DockerSwarm - Revision history

T1t0: /* Tunneling an internal container port */

2025-05-02T22:34:25Z

Tunneling an internal container port

← Older revision		Revision as of 22:34, 2 May 2025
Line 414:		Line 414:
	* first, create a new container in the same network that tunneling and export a new port to a specific host node, in this example is a rabbitmq_service_name (available in the rabbit_network network) instance port exported in the 55555 host port		* first, create a new container in the same network that tunneling and export a new port to a specific host node, in this example is a rabbitmq_service_name (available in the rabbit_network network) instance port exported in the 55555 host port
	<pre>		<pre>
			version: '3.7'

			networks:
			rabbit_network:
			external: true

			services:
	socat-tunneling:		socat-tunneling:
	image: ~~jonlabelle~~/~~network-tools~~		image: 'alpine/socat:1.8.0.3'
	entrypoint: socat -dd TCP-LISTEN:55555,fork TCP:rabbitmq_service_name:5672		entrypoint: socat -dd TCP-LISTEN:55555,fork TCP:rabbitmq_service_name:5672
	networks:		networks:
Line 425:		Line 432:
	deploy:		deploy:
	endpoint_mode: dnsrr		endpoint_mode: dnsrr
	~~mode: replicated~~
	~~replicas: 1~~
	placement:		placement:
	constraints:		constraints:

T1t0: /* Tunneling an internal container port */

2023-12-20T11:35:48Z

Tunneling an internal container port

← Older revision		Revision as of 11:35, 20 December 2023
Line 435:		Line 435:
	<pre>		<pre>
	ssh -v -C -N -L 0.0.0.0:5672:localhost:55555 NODE_HOSTNAME		ssh -v -C -N -L 0.0.0.0:5672:localhost:55555 NODE_HOSTNAME
			</pre>

			* you can also use this port in a local container (e.g. to replace a local service) with:
			<pre>
			rabbitmq-emulated:
			image: jonlabelle/network-tools
			entrypoint: socat -dd TCP-LISTEN:5672,fork TCP:host.docker.internal:5672
			extra_hosts:
			- "host.docker.internal:host-gateway"
	</pre>		</pre>

T1t0: /* Notes */

2023-12-20T09:37:32Z

Notes

← Older revision		Revision as of 09:37, 20 December 2023
Line 388:		Line 388:
	</pre>		</pre>

	== Move a ~~volume~~ between nodes ==		== Move a Volume between nodes ==

	* from the source host:		* from the source host:
	<pre>		<pre>
	mkdir bkp		mkdir bkp
	docker run -it --rm -v VOLUME_NAME:/mnt/volume:ro -v $(pwd)/bkp:/bkp debian:stable-slim		docker run -it --rm -v <VOLUME_NAME>:/mnt/volume:ro -v $(pwd)/bkp:/bkp debian:stable-slim
	tar -czf /bkp/volume.tgz /mnt/volume		tar -czf /bkp/volume.tgz /mnt/volume
	exit		exit
Line 402:		Line 402:
	* from the dest host:		* from the dest host:
	<pre>		<pre>
	docker volume create --driver local --label com.docker.stack.namespace=OPTIONAL_LABEL VOLUME_NAME		docker volume create --driver local --label com.docker.stack.namespace=<OPTIONAL_LABEL VOLUME_NAME>
	mkdir bkp		mkdir bkp
	mv volume.tgz bkp/		mv volume.tgz bkp/
	docker run -it --rm -v VOLUME_NAME:/mnt/volume:rw -v $(pwd)/bkp:/bkp debian:stable-slim		docker run -it --rm -v <VOLUME_NAME>:/mnt/volume:rw -v $(pwd)/bkp:/bkp debian:stable-slim
	tar -xzf bkp/volume.tgz		tar -xzf bkp/volume.tgz
	exit		exit
	</pre>		</pre>

			== Tunneling an internal container port ==

			* first, create a new container in the same network that tunneling and export a new port to a specific host node, in this example is a rabbitmq_service_name (available in the rabbit_network network) instance port exported in the 55555 host port
			<pre>
			socat-tunneling:
			image: jonlabelle/network-tools
			entrypoint: socat -dd TCP-LISTEN:55555,fork TCP:rabbitmq_service_name:5672
			networks:
			- rabbit_network
			ports:
			- target: 55555
			published: 55555
			mode: host
			deploy:
			endpoint_mode: dnsrr
			mode: replicated
			replicas: 1
			placement:
			constraints:
			- node.hostname == NODE_HOSTNAME
			</pre>

			* then, tunnel the remote host port to a local port as usual
			<pre>
			ssh -v -C -N -L 0.0.0.0:5672:localhost:55555 NODE_HOSTNAME
			</pre>

	[[Category:unix]]		[[Category:unix]]

T1t0: /* Notes */

2023-12-20T08:57:21Z

Notes

@@ Line 387: / Line 387: @@
        - 'STACK_NAMESPACE={{index .Service.Labels "com.docker.stack.namespace"}}'
 </pre>
 [[Category:unix]]

T1t0 at 19:57, 2 September 2023

2023-09-02T19:57:21Z

Show changes

T1t0: /* Using Traefik as edge proxy */

2023-09-02T19:22:34Z

Using Traefik as edge proxy

← Older revision		Revision as of 19:22, 2 September 2023
Line 66:		Line 66:

	from https://community.traefik.io/t/ping-endpoint-working-but-docker-healthcheck-fails/9845		from https://community.traefik.io/t/ping-endpoint-working-but-docker-healthcheck-fails/9845

			NOTE: please replace <YOUR_HOST> with the hostname of your loadbalancer

	<pre>		<pre>
Line 71:		Line 73:
	docker network create --driver=overlay --subnet=10.1.0.0/16 --attachable traefik-net		docker network create --driver=overlay --subnet=10.1.0.0/16 --attachable traefik-net
	cat > traefik.yml << 'EOF'		cat > traefik.yml << 'EOF'
	version: "3.7"		version: '3.7'

	networks:		networks:
Line 104:		Line 106:
	- '--providers.swarm.network=traefik-net'		- '--providers.swarm.network=traefik-net'
	- '--providers.swarm.endpoint=unix:///var/run/docker.sock'		- '--providers.swarm.endpoint=unix:///var/run/docker.sock'
	~~- '--metrics.prometheus=true'~~
	~~- '--metrics.prometheus.addEntryPointsLabels=true'~~
	~~- '--metrics.prometheus.addServicesLabels=true'~~
	~~- '--metrics.prometheus.buckets=0.1,0.3,0.5,1.0,5.0'~~
	~~- '--tracing.jaeger=true'~~
	~~- '--tracing.jaeger.samplingParam=0'~~
	~~- '--tracing.jaeger.traceContextHeaderName=X-Request-ID'~~
	environment:		environment:
	- 'LOG_ENABLED=true'		- 'LOG_ENABLED=true'
Line 149:		Line 144:

	# add dashboard route		# add dashboard route
	#- 'traefik.http.routers.dashboard-rt.rule=~~Path~~(`~~/dashboard~~`)'		- 'traefik.http.routers.dashboard-rt.rule=Host(`<YOUR_HOST>`) && (PathPrefix(`/api`) \|\| PathPrefix(`/dashboard`))'
	~~- 'traefik.http.routers.dashboard-rt.rule=~~PathPrefix(`/api`) \|\| PathPrefix(`/dashboard`)'
	- 'traefik.http.routers.dashboard-rt.service=api@internal'		- 'traefik.http.routers.dashboard-rt.service=api@internal'
	- 'traefik.http.routers.dashboard-rt.middlewares=traefik-auth'		- 'traefik.http.routers.dashboard-rt.middlewares=traefik-auth'

	# add metrics route		# add metrics route
	- 'traefik.http.routers.metrics-rt.rule=PathPrefix(`/metrics`)'		- 'traefik.http.routers.metrics-rt.rule=Host(`<YOUR_HOST>`) && PathPrefix(`/metrics`)'
	- 'traefik.http.routers.metrics-rt.service=prometheus@internal'		- 'traefik.http.routers.metrics-rt.service=prometheus@internal'

	EOF		EOF
	docker stack deploy -c traefik.yml traefik		docker stack deploy -c traefik.yml traefik

T1t0: Created page with "= Install = == Prerequisites == from https://kubernetes.io/docs/setup/production-environment/container-runtimes/ * OS commands

 apt-get -y install docker.io docker-com..."

2023-08-30T23:35:10Z

Created page with "= Install = == Prerequisites == from https://kubernetes.io/docs/setup/production-environment/container-runtimes/ * OS commands <pre> apt-get -y install docker.io docker-com..."

New page

= Install =

== Prerequisites ==

from https://kubernetes.io/docs/setup/production-environment/container-runtimes/

* OS commands
<pre>
apt-get -y install docker.io docker-compose > /dev/null
apt-get -y clean > /dev/null
</pre>

* OS configs
<pre>
mkdir -p /srv/local/swarm
useradd --system --uid 500 --gid nogroup --groups docker --no-create-home --home-dir /srv/local/swarm --shell /bin/bash swarm
chown swarm:nogroup /srv/local/swarm
</pre>

= Cluster setup =

* to create the leader node

<pre>
su - swarm
docker swarm init
docker node ls
</pre>

to get a token to add more managers nodes:
<pre>
docker swarm join-token manager
</pre>

to get a token to add worker nodes:
<pre>
docker swarm join-token worker
</pre>

* to add more nodes

for each node:

<pre>
su - swarm
docker swarm join --token <TOKEN_FROM_PREVIOUS_COMMANDS> <HOST:PORT_FROM_PREVIOUS_COMMANDS>
</pre>

Note: use the manager or worker tokens to add nodes as manager or worker, respectively

= Exposing cluster applications outside the cluster =

== Using Traefik as edge proxy ==

from https://blog.creekorful.org/2020/01/how-to-expose-traefik-2-dashboard-securely-docker-swarm/

and https://juliensalinas.com/en/traefik-reverse-proxy-docker-compose-docker-swarm-nlpcloud/

and https://www.rockyourcode.com/traefik-2-docker-swarm-setup-with-docker-socket-proxy-and-more/

and https://www.cometari.com/case-study/container-orchestration-with-docker-swarm-and-traefik

<pre>

* from any manager node

from https://community.traefik.io/t/ping-endpoint-working-but-docker-healthcheck-fails/9845

<pre>
su - swarm
docker network create --driver=overlay --subnet=10.1.0.0/16 --attachable traefik-net
cat > traefik.yml << 'EOF'
version: "3.7"

networks:
traefik-net:
external: true

services:
traefik:
image: traefik:v3.0
healthcheck:
test: traefik healthcheck --ping
interval: 3s
timeout: 2s
retries: 2
start_period: 10s
networks:
- traefik-net
ports:
- '30080:80'
volumes:
- '/var/run/docker.sock:/var/run/docker.sock:ro'
command:
- '--log.level=INFO'
- '--accesslog=true'
- '--entryPoints.web.address=:80'
- '--ping=true'
- '--api=true'
- '--api.dashboard=true'
- '--providers.swarm=true'
- '--providers.swarm.watch=true'
- '--providers.swarm.exposedbydefault=false'
- '--providers.swarm.network=traefik-net'
- '--providers.swarm.endpoint=unix:///var/run/docker.sock'
- '--metrics.prometheus=true'
- '--metrics.prometheus.addEntryPointsLabels=true'
- '--metrics.prometheus.addServicesLabels=true'
- '--metrics.prometheus.buckets=0.1,0.3,0.5,1.0,5.0'
- '--tracing.jaeger=true'
- '--tracing.jaeger.samplingParam=0'
- '--tracing.jaeger.traceContextHeaderName=X-Request-ID'
environment:
- 'LOG_ENABLED=true'
- 'LOG_SERVICE={{.Service.Name}}'
- 'LOG_TASK={{.Task.Name}}'
- 'LOG_IMAGE={{index .Service.Labels "com.docker.stack.image"}}'
- 'LOG_HOST={{.Node.Hostname}}'
logging:
driver: 'json-file'
options:
env: 'LOG_ENABLED,LOG_SERVICE,LOG_TASK,LOG_IMAGE,LOG_HOST'
max-size: '32m'
max-file: '1'
deploy:
mode: global
placement:
constraints:
- node.role == manager
restart_policy:
condition: any
delay: 5s
labels:
# enable traefik, because we disabled expose a service by default
- 'traefik.enable=true'

# dummy service required by swarm port detection, but not used, the port can be any integer value
- 'traefik.http.services.traefik-srv.loadbalancer.server.port=888'

# define middlewares
- 'traefik.http.middlewares.gzip.compress=true'
- 'traefik.http.middlewares.gzip.compress.excludedcontenttypes=image/png, image/jpeg, font/woff2'
# basicauth created with 'echo $(htpasswd -nb admin admin) | sed -e s/\\$/\\$\\$/g'
- 'traefik.http.middlewares.traefik-auth.basicauth.users=admin:$$apr1$$VJpGG3n7$$suGL0SjcG4V.RaMAgegZT1'

# add additional ping route
- 'traefik.http.routers.ping-rt.rule=Path(`/healthcheck`)'
- 'traefik.http.routers.ping-rt.service=ping@internal'

# add dashboard route
#- 'traefik.http.routers.dashboard-rt.rule=Path(`/dashboard`)'
- 'traefik.http.routers.dashboard-rt.rule=PathPrefix(`/api`) || PathPrefix(`/dashboard`)'
- 'traefik.http.routers.dashboard-rt.service=api@internal'
- 'traefik.http.routers.dashboard-rt.middlewares=traefik-auth'

# add metrics route
- 'traefik.http.routers.metrics-rt.rule=PathPrefix(`/metrics`)'
- 'traefik.http.routers.metrics-rt.service=prometheus@internal'
EOF
docker stack deploy -c traefik.yml traefik
</pre>

see service logs with
<pre>
docker service logs -f traefik_traefik
</pre>

Note: the traefik log and env statements are useful to capture logs data with tools like fluentbit, see [[Grafana]] and the next section

= Use placeholder to get docker infos =

from https://docs.docker.com/engine/swarm/services/#create-services-using-templates

and https://forums.docker.com/t/example-usage-of-docker-swarm-template-placeholders/73859

<pre>
version: '3'

services:
myservice:
image: 'myimage'
environment:
- 'TASK_NAME={{.Task.Name}}'
- 'TASK_SLOT={{.Task.Slot}}'
- 'SERVICE_ID={{.Service.ID}}'
- 'SERVICE_NAME={{.Service.Name}}'
- 'SERVICE_LABELS={{.Service.Labels}}'
- 'SERVICE_IMAGE={{index .Service.Labels "com.docker.stack.image"}}'
- 'STACK_NAMESPACE={{index .Service.Labels "com.docker.stack.namespace"}}'
</pre>

[[Category:unix]]
[[Category:linux]]
[[Category:debian]]
[[Category:container]]
[[Category:docker]]
[[Category:traefik]]