Always include a scheme — bare host:port parses as schemeless and fails","Sanitize proxy env vars in systemd units and container entrypoints"],"tags":["proxy","network","environment","loadbalancer","url"],"backgroundTag":null,"analyzedSha":"6ba341e396edc16b8dcae978a7c5e3ac7ee5606e","analyzedAt":"2026-08-15T16:27:54.286Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}