How to run behind a SOCKS5 proxy?

[leoniscsem]

Ubuntu 22.04
GNOME 42.9
X11 (thanks, Nvidia...)

Because of the Great Firewall of China I have to proxy through one of our servers in the outside world. Yet I do not proxy all of my traffic through it via system proxy, but just use it for specific applications.

I was able to proxy another Matrix client by the GNOME team which came as a flatpak. I prefer snap packages though, and Neuchadnezzar looks really interesting to me. I (clumsily) tried to launch it like this, but found out due to the isolation from the system this directive is ignored:
env ALL_PROXY=socks5h://127.0.0.1:8080 nebuchadnezzar

I have also installed and configured proxychains4, but snap seems to ignore my proxy. Even, when I configure a system-wide proxy in my system settings.

I found another hint in this Snapcraft forum thread, but it does not apply here since it addresses snapd. Any adivce would be helpful.

[leoniscsem]

I have tried to use the env-injector hook for both http and https: sudo snap set nebuchadnezzar apps.nebuchadnezzar.env.http-proxy="socks5://127.0.0.1:8080"

Still, the connection keeps timing out and I cannot connect.

[Feichtmeier]

Hi @leoniscsem thanks for trying this WIP matrix client

I could imagine this needs fixing in the snap rather as in the app itself

@kenvandine can you give any input?

[leoniscsem]

The snapcraft documentation gave me the understanding that snapd itself could be run behind a proxy, thus the snap applications would make use of the proxy too. In my case that's not what I try to achieve (actually what I want to avoid), but I also read elsewhere that env-injector (*) would work IF the snap application is configured during the build process to do allow that.

I had a similar issue with a flatpak application (Tuba, a Mastodon client), and the kind developer of the application added a proxy config input to the application. I am well aware that snap and flatpak are very different standards, but in both cases it means "escaping the container and sending traffic through the proxy tunnel". I will try to find out if his proxy extension just added env variables or if he used a hook given by the framework.

A Google search led me to this:
sudo snap set <snap-name> apps.<app-command>.env.https-proxy="socks5://127.0.0.1:1080"
Note: This only works if the Snap developer has included the env-injector extension in their package.

(*) Source: Snapcraft 8.8.0 documentation

[leoniscsem]

Further googling brought up some results ... Gemini dug up some concepts (zum ersten Mal was Brauchbares dabei)

To enable a Snap application to successfully use a SOCKS5 proxy, specific
interfaces (sometimes referred to as hooks in this context) must be connected to grant the app the necessary permissions to communicate over the network.

1. Required Interfaces (Plugs)
For a Snap app to access any network, including a SOCKS5 proxy, the following interfaces must be present in its snapcraft.yaml and connected:

network: The most basic requirement, allowing the application to use the network.
network-bind: Required if the application needs to bind to a specific local port to communicate with the SOCKS5 proxy.
network-control (Advanced): This interface is often needed if the application attempts more complex networking tasks or requires privileged access to network namespaces.

2. The "Configure" Hook
If you are developing or modifying a Snap to support SOCKS5 specifically, you should use a configure hook. This is an executable file located in the snap/hooks/ directory that runs when a user changes a configuration setting.

A common pattern for 2026 Snap applications is to use this hook to pick up system-wide proxy settings:

1. The user runs: sudo snap set <app-name> roxy=socks5://127.0.0.1:1080.
2. The configure hook triggers, reads this value, and writes it to the application's internal config file or sets the appropriate environment variables for the app's next startup.

additional nonsense

**3. Environment Variables** Standard applications rely on the following environment variables to route traffic through a SOCKS5 proxy:

ALL_PROXY=socks5://<ip>:<port>
HTTPS_PROXY=socks5://<ip>:<port>
HTTP_PROXY=socks5://<ip>:<port> 

Note for 2026: Even with these interfaces, some Snaps may still leak DNS requests. Using the socks5h:// protocol (if supported by the app) is recommended to ensure DNS resolution also happens through the proxy.

Comparing the snapcraft.yaml with the required plugs from above, network-bind and network-control are not present. I will dive deeper into this matter and do a test build on the weekend. Let's see what comes from that.