It works with Docker swarm ? #32

Activity

1. D0wn3r commented on Sep 19, 2024

   

   D0wn3r

   on Sep 19, 2024

   Author

   More actions

   It works if I set ip (but I would like it dynamic) and if I allow all GET

   services:
     dockerproxy:
       image: wollomatic/socket-proxy:1 # see https://github.com/wollomatic/socket-proxy for reference
       command:
         - '-loglevel=info' # set to debug for far more logging
         - '-allowfrom=10.0.2.67,10.0.2.68,10.0.2.62'
         - '-listenip=0.0.0.0'
         - '-allowGET=.*' # this regexp allows readonly access only for requests that traefik needs
         - '-shutdowngracetime=5'
         - '-watchdoginterval=600'
         - '-stoponwatchdog'
   
2. wollomatic commented on Sep 19, 2024

   

   wollomatic

   on Sep 19, 2024

   Owner

   More actions

   The above error message is caused by the -allowfrom configuration.

   If the hostnames in Swarm are dynamically generated, it is difficult to set an allowlist for them. A possibility would be to allow a local network range, e.g., -allowfrom=10.0.2.0/24. Please keep in mind that this can easily result in insecure configurations (on the other hand, most of the other Socket-Proxy-Software allows access from any IP).

   ---

   The -allowGET option depends on how you use Traefik:

   If you use the docker provider (https://doc.traefik.io/traefik/providers/docker/), the '-allowGET=/v1\..{1,2}/(version|containers/.*|events.*)' is fine for socket-proxy.

   You probably need another configuration for the allowlist if you use the swarm provider (https://doc.traefik.io/traefik/providers/swarm/): Maybe -allowGET=.* is fine in that case. You can enable the debug logging and see how the requests look. After that, you can create a more specific working regexp.

   Also, see #30

   (I'll convert this issue to a discussion)
3. Repository owner locked and limited conversation to collaborators on Sep 19, 2024
4. wollomatic

   converted this issue into a discussion #33 on Sep 19, 2024