Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

TIL: You can make HTTP requests without curl using Bash /dev/TCP

mareksuppa.com

Post reply on HN
Print view View original

11–20 of 255 posts

Re: TIL: You can make HTTP requests without curl using Bash /dev/TCP

#11

Post by sevenzero »

mrshu wrote: post #7
sevenzero wrote: post #3

Earlier quoted context omitted.

It seems pretty cool, but I am wondering if there's any drawback on just using images that support curl? I can't think of any and to me it's kinda a must have, even on production images

That is indeed a solid pushback! :) For what its worth, this container used `python:3.12.2-slim-bookworm` and I really would not expect that sort of an image to bundle `curl` -- even if it is intended for production.

Ah I see so it was basically a minimal image that bundles just python? I can see why it wouldn't bundle curl! Thought it was a custom Image for some reason, hence my original comment

Re: TIL: You can make HTTP requests without curl using Bash /dev/TCP

#12

Post by mrshu »

basilikum wrote: post #8

> As it turns out, bash can speak HTTP by itself. No, it can not. Bash lets you open TCP sockets. What you are doing here is trying to speak HTTP yourself, which is fine for testing and debugging, and hella cool for fun to do by hand, but you will shoot yourself in the foot if you try to use this pseudo http client unattended in reality. This toy code does not parse HTTP properly and will break. You could of course w…

> No, it can not. Bash lets you open TCP sockets.

Very fair pushback -- I did get carried away and will update the article to be more precise. Thanks for raising it!

> For less insane, non-bash shells there is always nc which is usually probably the wiser choice.

For completeness, `nc` or any netcat equvialent I could think of was not available in the image I was trying this with. It would certainly be a better option though.

Re: TIL: You can make HTTP requests without curl using Bash /dev/TCP

#13

Post by a-dub »

basilikum wrote: post #8

> As it turns out, bash can speak HTTP by itself. No, it can not. Bash lets you open TCP sockets. What you are doing here is trying to speak HTTP yourself, which is fine for testing and debugging, and hella cool for fun to do by hand, but you will shoot yourself in the foot if you try to use this pseudo http client unattended in reality. This toy code does not parse HTTP properly and will break. You could of course w…

it's not that insane. i've been manually typing http requests in since before http/1.1 and the mandatory host header.

it is insane to use it for anything serious (also the opposite, implementing webservers in bash), but for quick testing it's pretty great!

Re: TIL: You can make HTTP requests without curl using Bash /dev/TCP

#14

Post by giobox »

sevenzero wrote: post #3
mrshu wrote: post #2

I ran into this while checking connectivity between containers on an internal Docker network where the image had neither curl nor wget. The main surprise was that Bash has /dev/tcp which lets you do the equivalent of an HTTP request with a bit of shell magic, for instance: exec 3 /dev/tcp/service/8642 printf 'GET /health HTTP/1.1\r\nHost: service\r\nConnection: close\r\n\r\n' >&3 cat Where `service` is just the hostn…

It seems pretty cool, but I am wondering if there's any drawback on just using images that support curl? I can't think of any and to me it's kinda a must have, even on production images

It's also a two line Dockerfile to add wget or curl to almost any pre-existing container image. This is a fun idea though.

Re: TIL: You can make HTTP requests without curl using Bash /dev/TCP

#15

Post by mrshu »

sevenzero wrote: post #11
mrshu wrote: post #7

Earlier quoted context omitted.

That is indeed a solid pushback! :) For what its worth, this container used `python:3.12.2-slim-bookworm` and I really would not expect that sort of an image to bundle `curl` -- even if it is intended for production.

Ah I see so it was basically a minimal image that bundles just python? I can see why it wouldn't bundle curl! Thought it was a custom Image for some reason, hence my original comment

Yes, a very minimal image indeed. Had it been a custom image, curl would be one of the first things I would make sure it contains :)

Re: TIL: You can make HTTP requests without curl using Bash /dev/TCP

#16

Post by simonw »

Neat, works against example.com

  exec 3/dev/tcp/example.com/80
  printf 'GET / HTTP/1.1\r\nHost: example.com\r\nConnection: close\r\n\r\n' >&3
  cat
Outputs:

  HTTP/1.1 200 OK
  Date: Tue, 16 Jun 2026 17:37:45 GMT
  Content-Type: text/html
  ...
I always end up on example.com for this kind of thing because there are so few domains these days that don't enforce https!

Re: TIL: You can make HTTP requests without curl using Bash /dev/TCP

#17

Post by KomoD »

mrshu wrote: post #9
AndrewStephens wrote: post #5

This is pretty neat if all you need is to ping a local server but please use curl (or something equivalent) for contacting remote services. HTTP1.1 seems like such a simple protocol but in the real world you need to deal with proxies, different encodings, and redirects. Curl takes care of that (and a host of other annoying stuff) for you.

Totally! I was really just trying to see if intra-container connectivity works, and this ended up being a very quick way of doing so. (The alternative being building and deploying a new image, which would likely take significantly longer.)

> The alternative being building and deploying a new image, which would likely take significantly longer

You said the image was Python, though? Using that is way easier and faster. https://news.ycombinator.com/item?id=48558763

If all you need to know is that it can connect:

python3 -c 'import socket as s;s.create_connection(("8.8.8.8",53))'

or http:

python3 -c 'from urllib.request import*;print(urlopen("http://example.com").status)'

Re: TIL: You can make HTTP requests without curl using Bash /dev/TCP

#18

Post by OptionOfT »

sevenzero wrote: post #3
mrshu wrote: post #2

I ran into this while checking connectivity between containers on an internal Docker network where the image had neither curl nor wget. The main surprise was that Bash has /dev/tcp which lets you do the equivalent of an HTTP request with a bit of shell magic, for instance: exec 3 /dev/tcp/service/8642 printf 'GET /health HTTP/1.1\r\nHost: service\r\nConnection: close\r\n\r\n' >&3 cat Where `service` is just the hostn…

It seems pretty cool, but I am wondering if there's any drawback on just using images that support curl? I can't think of any and to me it's kinda a must have, even on production images

I always recommend to not have any dependencies outside of the code.

So we start at compiling the codebase (Rust) against MUSL. That way we can run it with FROM scratch images.

If we need more tooling available at runtime, then we look at alpine, but still using MUSL.

If MUSL itself is proving problematic, or if some of the libraries we use need glibc then we can look at using some locked down image.

The cool part about FROM scratch images is that you'll never have to update your base image to address CVEs. Only your software and its (compiled) dependencies.

Re: TIL: You can make HTTP requests without curl using Bash /dev/TCP

#19

Post by xmodem »

sevenzero wrote: post #3
mrshu wrote: post #2

I ran into this while checking connectivity between containers on an internal Docker network where the image had neither curl nor wget. The main surprise was that Bash has /dev/tcp which lets you do the equivalent of an HTTP request with a bit of shell magic, for instance: exec 3 /dev/tcp/service/8642 printf 'GET /health HTTP/1.1\r\nHost: service\r\nConnection: close\r\n\r\n' >&3 cat Where `service` is just the hostn…

It seems pretty cool, but I am wondering if there's any drawback on just using images that support curl? I can't think of any and to me it's kinda a must have, even on production images

More than one ~500 employee company I've worked at has had security policies either encouraging or requiring the use of "distro-less" images - images with no OS components other than the absolute minimum required to run the application. For go binaries this meant literally nothing in the container apart from the executable.

In theory it has a couple of benefits. You don't have to re-deploy your image to patch CVE's in OS components if you don't have any OS components. And it provides some measure of defence-in-depth - one could certainly theory-craft a scenario where an attacker gains some limited control over your application and then uses some OS component to escalate.

These days if a security engineer is proposing my team adopt distro-less containers to receive these benefits, I would point out that we need to weigh them against the very real drawbacks of not having standard debugging tools available where and when we need them. And also to consider the relative impact of other defence-in-depth measures they could be pursuing instead - such as any sort of network policy to limit network traffic.

Re: TIL: You can make HTTP requests without curl using Bash /dev/TCP

#20

Post by bearjaws »

mrshu wrote: post #12
basilikum wrote: post #8

> As it turns out, bash can speak HTTP by itself. No, it can not. Bash lets you open TCP sockets. What you are doing here is trying to speak HTTP yourself, which is fine for testing and debugging, and hella cool for fun to do by hand, but you will shoot yourself in the foot if you try to use this pseudo http client unattended in reality. This toy code does not parse HTTP properly and will break. You could of course w…

> No, it can not. Bash lets you open TCP sockets. Very fair pushback -- I did get carried away and will update the article to be more precise. Thanks for raising it! > For less insane, non-bash shells there is always nc which is usually probably the wiser choice. For completeness, `nc` or any netcat equvialent I could think of was not available in the image I was trying this with. It would certainly be a better optio…

This is the most Claude pilled comment I've seen here.
Post reply on HN