Solved it. At least partially. The container dns-resolved git.mydomain.com and chat.mydomain.com to the external address which gets nat’ed and then forwarded with haproxy. For some reason there is an issue with sso in that scenario. I’ve temporary extended the /etc/hosts of the container to contain the mapping of git.mydomain.com and chat.mydomain.com to the internal address of haproxy. This made the sso working. But it would be nice to know about the reason for this behaviour.