Make internal
networks not overlay networks #62
Labels
No Label
abra
abra-gandi
awaiting-feedback
backups
bug
build
ci/cd
community organising
contributing
coopcloud.tech
democracy
design
documentation
duplicate
enhancement
finance
funding
good first issue
help wanted
installer
kadabra
performance
proposal
question
recipes.coopcloud.tech
security
test
wontfix
No Milestone
No project
No Assignees
2 Participants
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: coop-cloud/organising#62
Loading…
Reference in New Issue
No description provided.
Delete Branch "%!s(<nil>)"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Apps in stacks shouldn't be able to see other apps in other stacks.
We're suspecting that
internal
is not quite so internal after all./cc @3wordchant
From https://docs.docker.com/compose/compose-file/compose-file-v3/#driver-1
And...
From https://docs.docker.com/network/bridge/
Makes me think this is what we wanted all along?
Sounds legit! Let's try it 👌
noises of everything breaking
Oh sheyat, I saw @roxxers also used this https://docs.docker.com/compose/compose-file/compose-file-v3/#internal in the mastodon configs! Another thing to ponder on!
I tried:
And saw:
internal: true
did work.I ran into this issue with coop-cloud/levelfly -- if it's on the same swarm box with another app that has a
db
container, it eventually loses track of which one it's meant to point at.From
app
:In
db
:Changing the
internal
network to bothinternal: true
, anddriver: bridge
, but redeploying doesn't seem to do anything on a regulardeploy
; I got the same error message withdriver: bridge
when I didundeploy
then re-deploy
.internal: true
has gone through OK, and I see it showing up as abridge
network now. This problem seems to take a while to crop up, so I'll check back in in a day or so.If that fixes it, recommend we mass-update (and probably redeploy..) all our apps.
OK nice @3wordchant! I've been low-key using
internal: true
on all things I package since and it has been doing what I think we originally intended. So, this sounds like the move alright. I think the mass-update would have to include a deletion of the unused overlay network to close the loop. Probably somenetwork ls -f ...
machinery can pull out only the overlay networks for a deletion command in a script.Investigate overlay internal network issueto Use `internal: true` to create bridge networks instead of overlay networksOK, I'm gonna try write a small wrapper script which helps automate these migrations over in https://git.autonomic.zone/coop-cloud/tyop. I've done enough mass typos to know that we'll be doing these as long as this project exists :)
Done!
tyop
is pretty broken but I think it will do the job 🚀(I might have missed some, so keep an eye out for this)
https://git.autonomic.zone/coop-cloud/tyop
Actually, we got this totally wrong.
internal: true
is still making overlay networks and in fact, it means that the container has no access to the internet! Not just the stacks on the other machines. We need to make a bridge network that is isolated from the other stacks but still has internet access. The saga continues. A new mass update coming soon...Use `internal: true` to create bridge networks instead of overlay networksto Make `internal` networks not overlay networksMaybe!
Summary is then:
Docker doesn't give us this stack level network encapsulation we need without some serious work arounds which are not workable for us (if new apps get added to the proxy network then Traefik needs to be restarted).
internal: true
seems required for some apps perhaps (levelfly) but not for all. So it seems like reverting that mass update would be the right thing to do now.Any container on the proxy network can see the rest and there is not much we can do about that! When we reference services in configs on those proxy networks, we need to do prefixing to avoid namespace conflicts (e.g.
${STACK_NAME}_app
/{{ env "STACK_NAME" }}_app
We should write out some docs on how we understand our networking setup to be working.
I'll try squash this and then close this off once and for all 🙈
Mass revert has taken place!
Annnddd https://docs.coopcloud.tech/networking/.