Bjorn you’re correct, dns names are available only on the inside of docker networks, and you could have same service names in different stacks with same service name (different stack name) and they won’t collide or resolve each other. If for instance nginx is in a stack with appA and appB, you could bind nginx to 80 external:80 internal then in nginx reverse proxy config :80{ proxy http://fqdn/appA/ appA:80, http://fqdn/appB/ appB:80} and in the stack appA and appB will each have their own (internal) IP, and they can bind to whatever ports they each want (80 above), and only things inside that stack can access/ping them since you aren’t exposing those services directly to the outside (only nginx service is exposed)
You could have 100 containers in the stack, in that stack network, all bound to their own port 80, not exposed; and then make 100 stanzas in your exposed reverse proxy to get traffic to them from the outside world.
To isolate different customer apps, or just for isolation security; you could have one stack do nothing but expose 80 to a proxy service container. AppA in a totally different stack (or just network), and run a proxy also in that stack, exposing port 81 for example. In the first stack (proxy only) have it reverse proxy :80{ http://fqdn/appA -> swarmhostfqdn:81} and in the appA stack’s proxy have it also reverse proxy to 10 different services names in that stack, all bound to their own port 80 but not otherwise accessible....
The proxy in the first network would be a point of compromise, but even if rooted can only access appA’s containers via the proxy in the appA stack, and couldn’t otherwise talk/hack directly appA’s service containers, only talk to them through whatever the appA proxy routes.
At the end of the day, unless you want to run separate routers, load balancers, and swarms, for each separate customer’s traffic, there will points on the network where all of your customer traffic comes back together before heading back out to the internet, so choose your battles.
Thanks @mh720 for taking the time to help me out. I ended up asking this question on reddit and twitter and got a few pointers, basically what you were saying as well. I guess I needed to write out my exact problem to get to a better question to ask. What I ended up doing that made it work for now was creating a new "public" network, let all the publishable services join that network and now I can route over my containers using their hostnames or IPs. This was what I was looking for. I've even gotten the reverse proxy setup now as well which automatically detects the service and adds it, so that seems to be working great.
Now to figure out if replication works as I think it does, but the main issue I was having and just couldn't wrap my head around is fixed and I've definitely learned a few things about swarm and how the networks in docker function.
Thanks again!
Isn't the more common convention in orchestration to use a specific tag (ie
my/service:1.0.1) so you can have rollbacks?
is there any better way of managing secrets if this is the case?
So yes, you can still login to a container that has a secret set and echo that value out, that's the reality with any secret system when you can read it - But the value can be encrypted at rest when not in use, and is only available when you mount it - not after, and not retrievable through layers
Think of it more of as a secure pipe to the secret rather than the secret itself being "secured" while mounted.
@dnordberg Read over https://www.alexandraulsh.com/2018/06/25/docker-npmrc-security/ for an example of why secrets are better. Read the update to the document last, but it should give you an idea of what Docker is actually securing
Hello everyone, I have recently done some courses on docker and kubernetes. Now I want to work on some real use cases which are being used in Production environments.
Could anyone here please tell any POC which I can pick up as a beginner to get a hands-on on both of them.
Could anyone here please tell any POC which I can pick up as a beginner to get a hands-on on both of them.
Hi,
I'm trying to containerize IIS running on Windows 2008R2 running on vSphere 6.7. My steps are as follows:
- convert .vmdk to .vhdx
- run Image2Docker 1.8.5
- ConvertTo-Dockerfile -ImagePath I:\cloneVMIIS_3.vhdx -OutputPath I:\container2\ -MountPath C:\Image\ -Artifact IIS -ArtifactParam 'Default Web Site/Asghar' -Force –Verbose
- in container2 I get the followings:
Generate_IIS : You cannot call a method on a null-valued expression.- config folder - wwwroot folder - IIS.json file - no DockerFile due to the following error:
At C:\Program Files\WindowsPowerShell\Modules\Image2Docker\1.8.5\Functions\Private\GenerateDockerfile.ps1:37 char:23 - ... ockerfile = & "Generate_$Artifact" -MountPath $MountPath -ManifestPat ...
~~~~~~~~~~~~~- CategoryInfo : InvalidOperation: (:) [Generate_IIS], RuntimeException
- FullyQualifiedErrorId : InvokeMethodOnNull,Generate_IIS
I’d be grateful if you could help me resolve this problem.
Many thanks,
Hi guys, it's been a while since I posted this in StackOverflow, and it's related with Docker Swarm visualizer and nginx config. It should be quite easy, but I'm not expert enough, perhaps one of you could help? Thanks https://stackoverflow.com/questions/57856434/nginx-password-protect-docker-visualizer
How to convert a java standlone app to web application or access via internet?
I come across several beautiful java standalone application..example DocFetcher...However there is no web interface available.
Is there a way to make it as web application using any tool or third party plugin or server?
Is there a way to launch in the server and access as jnlp from anywhere?
What would be the best and easiest way to convert a standalone jar or desktop java application to web server...
Not going to be a request and response..Instead wanted to do the same thing which we can do in the standlone......
Please kindly advise....
i f nothing is possible, is it possible via docker
looking for a solution via docker if possible
I was under the impression that those should normalize & be equal?
I´m deploy with docker service and have same as this $REGISTRY_DOMAIN:$REGISTRY_PORT/${IMAGE} \
--path.procfs /host/proc \
--path.sysfs /host/sys \
--path.rootfs /host \
--collector.filesystem.ignored-mount-points "^/(sys|proc|dev|etc)($|/)" \
--collector.textfile.directory /etc/node-exporter/
--path.procfs /host/proc \
--path.sysfs /host/sys \
--path.rootfs /host \
--collector.filesystem.ignored-mount-points "^/(sys|proc|dev|etc)($|/)" \
--collector.textfile.directory /etc/node-exporter/
this are commands to prometheus service
So, i want deploy with docker stack
How apply this commands in a ymal file ?
prometheus:
image: prom/prometheus:v2.0.0
volumes:
image: prom/prometheus:v2.0.0
volumes:
- prometheus_config_data:/etc/prometheus/
- prometheus_data:/prometheus
command:
- '--config.file=/etc/prometheus/prometheus.yml'
- '--storage.tsdb.path=/prometheus'
- '--web.console.libraries=/usr/share/prometheus/console_libraries'
- '--web.console.templates=/usr/share/prometheus/consoles'
I haven't well search