Hi,I am new to docker and I find docker is easy to deploy services and I like it.I have use traefik to reverse-proxy containers on the same docker,and I can visit their webpages with domain.But I can’t apply the same thing to services that are outside of docker.
I have done some research,the answer may be related to docker’s nat.So I created a new VM to test it.The new VM only installed docker,and has only one container which is nginx.Let’s call the new VM’s nginx n2,because the old VM I used has a nginx too,let’s call that n1.I will use n1 as a reverse proxy later with traefik disabled.
Before test,I will tell you what I have done yet.I run VMware on a windows machine which IP address is 192.168.0.197,and use it to create 2 VMs.And there is a service running on windows has a webpage.Frist VM,VM1,is using Ubuntu server 20.04 as OS,with webmin and docker 20.10.17 installed,with 3 containers(portainer,traefik,nginx),IP 192.168.0.130.Second VM,VM2,also Ubuntu server 20.04,docker 20.10.17,nginx,IP 192.168.0.120.VM1 have are not enabled promiscuous mode yet.VM2 will not enable promiscuous mode.
All file related are show below:
traefik.yml
log:
level: DEBUG
filePath: /etc/traefik/logs/traefik.log
accessLog:
filePath: /etc/traefik/logs/traefik-access.log
api:
dashboard: true
debug: true
entryPoints:
web:
address: :80
providers:
docker:
exposedByDefault: false
watch: true
file:
filename: /config.yml
directory: /etc/traefik
watch: true
docker-compose.yml for traefik
version: "3"
services:
traefik:
image: traefik:latest
container_name: traefik
restart: unless-stopped
networks:
- "traefik_test"
ports:
- 80:80
volumes:
- /var/run/docker.sock:/var/run/docker.sock
- /etc/localtime:/etc/localtime:ro
- /home/me/docker/traefik:/etc/traefik
- /home/me/docker/traefik/config.yml:/config.yml
- /home/me/docker/traefik/logs:/etc/traefik/logs
networks:
traefik_test:
external: true
docker- compose.yml for n1
version: "3"
services:
nginx:
image: nginx:latest
container_name: nginx
restart: unless-stopped
networks:
- "traefik_test"
ports:
- 180:80
volumes:
- /home/me/docker/nginx/conf.d:/etc/nginx/conf.d
docker- compose.yml for n2
version: "3"
services:
nginx:
image: nginx:latest
container_name: nginx
restart: unless-stopped
ports:
- 180:80
config.yml
http:
routers:
traefik:
entryPoints:
- web
rule: "Host(`traefik.test.lan`)"
service: api@internal
n1:
entryPoints:
- web
rule: "Host(`n1.test.lan`)"
service: n1
n2:
entryPoints:
- web
rule: "Host(`n2.test.lan`)"
service: n2
app:
entryPoints:
- web
rule: "Host(`app.test.lan`)"
service: app
services:
n1:
loadBalancer:
servers:
- url: "http://192.168.0.130:180"
n2:
loadBalancer:
servers:
- url: "http://192.168.0.120:180"
app:
loadBalancer:
servers:
- url: "http://192.168.0.197:1235"
nginx.conf(I actually use one at a time)
server {
listen 80;
server_name 192.168.0.130:9000;
location / {
proxy_pass http://portainer.test.lan/;
}
}
server {
listen 80;
server_name 192.168.0.120:180;
location / {
proxy_pass http://n2.test.lan/;
}
}
server {
listen 80;
server_name 192.168.0.197:1235;
location / {
proxy_pass http://app.test.lan/;
}
}
This the line I created macvlan,Don’t worry they will not confilct with my other devices.
docker network create -d macvlan --subnet=192.168.0.0/24 --gateway=192.168.0.1 -o parent=ens32 macvlan
So let’s start the test.N1 was not configed yet.I first used traefik as reverse proxy provider,opened traefik dashboard and saw services running,then visiting webpages one by one,then changed network type one by one.Then I shuted down traefik,changed configraton in nginx.conf one by one.And changed n1’s port to 80.And repeat.Then enabled promiscuous mode on VM1 and repeat.Then deleted nginx.conf and changed n1’s port to 180 and started traefik.And repeat.
Test result:
N2 is showing 404.App is showing 504.
From start to end,traefik cannot reverse-proxy services outside of docker,not even by traefik’s ip.Last line is the most interested.With promiscuous mode enabled,and macvlan mode,although I can’t visit n2 and app by domain,but I can visit them by nginx’s ip.So it means container using macvlan with promiscuous mode enabled can communicate with services outside of docker.But why not by domain?
Messing up with promiscuous mode eventually caused VM1’s docker broke down.I can’t visit containers’ webpage on VM1 again.
So can anyone teach me how to let traefik reverse-proxy services outside of docker.
