with a socket proxy on a Swarm

[IGitYou]

Hello all.

I just tried to stand up a dozzle interest in my dev env in hopes to make my life a little easier.

Seeing it uses the socket to connect and I just went through a round of hardening on my box, I do not expose the socket to any service anymore except a proxy.

I was able to get this somewhat working using your documentation, but was hoping there was a way for me to tell Dozzle to only use a socket proxy running locally on that node. This would permit local access to the local socket.

Currently it appears to query and let the swarm LB determine which container it will land on. I do not get full representation of the cluster and have some other behaviors that I am betting are related.

I played with this yesterday and could not get it working. Wondering if anyone has a working config like this involving both a socket proxy and a Swarm cluster in Docker.

thanks for any insights.

[amir20]

I was able to get this somewhat working using your documentation, but was hoping there was a way for me to tell Dozzle to only use a socket proxy running locally on that node. This would permit local access to the local socket.

I am not sure what this means. Just set up a proxy and point Dozzle to it as documented.

Currently it appears to query and let the swarm LB determine which container it will land on. I do not get full representation of the cluster and have some other behaviors that I am betting are related.

What is it? Dozzle on swarm needs to get deployed on every node in swarm. They all communicate together to accurately represent all the containers in the cluster. Dozzle doesn't use swarm API as it is unstable and doesn't work.

I would recommend first setting up Dozzle without any proxies and then moving to proxy.

If there are any bugs without proxy then I think it's worth opening issues so I can see if they are really bugs. If something doesn't work with a proxy, then you'll need to investigate yourself as it is outside of my scope to support all proxy types out there.

If something is missing in the docs, then a PR would be appreciated.

Finally, when asking for help, it would be best to share all your configuration.

[amir20]

This is exactly what I tried but specifying localhost does not work (maybe it goes to the dozzle local container?) and I have not figured out a way to explicitly ensure that Dozzle uses the socket proxy that is local.

Can you share config? Because that should work.

Edit:

maybe it goes to the dozzle local container

Yes that's what it would do. But I assume you were able to point to the proxy.

[IGitYou]

I will try to make a basic example config and get it up here. THanks

Yes that's what it would do. But I assume you were able to point to the proxy.
I can point it to the proxy by service name and network alias. Doing so does not always point it to the local instance of the service. using localhost is not working because I think it is looking inside the container for the proxy... which is naturally wrong.

This is the issue. I believe it goes to the Swarm DNS and does a lookup and the swarm determines which of the services IPs it is going to get you. Specifying a network translatable address does not assure the local instance will work and the swarm directions assume it is using the direct socket. The question: How to configure a socket proxy to a local socket proxy instance to emulate the desired swarm config of this service.

I tried to change the service name to append a NodeHostName or whatever to it and have not been successful. I am not great at most I do (at first), but research shows my approach may not be supported (server templates in swarm service compose files).

If localhost were translated as the local instance of the container I do not think I would have an issue. I think ContainerID:Port would work because I can see this as the DNS alias. This is my attempted config.

[amir20]

I see your problem now. I think you have to use network host mode and point to host.docker.internal. To be honest, I do not know either. I don't have a lot of time to test things. I'll wait until you provide an example.

I hope we can figure this out to document for other people. I bet with ChatGPT there is a way to get something working. :P

[amir20]

I did some reading last night. I am afraid this is not possible. Swarm services can only communicate with other services. You can use network_mode: host but I wouldn't recommend it.

Your best option is to set up each node manually with one central UI.

I have updated the documentation to reflect this.

[IGitYou]

host networking will not work as it is not a swarm thing
You can do macvlan networking and you may get that to work... but then you end up tring to assing static IPs and stuff gets messy from them on out.

I feel like if I could append the cluster node name to each service I could do it.

I also feel like each is uniquely addressible by the containers DNS addressible name... but building that out would involve the nodeID and the containerID . I am failing at even the nodeName.

THanks for your feedback.

I read that localhost is specially translated by dozzle in the docs. I did not read any details at what that meant specificlly. I was hoping it did some magic.

I know service discovery based on port should be possible. It is with other services I run. Perhaps there is an opportunity to be able to resolve 127.0.0.1:2037 (or whatever teh socket's port is) and have it do local port discovery on all networks . I question if that would not work.

I was just hoping I was not a pioneer in this issue.

Thanks again.

Your answer is not accurate though because host networking cannot be used in a swarm

[amir20]

@IGitYou

According to ChatGPT. These are your options:

You're absolutely correct! When a container connects to localhost, it's connecting to the container's own network namespace, not the host. Let me clarify the proper approaches:

Host Network Mode (Corrected)

When using host network mode, the container shares the host's network namespace, so localhost actually works:

version: '3.8'
services:
  proxy:
    image: your-proxy-image
    network_mode: host  # Shares host network
    deploy:
      mode: global
  
  app:
    image: your-app-image
    network_mode: host  # Also shares host network
    environment:
      - PROXY_URL=http://localhost:8080  # This works because both use host network
    deploy:
      mode: global

Published Ports (Most Common Solution)

For containers with default bridge/overlay networks, you need to connect to the host IP:

version: '3.8'
services:
  proxy:
    image: your-proxy-image
    ports:
      - "8080:80"  # Published to host
    deploy:
      mode: global
  
  app:
    image: your-app-image
    environment:
      # Connect to host IP, not localhost
      - PROXY_URL=http://host.docker.internal:8080  # Docker Desktop
      # OR discover host IP dynamically (see below)
    deploy:
      mode: global

Using Docker's Special DNS Names

In newer Docker versions, you can use special hostnames:

version: '3.8'
services:
  proxy:
    image: your-proxy-image
    ports:
      - "8080:80"
    deploy:
      mode: global
  
  app:
    image: your-app-image
    environment:
      # These work in some Docker environments
      - PROXY_URL=http://host.docker.internal:8080  # Docker Desktop
      # OR
      - PROXY_URL=http://gateway.docker.internal:8080
    deploy:
      mode: global

Unfortunately, I don't think any of these are great ideas. It seems that swarm mode with proxy is not a good option. This isn't a problem with Dozzle so there isn't anything I can do.

[amir20]

I think applications like yours could specify an option to use local socket proxy

How would I do that? localhost pointing to the container is a Docker feature. I don't control it. Your only option is to run a sock file that is a wrapper around the docker.sock and mount that file.

I do not think that swarm with a socket proxy is a bad option

I'd say given the complexity, it's not a very popular option.

At this point, I'll wait to see if you come up with any solutions. Dozzle is not different than any other containers. So if you find an example where someone can run service in swarm and also connect to a local proxy then I can see how it is done.

[IGitYou]

I am no expert... a little battle torn perhaps.

I would think if you had a variable that dynamically pulled the nodeID, or an env variable that allowed translation to a unique address that would help with the issue.

I am thinking perhaps if I can get arround relabling, perhaps I can do somethign like that and work it out.

[IGitYou]

Just to follow-up I took it to the proxy container owner. You are right, this functionality should not be consumer dependent. I have some ideas I may play with. I will let you know if I crack the nut but I have just momentarily acceptted that socket based solutions which need local node access are not able to be used until I solution it. I think I realized the scope when playing with your solution and realized I was having other solutions that have the same needs having the same problem. I think you were onto something with loading up the socket with a local only network and perhaps isolating it like that..... I will have to poke more in my next feature release.

[IGitYou]

Following up here... I found out how to make it work...I will confirm with your container too soon...

wollomatic/socket-proxy#115

[amir20]

Just update the documentation if you see something working.