For some reason docker-compose does not like the address 203.0.113.1 for the gogs container in the below configuration. Note that in the below example I have Gogs running on 203.0.113.3 which works, but if I change that to 203.0.113.1 then the message:
ERROR: for f1d322793d47_docker_gogs_1 Cannot start service gogs: Address already in use.
I have checked to make sure no container using the ip address 203.0.113.1 is running so I'm curious whether docker-compose just disallows that address for some reason in general?
version: '3'
services:
gogs-nginx:
build: ./nginx
ports:
- "80:80"
networks:
mk1net:
ipv4_address: 203.0.113.2
gogs:
image: gogs/gogs
ports:
- "3000:3000"
volumes:
- gogs-data:/data
depends_on:
- gogs-nginx
networks:
mk1net:
ipv4_address: 203.0.113.3
volumes:
gogs-data:
external: true
networks:
mk1net:
ipam:
config:
- subnet: 203.0.113.0/24
In a network there are three IPs which are normally reserved for specific tasks.
0 is used as network address. 1 is used as Gateway address and 255 is used as Broadcast Address.
If one container wants to communicate with an other container in the same network he can speak with him directly. When he wants to talk with some other IP outside his network he sends his request to the Gateway address and hopes the Gateway knows how to route this.
To see this you can inspect a docker container and check his Gateway property near the IPAddress.
Or use ifconfig (Linux) and search for a network with the same id as your created one. This network will have the IP 203.0.113.1
So your IP is already used by the Network Gateway.
In docker compose version 2 there is a config to change the Gateway and Broadcast ip.
For version 3 it seems the config is currently not supported.
Update: docker compose version 3 now has ipam.gateway. See config
If some docker service happens to not have an ip address explicitly assigned, it is assigned automatically/randomly the first free one, if it happens to be coincidentally the same one as one of the ip addresses explicitly assigned in the docker-compose service definition later/afterwards, then they get into conflict, and it fails with the said error message.
Related
how can we run docker commands inside container with docker-compose?
Simply I want to get IP of some other network container.
I am running three container va-server, db and api-server. All the containers are in same docker-network
Here I am providing docker-compose file below:
version: "2.3"
services:
va-server:
container_name: va_server
image: nitinroxx/facesense:amd64_2022.11.28 #facesense:alpha
runtime: nvidia
restart: always
mem_limit: 4G
networks:
- perimeter-network
db:
container_name: mongodb
image: mongo:latest
ports:
- "27017:27017"
restart: always
volumes:
- ./facesense_db:/data/db
command: [--auth]
networks:
- perimeter-network
api-server:
container_name: api_server
image: nitinroxx/facesense:api_amd64_2022.11.28
ports:
- "80:80"
- "465:465"
restart: always
networks:
- perimeter-network
networks:
perimeter-network:
driver: bridge
ipam:
config:
- gateway: 10.16.239.1
subnet: 10.16.239.0/24
I have install docker inside the container which giving me below permission error:
docker.errors.dockerexception: error while fetching server api version: ('connection aborted.', permissionerror(13, 'permission denied')
...inside [a] container [...] I want to get IP of some other network container....
Docker provides an internal DNS service that can resolve container names to their Docker-internal IP addresses. From one of the containers you show, you could look up a host name like db to get the container's IP address; but in practice, this is a totally normal DNS name and all but the lowest-level networking interfaces can use those directly.
This does require that all of the containers involved be on the same Docker network. Normally Compose sets this up automatically for you; in the file you show I might delete the networks: blocks and container_name: overrides in the name of simplicity. Also see Networking in Compose in the Docker documentation.
In short:
You can probably use the Compose service names va-server, db, and api-server as host names without specifically knowing their IP addresses.
This probably means you never need to know the container IP addresses at all (they're usually unusable from outside Docker).
If you do need an IP address from inside a container, a DNS lookup can find it.
You can't usually run docker commands from inside containers. You can't do this safely without making it possible for the container to take over the whole host. There are usually better patterns that don't tie you to the Docker stack specifically.
I set up a Docker host with rootless. Portainer is working fine and I also can start with the following compose file the openproject but only when I run it on the standard bridge network from docker.
I have created several network adapter on my docker host (debian). So i have there for example
ens1283 = 192.168.10.5
ens3283 = 192.168.50.11
Why: ens3283 has on the host of course a mac address which gives me the possibility to distribute a fixed ip.
Now I created a bridge on portainer with the following settings:
Nam VLAN50FIX11
ID 2725cc96b95b7de962a5a69d3437e0b601f4606782ad97bffe8234166eaab93e
Driver bridge
Scope local
Attachable false
Internal false
IPV4 Subnet - 172.17.11.0/16 IPV4 Gateway - 172.17.11.1
IPV4 IP range - 172.17.11.1/25 IPV4 Excluded Ips
Access control
Ownership administrators
Network options
com.docker.network.bridge.enable_icc true
com.docker.network.bridge.enable_ip_masquerade true
com.docker.network.bridge.host_binding_ipv4 192.168.50.11
com.docker.network.bridge.name VLAN50FIX11
com.docker.network.driver.mtu 1500
I also tried it with different network so: 192.168.50.0/24 and a lot other version.
But I had never luck I always got ERR_SS_PROTOCOL_ERROR in the browser. When I start the stack with the default bridge, it works fine.
Docker compose file:
version: '3.9'
services:
openproject:
hostname: SVGXXX-OPEN-01
image: openproject/community:12.1.5
networks:
- VLAN50FIX11
ports:
- 8181:80
container_name: openproject
environment:
- PUID=1001
- PGID=1001
- SECRET_KEY_BASE=9jsdjkSKjf99847459Dg7956ds61
volumes:
- /var/lib/containers/openproject/pgdata:/var/openproject/pgdata
- /var/lib/containers/openproject/assets:/var/openproject/assets
restart: unless-stopped
networks:
VLAN50FIX11:
external: true
I always recieve: ERR_SSL_PROTOCOL_ERROR when I start the openproject stack.
What do I need to change?
Thanks for your help
Perhaps you have to set
OPENPROJECT_HTTPS=false
disables the on-by-default HTTPS mode of OpenProject so you can access
the instance over HTTP-only. For all production systems we strongly
advise not to set this to false, and instead set up a proper TLS/SSL
termination on your outer web server.
https://www.openproject.org/docs/installation-and-operations/installation/docker/#all-in-one-container
I'im fairly new to docker and docker compose.
I have a simple scenario, based on three applications (app1, app2, app3) that I want to connect to my host's network. The purpose is having an internet connection also inside the container.
Here is my docker-compose file:
version: '3.9'
services:
app1container:
image: app1img
build: ./app1
networks:
network_comp:
ipv4_address: 192.168.1.1
extra_hosts:
anotherpc: 192.168.1.44
ports:
- 80:80
- 8080:8080
app2container:
depends_on:
- "app1container"
image: app2img
build: ./app2
networks:
network_comp:
ipv4_address: 192.168.1.2
ports:
- 3100:3100
app3container:
depends_on:
- "app1container"
image: app3img
build: ./app3
networks:
network_comp:
ipv4_address: 192.168.1.3
ports:
- 9080:9080
networks:
network_comp:
driver: ""
ipam:
driver: ""
config:
- subnet: 192.168.0.0/24
gateway: 192.168.1.254
I already read the docker-compose documentation, which says that there is no a bridge driver for Windows OS. Is there anyway a solution to this issue?
You shouldn't usually need to do any special setup for this to work. When your Compose service has ports:, that makes a port available on the host's IP address. The essential rules for this are:
The service inside the container must listen on the special 0.0.0.0 "all interfaces" address (not 127.0.0.1 "this container only"), on some (usually fixed) port.
The container must be started with Compose ports: (or docker run -p). You choose the first port number, the second port number must match the port inside the container.
The service can be reached via the host's IP address on the first port number (or, if you're using the older Docker Toolbox setup, on the docker-machine ip address).
http://host.example.com:12345 (from other hosts)
|
v
ports: ['12345:8080'] (in the `docker-compose.yml`)
|
v
./my_server -bind 0.0.0.0:8080 (the main container command)
You can remove all of the manual networks: configuration in this file. In particular, it's problematic if you try to specify the Docker network to have the same IP address range as the host network, since these are two separate networks. Compose automatically provides a network named default that should work for most practical applications.
I want to connect two Docker containers, defined in a Docker-Compose file to each other (app and db). And one of them (app) should also be connected to the host network.
The containers should be connected to a common user-defined network (appnet or default) to use the embedded DNS capabilities from docker networking.
app needs also to be directly connected to the host network to receive ethernet broadcasts (network layer 2) in the physical network of the docker host.
Using both directives network_mode: host and networks in compose together, results in the following error:
ERROR: 'network_mode' and 'networks' cannot be combined
Specifying the network name host in the service without defining it in networks (because it already exists), results in:
ERROR: Service "app" uses an undefined network "host"
Next try: define both networks explicitly and do not use the network_mode: host attribute at service level.
version: '3'
services:
app:
build: .
image: app
container_name: app
environment:
- MONGODB_HOST=db
depends_on:
- db
networks:
- appnet
- hostnet
db:
image: 'mongo:latest'
container_name: db
networks:
- appnet
networks:
appnet: null
hostnet:
external:
name: host
The foregoing compose file produces an error:
ERROR: for app network-scoped alias is supported only for containers in user defined networks
How to use the host network, and any other user-defined network (or the default) together in Docker-Compose?
TL;DR you can't. The host networking turns off the docker network namespace for that container. You can't have it both on and off at the same time.
Instead, connect to your database with a published port, or a unix socket that you can share as a volume. E.g. here's how to publish the port:
version: "3.3"
services:
app:
build: .
image: app
container_name: app
environment:
- MONGODB_HOST=127.0.0.1
db:
image: mongo:latest
container_name: db
ports:
- "127.0.0.1:27017:27017"
To use host network, you don't need to define it. Just use "ports" keyword to define, which port(s) from service you want to expose in host network.
Since Docker 18.03+ one can use host.docker.internal to access your host from within your containers. No need to add host network or mix it with the user defined networks.
Source: Docker Tip #65: Get Your Docker Host's IP Address from in a Container
I have a docker-compose file which is globally like this.
version '2'
services:
app:
image: myimage
ports:
- "80:80"
networks:
mynet:
ipv4_adress: 192.168.22.22
db:
image: postgres:9.5
ports:
- "6432:5432"
networks:
mynet:
ipv4_adress: 192.168.22.23
...
networks:
mynet:
driver: bridge
ipam:
driver: default
config:
- subnet: 192.168.22.0/24
I want to put my postgresql and application in subnetworks to avoid the ports to be exposed outside my computer/server.
From within the app container, I can't connect to 192.168.22.23, I installed net-tools to use ifconfig/netstat, and it doesn't seem the containers are able to communicate.
I assume I have this problem because I'm using subnetworks with static ipv4 adresses.
I can access both static IPs from the host (connect to postgres and access the application)
Do you have any piece of advice, the goal is to access the ports of another container to communicate with him, without removing the use of static ips (on app at least). Here, to connect to postgresql from the app container.
The docker run -p option and Docker Compose ports: option take a bind address as an optional parameter. You can use this to make a service accessible from the same host, but not from other hosts:
services:
db:
ports:
- '127.0.0.1:6432:5432'
(The other good use of this setting is if you have a gateway machine with both a public and private network interface, and you want a service to only be accessible from the private network.)
Once you have this, you can dispense with all of the manual networks: setup. Non-Docker services on the same host can reach the service via the special host name localhost and the published port number. Docker services can use inter-container networking; within the same docker-compose.yml file you can use the service name as a host name, and the internal port number.
host$ PGHOST=localhost PGPORT=6432 psql
services:
app:
environment:
- PGHOST=db
- PGPORT=5432
You should remove all of the manual networks: setup, and in general try not to think about the Docker-internal IP addresses at all. If your Docker is Docker for Mac or Docker Toolbox, you cannot reach the internal IP addresses at all. In a multi-host environment they will be similarly unreachable from hosts other than where the container itself is running.