Zero Down Time Deployment Node.js/NGINX Docker - docker

I have a React/Node.js application running on a single server using docker-compose. I'm trying to achieve a 0 downtime deployment for my react app. The process right now, does a webpack build (replaces the files in my dist folder) and then docker down and docker up. This whole process takes about 2-3 minutes.
I realized that with docker-compose I can scale my container up/down but I'm not sure how to only push my code to 1 of them, rebuild the webpack and npm restart it then kill other containers. I really don't want to use Kubernetes/Swarm or Openshift since it's a bit of overkill. I'm wondering if anyone else has achieved something similar to this.
My docker-compose looks like this:
node:
build:
context: ./env/docker/node
args:
- PROJECT_ROOT=/var/www/app
image: react_app:rapp_node
command: "npm run prod"
expose:
- "3333"
networks:
- react-net
volumes_from:
- volumes_source
tty: false
nginx:
env_file:
- ".env"
build:
context: ./env/docker/nginx
volumes_from:
- volumes_source
volumes:
- ./env/data/logs/nginx/:/var/log/nginx
- ./env/docker/nginx/sites/node.template:/etc/nginx/node.template
networks:
- react-net
- nginx-proxy
environment:
NGINX_HOST: ${NGINX_HOST}
VIRTUAL_HOST: ${NGINX_VIRTUAL_HOST}
LETSENCRYPT_HOST: ${NGINX_VIRTUAL_HOST}
ESC: $$
links:
- node:node
command: /bin/sh -c "envsubst < /etc/nginx/node.template > /etc/nginx/sites-available/node.conf && nginx -g 'daemon off;'"
volumes_source:
image: tianon/true
volumes:
- ./app:/var/www/app
And my nginx is something like this:
server {
server_name www.${NGINX_HOST};
return 301 ${ESC}scheme://${NGINX_HOST}${ESC}request_uri;
}
server {
listen 80;
server_name ${NGINX_HOST};
root /var/www/app;
location / {
proxy_pass http://node:3333;
proxy_http_version 1.1;
proxy_set_header Upgrade ${ESC}http_upgrade;
proxy_set_header Connection 'upgrade';
proxy_set_header Host ${ESC}host;
proxy_cache_bypass ${ESC}http_upgrade;
}
}

faster way how to refresh container is
docker-compose restart node
because if you do docker-compose down it will bring all services down, remove configured networks.
If you have scaled service you might try to restart it with
docker restart foldername_node_2
and you could have 0 downtime, but the nginx configuration is not sufficient cause it will randomly select node machine, so you will have to implement some backup server

Related

Ignore the service availability during start nginx in docker swarm

The application makes up of serveral services in front of which we use nginx as the web server. And we deploy all these services inclulding nginx by in docker swarm.
docker-compose.yaml:
version: '3'
services:
sa:
image: xx.com/service-a
sb:
image: xx.com/service-b
sc:
image: xx.com/service-c
....
gateway:
image: nginx
volumes:
- /nginx.conf:/etc/nginx/conf.d/default.conf:ro
networks:
overlay:
nginx.conf:
location / {
proxy_pass http://sa;
}
location /sb/ {
proxy_pass http://sb;
}
location /sc/ {
proxy_pass http://sc;
}
......
So far so good, however when start the stack and if one of the service(say it is sc) fail to start, it will cause the nginx fail to start too which make our whole application unavailable.
Seems like that the embed-ed dns server by docker can not resolve the host sc since it is not started yet.
We do not want a single service affect the whole application, and sounds like this can be described as another question: "how to let nginx ignore the availability of the upstream/proxy during start". While after searching no solution. Any idea?
You can delay the dns resolution , until you need it .
So nginx can restart without doing dns resolution .
you must use a variable in your proxy_passdirective .
...
set $backend "http://serviceD" ;
proxy_pass $backend;
...
So i was able to simulate your problem with this docker-compose.yaml and th following default.conf
in the nginx image , the default resolver is pointing to 127.0.0.11
resolver 127.0.0.11 valid=30s;
resolver_timeout 5s;
server {
listen 0.0.0.0:80;
server_name localhost;
location / {
proxy_pass http://serviceA;
}
location /sd/ {
set $backend "http://serviceD" ;
proxy_pass $backend;
}
}
version: '3.7'
services:
serviceA:
image: debian:stretch-slim
command: ["sleep","3600" ]
serviceD:
image: debian:stretch-slim
command: ["sleep","3600" ]
nginx:
image: nginx
volumes:
- ${PWD}/default.conf:/etc/nginx/conf.d/default.conf:ro
command: ["/bin/sh","-c","exec nginx -g 'daemon off;'"]
restart: always
ports:
- target: 80
published: 8080
protocol: tcp
mode: host
testD:
image: alpine:latest
restart: always
command: ["/bin/sh","-c","( apk add --no-cache bind-tools && host serviceD && ping -c 8 -i 4 serviceD )" ]

Docker compose of nginx, express, letsencrypt SSL get 502 Bad gateway

I am trying to find a way to publish nginx, express, and letsencrypt's ssl all together using docker-compose. There are many documents about this, so I referenced these and tried to make my own configuration, I succeed to configure nginx + ssl from this https://medium.com/#pentacent/nginx-and-lets-encrypt-with-docker-in-less-than-5-minutes-b4b8a60d3a71
So now I want to put sample nodejs express app into nginx + ssl docker-compose. But I don't know why, I get 502 Bad Gateway from nginx rather than express's initial page.
I am testing this app with my left domain, and on aws ec2 ubuntu16. I think there is no problem about domain dns and security rules settings. All of 80, 443, 3000 ports opened already. and When I tested it without express app it shows well nginx default page.
nginx conf in /etc/nginx/conf.d
server {
listen 80;
server_name example.com;
return 301 https://$server_name$request_uri;
}
server {
listen 443 ssl;
listen [::]:443 ssl;
server_name example.com;
server_tokens off;
location / {
proxy_pass http://localhost:3000;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection 'upgrade';
proxy_set_header Host $host;
proxy_cache_bypass $http_upgrade;
}
ssl_certificate /etc/letsencrypt/live/sendpi.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/sendpi.com/privkey.pem;
include /etc/letsencrypt/options-ssl-nginx.conf;
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
}
docker-compose.yml
version: '3'
services:
app:
container_name: express
restart: always
build: .
ports:
- '3000:3000'
nginx:
container_name: nginx
image: nginx:1.15-alpine
restart: unless-stopped
volumes:
- ./data/nginx:/etc/nginx/conf.d
- ./data/certbot/conf:/etc/letsencrypt
- ./data/certbot/www:/var/www/certbot
ports:
- "80:80"
- "443:443"
command: "/bin/sh -c 'while :; do sleep 6h & wait $${!}; nginx -s reload; done & nginx -g \"daemon off;\"'"
certbot:
image: certbot/certbot
restart: unless-stopped
volumes:
- ./data/certbot/conf:/etc/letsencrypt
- ./data/certbot/www:/var/www/certbot
entrypoint: "/bin/sh -c 'trap exit TERM; while :; do certbot renew; sleep 12h & wait $${!}; done;'"
Dockerfile of express
FROM node:12.2-slim
WORKDIR /usr/src/app
COPY package*.json ./
RUN npm install
COPY . .
EXPOSE 3000
CMD ["npm", "start"]
I think SSL works fine, but there are some problems between express app and nginx. How can I fix this?
proxy_pass http://localhost:3000
is proxying the request to the 3000 port on the container that is running nginx. What you instead want is to connect to the 3000 port of the container running express. For that, we need to do two things.
First, we make the express container visible to nginx container at a predefined hostname. We can use links in docker-compose.
nginx:
links:
- "app:expressapp"
Alternatively, since links are now considered a legacy feature, a better way is to use a user defined network. Define a network of your own with
docker network create my-network
and then connect your containers to that network in compose file by adding the following at the top level:
networks:
default:
external:
name: my-network
All the services connected to a user defined network can access each other via name without explicitly setting up links.
Then in the nginx.conf, we proxy to the express container using that hostname:
location / {
proxy_pass http://app:3000
}
Warning: The --link flag is a legacy feature of Docker. It may eventually be removed. Unless you absolutely need to continue using it, we recommend that you use user-defined networks to facilitate communication between two containers instead of using --link.
Define networks in your docker-compose.yml and configure your services with the appropriate network:
version: '3'
services:
app:
restart: always
build: .
networks:
- backend
expose:
- "3000"
nginx:
image: nginx:1.15-alpine
restart: unless-stopped
depends_on:
- app
volumes:
- ./data/nginx:/etc/nginx/conf.d
- ./data/certbot/conf:/etc/letsencrypt
- ./data/certbot/www:/var/www/certbot
networks:
- frontend
- backend
ports:
- "80:80"
- "443:443"
command: "/bin/sh -c 'while :; do sleep 6h & wait $${!}; nginx -s reload; done & nginx -g \"daemon off;\"'"
certbot:
image: certbot/certbot
restart: unless-stopped
volumes:
- ./data/certbot/conf:/etc/letsencrypt
- ./data/certbot/www:/var/www/certbot
entrypoint: "/bin/sh -c 'trap exit TERM; while :; do certbot renew; sleep 12h & wait $${!}; done;'"
networks:
frontend:
backend:
Note: the app service no longer publish's it's ports to the host it only exposes port 3000 (ref. exposing and publishing ports), it is only available to services connected to the backend network. The nginx service has a foot in both the backend and frontend network to accept incoming traffic from the frontend and proxy the connections to the app in the backend (ref. multi-host networking).
With user-defined networks you can resolve the service name:
user nginx;
worker_processes 1;
error_log /var/log/nginx/error.log warn;
pid /var/run/nginx.pid;
events {
worker_connections 1024;
}
http {
upstream app {
server app:3000 max_fails=3;
}
server {
listen 80;
server_name example.com;
return 301 https://$server_name$request_uri;
}
server {
listen 443 ssl;
listen [::]:443 ssl;
server_name example.com;
server_tokens off;
location / {
proxy_pass http://app;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection 'upgrade';
proxy_set_header Host $host;
proxy_cache_bypass $http_upgrade;
}
ssl_certificate /etc/letsencrypt/live/sendpi.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/sendpi.com/privkey.pem;
include /etc/letsencrypt/options-ssl-nginx.conf;
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
}
}
Removing the container_name from your services makes it possible to scale the services: docker-compose up -d --scale nginx=1 app=3 - nginx will load balance the traffic in round-robin to the 3 app containers.
I think maybe a source of confusion here is the way the "localhost" designation behaves among running services in docker-compose. The way docker-compose orchestrates your containers, each of the containers understands itself to be "localhost", so "localhost" does not refer to the host machine (and if I'm not mistaken, there is no way for a container running on the host to access a service exposed on a host port, apart from maybe some security exploits). To demonstrate:
services:
app:
container_name: express
restart: always
build: .
ports:
- '2999:3000' # expose app's port on host's 2999
Rebuild
docker-compose build
docker-compose up
Tell container running the express app to curl against its own running service on port 3000:
$ docker-compose exec app /bin/bash -c "curl http://localhost:3000"
<!DOCTYPE html>
<html>
<head>
<title>Express</title>
<link rel='stylesheet' href='/stylesheets/style.css' />
</head>
<body>
<h1>Express</h1>
<p>Welcome to Express</p>
</body>
</html>
Tell app to try to that same service which we exposed on port 2999 on the host machine:
$ docker-compose exec app /bin/bash -c "curl http://localhost:2999"
curl: (7) Failed to connect to localhost port 2999: Connection refused
We will of course see this same behavior between running containers as well, so in your setup nginx was trying to proxy it's own service running on localhost:3000 (but there wasn't one, as you know).
Tasks
build NodeJS app
add SSL functionality from the box (that can work automatically)
Solution
https://github.com/evertramos/docker-compose-letsencrypt-nginx-proxy-companion
/ {path_to_the_project} /Docker-compose.yml
version: '3.7'
services:
nginx-proxy:
image: jwilder/nginx-proxy:alpine
restart: always
container_name: nginx-proxy
volumes:
- /var/run/docker.sock:/tmp/docker.sock:ro
- ./certs:/etc/nginx/certs:ro
- ./vhost.d:/etc/nginx/vhost.d
- ./html:/usr/share/nginx/html
- ./conf.d:/etc/nginx/conf.d
ports:
- "443:443"
- "80:80"
labels:
- "com.github.jrcs.letsencrypt_nginx_proxy_companion.nginx_proxy=true"
letsencrypt:
image: jrcs/letsencrypt-nginx-proxy-companion
container_name: letsencrypt
volumes:
- /var/run/docker.sock:/var/run/docker.sock:ro
- ./certs:/etc/nginx/certs:rw
- ./vhost.d:/etc/nginx/vhost.d:rw
- ./html:/usr/share/nginx/html:rw
environment:
- NGINX_PROXY_CONTAINER=nginx-proxy
api:
container_name: ${APP_NAME}
build:
context: .
dockerfile: Dockerfile
command: npm start --port ${APP_PORT}
expose:
- ${APP_PORT}
# ports:
# - ${APP_PORT}:${APP_PORT}
restart: always
environment:
VIRTUAL_PORT: ${APP_PORT}
VIRTUAL_HOST: ${DOMAIN}
LETSENCRYPT_HOST: ${DOMAIN}
LETSENCRYPT_EMAIL: ${LETSENCRYPT_EMAIL}
NODE_ENV: production
PORT: ${APP_PORT}
volumes:
- /var/run/docker.sock:/tmp/docker.sock:ro
- ./certs:/etc/nginx/certs:ro
/ {path_to_the_project} /.env
APP_NAME=best_api
APP_PORT=3000
DOMAIN=api.site.com
LETSENCRYPT_EMAIL=myemail#gmail.com
Do not forget to connect DOMAIN to you server before you will run container there.
How it works?
just run docker-compose up --build -d

Nginx deployed in docker container doesn't expose nuxtjs deployed in another docker container (502 Bad Gateway)

I'm trying to run nuxtjs application using nginx as proxy server in docker containers. So, I have 2 containers: nginx and nuxt
here is how I'm building nuxt application
FROM node:11.15
ENV APP_ROOT /src
RUN mkdir ${APP_ROOT}
WORKDIR ${APP_ROOT}
ADD . ${APP_ROOT}
RUN npm install
RUN npm run build
ENV host 0.0.0.0
The result seems to be fine
Next is nginx config
server {
listen 80;
server_name dev.iceik.com.ua;
location / {
proxy_pass http://nuxt:3000;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
}
Also I've tried this nginx config
upstream nuxt {
server nuxt:3000;
}
server {
listen 80;
server_name dev.iceik.com.ua;
location / {
proxy_pass http://nuxt;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
}
And finally my docker-compose file
version: "3"
services:
nuxt:
build: ./app/
container_name: nuxt
restart: always
ports:
- "3000:3000"
command:
"npm run start"
nginx:
image: nginx:1.17
container_name: nginx
ports:
- "80:80"
volumes:
- ./nginx:/etc/nginx/conf.d
depends_on:
- nuxt
I can ping nuxt container from nginx container
Also here are opened ports
So, the expected result is that I can access my nuxt application.
However I'm getting 502 Bad Gateway
Do you have any ideas why nginx doesn't expose my nuxt application?
Thank you for any suggestions!
Nodejs is exposed localhost:3000 instead of 0.0.0.0:3000
Please correct it. It will work
Always good that your containers put into a network if they need to talk each other, other way is to use Host network(only works in linux). Try below docker-compose.yml they should be able to talk each other from the container names.
version: "3"
services:
nuxt:
build: ./app/
container_name: nuxt
restart: always
ports:
- "3000:3000"
command:
"npm run start"
networks:
- my_net
nginx:
image: nginx:1.17
container_name: nginx
ports:
- "80:80"
volumes:
- ./nginx:/etc/nginx/conf.d
depends_on:
- nuxt
networks:
- my_net
networks:
my_net:
driver: "bridge"

Bootstrap Formatting Rendering on my_site.com:8000, not on my_site.com

I have a personal website that leverages Flask, NginX, Gunicorn, and MySQL. It runs perfectly well, however, I am porting it over to a set of Docker containers (mostly to learn Docker).
I am currently facing an issue that I believe stems from my NginX configuration, as I am attempting to forward traffic to my_site to my_site:8000 [code block 1 below].
My problem is this: I finally got the forwarding to work, in that when I go to my_site.com, it renders my HTML (presumably through forwarding to Gunicorn's exposed port 8000). But, it does not format it using the bootstrap4 formatting. My terminal does show a 200 response for finding my main.css file, however. The strange part is that when I go to my_site:8000, it does properly format my pages!
Do any of you have an idea as to what could be my mix up? I've double checked my port exposures, my docker services references, etc. but cannot figure out what the differentiation is in specifying that port 8000, after what I believe was a successful implementation of the proxy_pass to port 8000 in my NginX configuration.
My docker-compose.yml file contents are shown below in code block 2
The NginX container is from the official NginX image on Docker hub
The MySQL container is from the official MariaDB image on Docker hub
The other containers are built upon Ubuntu 18.10 images. I simply downloaded Python, nano, requirements.txt, etc. on these.
Block 1 -- conf.d file for NginX
events { }
http {
upstream upstream-web {
server jonathanolson.us;
}
server {
listen 80;
server_name gunicornservice;
location /static {
alias /NHL-Project/flasksite/static;
}
location / {
proxy_pass http://gunicornservice:8000;
# include /etc/nginx/proxy_params;
proxy_redirect off;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Host $server_name;
}
}
}
Block 2 -- docker-compose.yml
version: '3.7'
networks:
default:
external:
name: nhlflasknetwork
services:
db:
restart: always
image: jonathanguy/mymariadb
ports:
- "3306:3306"
volumes:
- type: bind
source: /home/jonathan/NHL-Project
target: /NHL-Project
- type: volume
source: mynhldb
target: /var/lib/mysql
- type: volume
source: myConfig
target: /etc/mySecrets # Here, we will have the file /etc/mySecrets/config.py
environment:
- MYSQL_USER_FILE=/etc/mySecrets/mysql_user_file
- MYSQL_PASSWORD_FILE=/etc/mySecrets/mysql_user_password_file
web:
restart: always
image: jonathanguy/myflask
ports:
- "5000:5000"
volumes:
- type: bind
source: /home/jonathan/NHL-Project
target: /NHL-Project
- type: volume
source: myConfig
target: /etc/mySecrets # Here, we will have the file /etc/mySecrets/config.py
environment:
- MYSQL_ROOT_PASSWORD_FILE=/etc/mySecrets/mysql_root_password_file
- MYSQL_USER_FILE=/etc/mySecrets/mysql_user_file
- MYSQL_PASSWORD_FILE=/etc/mySecrets/mysql_user_password_file
depends_on:
- db # Tells docker that "web" can start once "db" is started and running
command: bash -c "python3 NHL-Project/flaskrun.py"
server:
build: ./myNginx
depends_on:
- web
volumes:
- type: bind # TODO -- Make this a volume mount for production
source: /home/jonathan/NHL-Project/flasksite/templates
target: /usr/share/nginx/html
- type: bind # TODO -- Make this a volume mount for production
source: /home/jonathan/NHL-Project/flasksite/static/favicon.ico
target: /usr/share/nginx/html/favicon.ico
- type: bind
source: /home/jonathan/NHL-Project/conf/conf.d
target: /etc/nginx/nginx.conf
ports:
- "80:80"
environment:
- NGINX_PORT=80
command: /bin/bash -c "chown -R nginx /usr/share/nginx/html && exec nginx -g 'daemon off;'"
gunicornservice:
image: jonathanguy/mygunicorn
depends_on:
- server
volumes:
- type: bind
source: /home/jonathan/NHL-Project
target: /NHL-Project
- type: volume
source: myConfig
target: /etc/mySecrets
ports:
- "8000:8000"
command: /bin/bash -c "gunicorn -w 5 flaskrun:app -b 0.0.0.0:8000"
working_dir: /NHL-Project
volumes:
mynhldb:
external: true
myConfig:
external: true
myCode:
external: true
I expect my full site to be rendered and formatted correctly when visiting my_site.com
Given my (successful?) implementation of a proxy_pass in the NginX config, I am getting all the HTML and successful finding of the main.css file.
I still have to visit my_site.com:8000 to have the html formatted using the specified bootstrap formatting.
Assuming form this snippet
location /static {
alias /NHL-Project/flasksite/static;
}
Your css files are placed hear.
This block is what is I guess is creating the issue as nginx service will try to find the file in its container directory, but this which be served from your web container.
Try removing that block from nginx conf file.
Also, if possible avoid binding volumes of the code where it is not required like nginx and MySQL.

Docker Compose: Django, uWSGI, NGINX without Proxy (different containers)

My docker-compose.yaml is
version: '3'
services:
nginx:
restart: always
build: ./nginx/
depends_on:
- web
ports:
- "8000:8000"
network_mode: "host" # Connection between containers
web:
build: .
image: app-image
ports:
- "80:80"
volumes:
- .:/app-name
command: uwsgi /app-path/web/app.ini
NGINX conf file is
upstream web {
server 0.0.0.0:80;
}
server {
listen 8000;
server_name web;
location = /favicon.ico { access_log off; log_not_found off; }
location /static/ {
alias "/app-static/";
}
location / {
proxy_pass http://web;
}
}
So basically I have Django and uWSGI in one container 'web' and NGINX in container 'nginx'. I linked both using NGINX via Proxy and both worked fine. (I somehow needed 'network_mode: "host"' without that didn't work)
Since they are different containers, I cannot use .sock file (Unless I use some volume hacks to share the .sock file which is not good!)
Even though this works, I have been asked to avoid using NGINX via proxy, so is there any other way to connect these two?
Searching didn't get me alternatives. I tried

Resources