Help: ssrf_proxy prompt "Recv recv: (111) Connection refused"

[dllkg]

Self Checks

• I have searched for existing issues search for existing issues, including closed ones.
• I confirm that I am using English to submit this report (我已阅读并同意 Language Policy).
• [FOR CHINESE USERS] 请务必使用英文提交 Issue，否则会被关闭。谢谢！:)
• Please do not modify this template :) and fill in all the required fields.

1. Is this request related to a challenge you're experiencing? Tell me about your story.

Just finished the private deployment of Dify community version 1.11.3, and found a prompt in the log: “ssrf_proxy-1 | 2026/01/14 06:38:12 | Recv recv: (111) Connection refused”. How should I solve this problem?

2. Additional context or comments

No response

[dosubot[bot]]

The ssrf_proxy in Dify acts as a Squid-based proxy to control and secure outbound network requests from your containers. The “Recv recv: (111) Connection refused” message means the proxy tried to connect to a service (often the sandbox or an external endpoint) but the connection was refused—usually because the target service isn’t running, isn’t reachable, or the proxy config is incorrect.

Here’s how to troubleshoot:

1. Make sure the ssrf_proxy and sandbox containers are both running and healthy. If either is down, restart them.
2. Check your docker-compose.yaml: ssrf_proxy should use the ubuntu/squid image, and the sandbox service should set HTTP_PROXY and HTTPS_PROXY to http://ssrf_proxy:3128. All related services (api, worker, sandbox, ssrf_proxy) must be on the same Docker network (ssrf_proxy_network) source.
3. Review docker/ssrf_proxy/squid.conf.template. Make sure the domains and ports you need are allowed. If you’re connecting to a new domain or non-standard port, add the appropriate ACLs and http_access rules source.
4. If you changed any config or environment variables, restart all related containers (dify, plugin daemon, ssrf_proxy) to clear caches and reload proxy rules source.
5. Some users have resolved similar errors by leaving SSRF_PROXY_HTTP_URL and SSRF_PROXY_HTTPS_URL blank in their configuration source.
6. Check the Squid logs (in the ssrf_proxy container) for more details. You can enable debug logging by setting LOG_LEVEL=DEBUG in your .env file source.

If the problem persists, sharing your docker-compose logs, .env, and squid.conf.template can help pinpoint the issue.

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}