Uh, I don’t think nginx can work as a socks proxy, at least I’ve never tried? Why can’t it access straight out or through a tunnel, or reverse proxy recaptcha or so?

EDIT: Apparently there is a socks plugin for nginx, did you compile it in? It looks like it might be a bit out of date too…

Well if it needs internet access then that needs to be supplied somehow. A single outgoing port and then binding to it for your outgoing connections (or a pool of them) seems perfectly sufficient since no incoming connections would be allowed? Or if you need an incoming connection too then a single port for that or whatever.

Docker can do it all fine already, just expose the specific port you want to listen in for incoming connections (if any) and just let it communicate ‘out’ via a bridge network to the host.

Are you actually wanting to restrict it to specific domains only? A reverse proxy would be safer there.

Well what are the very specific requirements you are needing first?

Do you need incoming connections, outgoing connections, both? Do they need to be restricted to very specific sets of IP’s, domains, data, etc…? Etc…

That then begs the question, ‘what’ is making the remote API call, is it your own controlled code or some untrusted user code?