Socket Proxy and Portainer

[vmcosco]

I have my stack up and running using your guide. I did not implement socket-proxy from the start so I am going back to do that now. Using your t2 yaml file (not the blog) for a guide, I set up the socket_proxy network and the socket proxy container. Once that I was up, I edited the compose entries for Traefik and Portainer. Both recreated just fine. Traefik worked as expected. I kept getting an error message when I opened Portainer saying that environments could not be retrieved and when Portainer came up, my stack was "down". I checked the log and this is what I found:

"Instance already has defined environments. Skipping the environment defined via CLI."

I undid my Portainer compose (set it back to what it was without the proxy entries). I checked the environments in Portainer and the Environment URL is locked as "/var/run/docker.sock". The docker-compose file does not seem to be able to edit it. If I enter my socket-proxy IP into the "Public IP" field, and click update, all of my containers still show up.

Does that mean that socket-proxy is setup properly, and just that Portainer cannot be updated via CLI to use it?

I do have a second environment using Agent that I set up directly in Portainer. Is that maybe what caused the failure to update?

[uasdj25]

For what it's worth, I also experienced this issue. I went in and deleted the environment, and manually created a new one within Portainer. I just went to environments, clicked add, and I gave it the same name (primary). I also gave it a URL of socket-proxy:2375.

Once I did this, it cleared my error. Hopefully it works for you, too.

[marapavelka]

I have the same problem. I already have Portainer installed and about 30 containers in it. So I changed the yml file to use socket_proxy and manually added a new environment with the name primary (old was local) and URL socket-proxy:2375. When I open Portainer, I can see the new environment and the correct number of containers etc. and the status is up, but when I click on it, I get the error "Failed load environment. Unable to connect to the Docker environment." :(

[marapavelka]

I removed container with docker stop portainer && docker rm portainer, renamed portainer data folder, pulled new image with dcpull portainer and finaly created new container with dcup portainer. Still the same :(

Here is my docker-compose file:

version: "3.9"
networks:
  traefik_proxy:
    name: traefik_proxy
    driver: bridge
    ipam:
      config:
        - subnet: 192.168.101.0/24
  default:
    driver: bridge
  socket_proxy:
    name: socket_proxy
    driver: bridge
    ipam:
      config:
        - subnet: 192.168.102.0/24
secrets:
  htpasswd:
    file: $DIR_DOCKER/secrets/htpasswd
  cloudflare_email:
    file: $DIR_DOCKER/secrets/cloudflare_email
  cloudflare_api_key:
    file: $DIR_DOCKER/secrets/cloudflare_api_key
  cloudflare_api_token:
    file: $DIR_DOCKER/secrets/cloudflare_api_token
services:
  traefik:
    container_name: traefik
    image: traefik:2.6
    restart: unless-stopped
    command:
      - --global.checkNewVersion=true
      - --global.sendAnonymousUsage=true
      - --entryPoints.http.address=:80
      - --entryPoints.https.address=:443
      - --entrypoints.https.forwardedHeaders.trustedIPs=173.245.48.0/20,103.21.244.0/22,103.22.200.0/22,103.31.4.0/22,141.101.64.0/18,108.162.192.0/18,190.93.240.0/20,188.114.96.0/20,197.234.240.0/22,198.41.128.0/17,162.158.0.0/15,104.16.0.0/12,172.64.0.0/13,131.0.72.0/22
      - --entryPoints.traefik.address=:8080
      - --api=true
      - --api.dashboard=true
      - --log=true
      - --log.level=WARN
      - --accessLog=false
      - --accessLog.filePath=/traefik.log
      - --accessLog.bufferingSize=100
      - --accessLog.filters.statusCodes=400-499
      - --providers.docker=true
      - --providers.docker.endpoint=tcp://socket-proxy:2375
      - --providers.docker.exposedByDefault=false
      - --entrypoints.https.http.tls.options=tls-opts@file
      - --entrypoints.https.http.tls.certresolver=dns-cloudflare
      - --entrypoints.https.http.tls.domains[0].main=$DOMAINNAME
      - --entrypoints.https.http.tls.domains[0].sans=*.$DOMAINNAME
      - --providers.docker.network=traefik_proxy
      - --providers.docker.swarmMode=false
      - --providers.file.directory=/rules
      - --providers.file.watch=true
      - --certificatesResolvers.dns-cloudflare.acme.email=$CLOUDFLARE_EMAIL
      - --certificatesResolvers.dns-cloudflare.acme.storage=/acme.json
      - --certificatesResolvers.dns-cloudflare.acme.dnsChallenge.provider=cloudflare
      - --certificatesResolvers.dns-cloudflare.acme.dnsChallenge.resolvers=1.1.1.1:53,1.0.0.1:53
      - --certificatesResolvers.dns-cloudflare.acme.dnsChallenge.delayBeforeCheck=90
    networks:
      traefik_proxy:
        ipv4_address: 192.168.101.254
      socket_proxy:
    security_opt:
      - no-new-privileges:true
    ports:
      - target: 80
        published: 80
        protocol: tcp
        mode: host
      - target: 443
        published: 443
        protocol: tcp
        mode: host
    volumes:
      - $DIR_DOCKER/traefik/rules:/rules
      - $DIR_DOCKER/traefik/acme/acme.json:/acme.json
      - $DIR_DOCKER/traefik/traefik.log:/traefik.log
      - $DIR_DOCKER/shared:/shared
    environment:
      - CF_API_EMAIL_FILE=/run/secrets/cloudflare_email
      - CF_API_KEY_FILE=/run/secrets/cloudflare_api_key
      - HTPASSWD_FILE=/run/secrets/htpasswd
    secrets:
      - cloudflare_email
      - cloudflare_api_key
      - htpasswd
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.http-catchall.entrypoints=http"
      - "traefik.http.routers.http-catchall.rule=HostRegexp(`{host:.+}`)"
      - "traefik.http.routers.http-catchall.middlewares=redirect-to-https"
      - "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"
      - "traefik.http.routers.traefik-rtr.entrypoints=https"
      - "traefik.http.routers.traefik-rtr.rule=Host(`traefik.$DOMAINNAME`)"
      - "traefik.http.routers.traefik-rtr.service=api@internal"
      - "traefik.http.routers.traefik-rtr.middlewares=chain-oauth@file"
  socket-proxy:
    container_name: socket-proxy
    image: tecnativa/docker-socket-proxy:latest
    restart: always
    networks:
      socket_proxy:
        ipv4_address: 192.168.102.254
    ports:
      - "2375:2375"
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock"
    environment:
      - LOG_LEVEL=info
      - EVENTS=1
      - PING=1
      - VERSION=1
      - AUTH=0
      - SECRETS=0
      - POST=1
      - BUILD=0
      - COMMIT=0
      - CONFIGS=0
      - CONTAINERS=1
      - DISTRIBUTION=0
      - EXEC=0
      - IMAGES=1
      - INFO=0
      - NETWORKS=1
      - NODES=0
      - PLUGINS=0
      - SERVICES=1
      - SESSION=0
      - SWARM=0
      - SYSTEM=0
      - TASKS=1
      - VOLUMES=1
  portainer:
    container_name: portainer
    hostname: portainer
    image: portainer/portainer-ce:latest
    restart: unless-stopped
    command: -H tcp://socket-proxy:2375
    networks:
      - traefik_proxy
      - socket_proxy
    security_opt:
      - no-new-privileges:true
    ports:
      - "$PORTAINER_PORT:9000"
    volumes:
      - $DIR_DOCKER/portainer/data:/data
    environment:
      - TZ=$TZ
      - DOCKER_HOST=socket-proxy:2375
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.portainer-rtr.entrypoints=https"
      - "traefik.http.routers.portainer-rtr.rule=Host(`portainer.$DOMAINNAME`)"
      - "traefik.http.routers.portainer-rtr.middlewares=chain-oauth@file"
      - "traefik.http.routers.portainer-rtr.service=portainer-svc"
      - "traefik.http.services.portainer-svc.loadbalancer.server.port=9000"

[boywiz]

Morning,
I think under your definition for the socket proxy you need:
hostname: socket-proxy

Mo

[marapavelka]

Still the same error :( Do I need to delete the persistent volume somehow? Because even if I delete the data folder, I still see the number of containers etc.

[uasdj25]

Only differences between my file and yours:

I don't specify a static address for containers.

I have the following under networks in the socket proxy portion of the compose file:

privileged: true

I don't have the DOCKER_HOST=socket-proxy2375 in the environment section for portainer

Basically the only differences in the compose file, anyway. I don't know if any of that helps, but hopefully it does.

[marapavelka]

Unfortunately, none of this helped :(