How Docker will resolve hostname or IP present in properties file? - docker

I have 2 Spring Boot micro-service applications i.e web application and metastore application. This is the properties file for my web application.
spring:
thymeleaf:
prefix: classpath:/static/
application:
name: web-server
profiles:
active: native
server:
port: ${port:8383}
---
host:
metadata: http://10.**.**.***:5011
Dockerfile for web application:
FROM java:8-jre
MAINTAINER **** <******>
ADD ./ms.console.ivu-ivu.1.0.1.jar /app/
CMD chmod +x /app/*
CMD ["java","-jar", "/app/ms.console.web-web.1.0.1.jar"]
EXPOSE 8383
Dockerfile for metadata application:
FROM java:8-jre
MAINTAINER ******* <********>
ADD config/* /deploy/config/
CMD chmod +x ./deploy/config/*
COPY ./ms.metastore.1.0.1.jar /deploy/
CMD chmod +x ./deploy/ms.metastore.1.0.1.jar
CMD ["java","-jar","./deploy/ms.metastore.1.0.1.jar"]
EXPOSE 5011
I am using Mesos and Marathon for cluster management. The Marathon scripts for metastore is :-
{
"id": "/ms-metastore",
"cmd": null,
"cpus": 1,
"mem": 2000,
"disk": 0,
"instances": 0,
"acceptedResourceRoles": [
"*"
],
"container": {
"type": "DOCKER",
"docker": {
"forcePullImage": true,
"image": "*****/****:ms-metastore",
"parameters": [],
"privileged": true
},
"volumes": [],
"portMappings": [
{
"containerPort": 5011,
"hostPort": 0,
"labels": {},
"protocol": "tcp",
"servicePort": 10000
}
]
},
"networks": [
{
"mode": "container/bridge"
}
],
"portDefinitions": [],
"fetch": [
{
"uri": "file:///etc/docker.tar.gz",
"extract": true,
"executable": false,
"cache": false
}
]
}
Web marathon:
{
"id": "/ms-console",
"cmd": null,
"cpus": 1,
"mem": 2000,
"disk": 0,
"instances": 0,
"acceptedResourceRoles": [
"*"
],
"container": {
"type": "DOCKER",
"docker": {
"forcePullImage": true,
"image": "****/****:ms-console",
"parameters": [],
"privileged": true
},
"volumes": [],
"portMappings": [
{
"containerPort": 8383,
"hostPort": 0,
"labels": {},
"protocol": "tcp",
"servicePort": 10000
}
]
},
"networks": [
{
"mode": "container/bridge"
}
],
"portDefinitions": [],
"fetch": [
{
"uri": "file:///etc/docker.tar.gz",
"extract": true,
"executable": false,
"cache": false
}
]
}
Web application I am connecting to metastore with IP which is hard coded (mentioned in properties). I created docker images for both and run in my server. The metastore server now running in different machine, so my web application is unable to resolve this IP.

All you need to do here is expose 5011 as the host port on the metadata server running on "different machine" using -p -
docker run -d -p 5011:5011 metadata_image ....
Now your web application should be able to access metadata server by using http://$different_machine_ip:5011/
$different_machine_ip = Metadata server IP
However since they need to be tightly coupled, i would suggest you run web app & metadata server on the same machine in case your metadata server is stateless.

Related

Docker container runs on aws fargate SSL issue

I am trying to make my .net core api on live on AWS fargate. I have created an application load balancer on AWS and added to listeners for 80 and 443 ports.
I exposed 8080 port to 80 and 8081 port to 443 in my container.
Here is my task definition file
{
"ipcMode": null,
"executionRoleArn": "my-esc-roles",
"containerDefinitions":
[
{
"dnsSearchDomains": null,
"environmentFiles": null,
"logConfiguration":
{
"logDriver": "awslogs",
"secretOptions": null,
"options":
{
"awslogs-group": "/ecs/my-tasks",
"awslogs-region": "us-east-1",
"awslogs-stream-prefix": "ecs"
}
},
"entryPoint":
[],
"portMappings":
[
{
"hostPort": 8080,
"protocol": "tcp",
"containerPort": 8080
},
{
"hostPort": 8081,
"protocol": "tcp",
"containerPort": 8081
}
],
"command":
[],
"linuxParameters": null,
"cpu": 0,
"environment":
[],
"resourceRequirements": null,
"ulimits": null,
"dnsServers": null,
"mountPoints":
[],
"workingDirectory": null,
"secrets":
[
{
"valueFrom": "LiveDb",
"name": "LiveDb"
},
{
"valueFrom": "SSLPath",
"name": "ASPNETCORE_Kestrel__Certificates__Default__Path"
},
{
"valueFrom": "SSLPassword",
"name": "ASPNETCORE_Kestrel__Certificates__Default__Password"
}
],
"dockerSecurityOptions": null,
"memory": 500,
"memoryReservation": 400,
"volumesFrom":
[],
"stopTimeout": null,
"image": "my-ecr-repo/image:latest",
"startTimeout": null,
"firelensConfiguration": null,
"dependsOn": null,
"disableNetworking": null,
"interactive": null,
"healthCheck": null,
"essential": true,
"links": null,
"hostname": null,
"extraHosts": null,
"pseudoTerminal": null,
"user": null,
"readonlyRootFilesystem": null,
"dockerLabels": null,
"systemControls": null,
"privileged": null,
"name": "my-container"
}
],
"placementConstraints":
[],
"memory": "2048",
"taskRoleArn": "**********************",
"compatibilities":
[
"EC2",
"FARGATE"
],
"taskDefinitionArn": "*******************",
"family": "supplierportal-tasks",
"requiresAttributes":
[
{
"targetId": null,
"targetType": null,
"value": null,
"name": "com.amazonaws.ecs.capability.logging-driver.awslogs"
},
{
"targetId": null,
"targetType": null,
"value": null,
"name": "ecs.capability.execution-role-awslogs"
},
{
"targetId": null,
"targetType": null,
"value": null,
"name": "com.amazonaws.ecs.capability.ecr-auth"
},
{
"targetId": null,
"targetType": null,
"value": null,
"name": "ecs.capability.secrets.ssm.environment-variables"
},
{
"targetId": null,
"targetType": null,
"value": null,
"name": "com.amazonaws.ecs.capability.docker-remote-api.1.18"
},
{
"targetId": null,
"targetType": null,
"value": null,
"name": "ecs.capability.task-eni"
}
],
"pidMode": null,
"requiresCompatibilities":
[
"FARGATE"
],
"networkMode": "awsvpc",
"runtimePlatform":
{
"operatingSystemFamily": "LINUX",
"cpuArchitecture": null
},
"cpu": "1024",
"revision": 10,
"status": "ACTIVE",
"inferenceAccelerators": null,
"proxyConfiguration": null,
"volumes":
[]
}
And here is my dockerfile
FROM mcr.microsoft.com/dotnet/aspnet:6.0 AS base
WORKDIR /app
EXPOSE 8080
EXPOSE 8081
ENV ASPNETCORE_URLS=http://+:8080;https://+:8081
# Creates a non-root user with an explicit UID and adds permission to access the /app folder
# For more info, please refer to https://aka.ms/vscode-docker-dotnet-configure-containers
RUN adduser -u 5678 --disabled-password --gecos "" appuser && chown -R appuser /app
USER appuser
FROM mcr.microsoft.com/dotnet/sdk:6.0 AS build
WORKDIR /src
COPY ["WebAPI/WebAPI.csproj", "WebAPI/"]
RUN dotnet restore "WebAPI/WebAPI.csproj"
COPY . .
WORKDIR "/src/WebAPI"
RUN dotnet build "WebAPI.csproj" -c Release -o /app/build
FROM build AS publish
RUN dotnet publish "WebAPI.csproj" -c Release -o /app/publish /p:UseAppHost=false
FROM base AS final
WORKDIR /app
COPY --from=publish /app/publish .
ENTRYPOINT ["dotnet", "WebAPI.dll"]
When it comes to port 80 everything works perfectly. but on port 443 I could not be able to set up SSL.
Here is the error log I receive.
Unhandled exception. Interop+Crypto+OpenSslCryptographicException: error:2006D080:BIO routines:BIO_new_file:no such file
I have stored my pfx file in s3 but it did not work. Where should I put my pfx file to deploy it in a container?
I have used the below paths for SSL on S3.
s3://mycert/WebAPI.pfx => did not work
https://my-cert.s3.amazonaws.com/ebAPI.pfx => did not work
arn:aws:s3:::my-cert/WebAPI.pfx => did not work
I have stored my pfx file in s3 but it did not work. Where should I put my pfx file to deploy it in a container?
You would need to add a step to the startup of your docker container to copy the file from S3 into the container, using either the AWS CLI tool, or the AWS SDK.
You really only need the SSL certificate that is installed on the load balancer, unless you have some sort of regulatory requirement for end-to-end encryption. The Application Load Balancer is doing SSL termination, so the network connection between the user's web browser and your AWS private network is encrypted. The SSL listener on the load balancer's port 443 can forward traffic to your unencrypted port 8080.

.Net Core 3.0 With AWS ECS(docker run -m)

https://learn.microsoft.com/zh-tw/dotnet/core/whats-new/dotnet-core-3-0
docker run -m
How do I write to the AWS ECS Task File?
Normally such question is strongly discouraged, you should show what you have done and what the problem you are facing. but here is a step.
Better to push your image to ECR
Specify an image ARN in the task definition
Create service from the task definition
{
"containerDefinitions": [
{
"entryPoint": [
"sh",
"-c"
],
"essential": true,
"image": "PUT_RESGISTRY_ECR_IMAGE_ARN_HERE",
"logConfiguration": {
"logDriver": "awslogs",
"options": {
"awslogs-group" : "/ecs/fargate-task-definition",
"awslogs-region": "us-east-1",
"awslogs-stream-prefix": "ecs"
}
},
"name": "sample-fargate-app",
"portMappings": [
{
"containerPort": 80,
"hostPort": 80,
"protocol": "tcp"
}
]
}
],
"cpu": "256",
"executionRoleArn": "arn:aws:iam::012345678910:role/ecsTaskExecutionRole",
"family": "fargate-task-definition",
"memory": "512",
"networkMode": "awsvpc",
"requiresCompatibilities": [
"FARGATE"
]
}
example_task_definitions
getting-started/tutorials/deploy-docker-containers
deploying-a-simple-hello-world-httpd-container-on-an-ecs-cluster

ECS Application sourcebundle validation error: We expected a VALUE token but got: START_ARRAY

I'm making an multi-container docker build on Elastic Beanstalk and whenever I run eb deploy
I get the error ECS Application sourcebundle validation error: We expected a VALUE token but got: START_ARRAY
I think it might be something wrong with my Dockerrun.aws.json, but I can't seem to figure out what it is.
Here's my dockerrun.aws.json
{
"AWSEBDockerrunVersion": 2,
"containerDefinitions": [
{
"environment": [
{
"name": "ELASTICSEARCH_URL",
"value": "elasticsearch:9200"
}
],
"essential": true,
"image": "902260087874.dkr.ecr.ap-southeast-1.amazonaws.com/the-medical-agora",
"memory": 128,
"links": [
"db",
"elasticsearch"
],
"mountPoints": [
{
"containerPath": "/usr/src/app",
"sourceVolume": "."
}
],
"name": "app",
"portMappings": [
{
"containerPort": 3000,
"hostPort": 80
}
]
},
{
"memory": 128,
"essential": true,
"image": "postgres:10.3-alpine",
"mountPoints": [
{
"containerPath": "/var/lib/postgresql/data",
"sourceVolume": "Db"
}
],
"name": "db",
"portMappings": [
{
"containerPort": 5432,
"hostPort": 5432
}
]
},
{
"memory": 128,
"essential": true,
"image": "docker.elastic.co/elasticsearch/elasticsearch-oss:6.2.4",
"mountPoints": [
{
"containerPath": "/usr/share/elasticsearch/data",
"sourceVolume": "Esdata1"
}
],
"name": "elasticsearch"
}
],
"volumes": [
{
"host": {
"sourcePath": "esdata1"
},
"name": "Esdata1"
},
{
"host": {
"sourcePath": "db"
},
"name": "Db"
},
{
"host": {
"sourcePath": "."
},
"name": "_"
}
]
}
Which is weird because when I ran this dockerrun.aws.json JSON schema linter on it, it seemed to do fine.
The project also works when I run it with eb local run. It seems to only break when I'm deploying it to Elastic Beanstalk.
Hey guys after reading the docs of eb deploy I discovered the problem.
Although I fixed the Dockerrun.aws.json file, it doesn't reflect on eb deploy until I make a new git commit.
So I just ran git add . and git commit and then ran git push for good measure.
After that when I ran eb deploy it used my new Dockerrun.aws.json and my problems were resolved.

Mesos Marathon(ctl) Debugging - "Abnormal executor termination: unknown container"

I'm still new to Mesos, but am trying to figure out the best way to debug a Mesos application I'm attempting to develop. I'm getting the error message "Abnormal executor termination: unknown container" through the web application, and am unsure how to get more descriptive error messages to figure out what's going on. The error message would seem to indicate it can't find the Docker image, but I know for a fact it's referencing the correct image that is installed and running.
{
"id": "pgprimary",
"cmd": null,
"cpus": 1,
"mem": 128,
"disk": 0,
"instances": 1,
"container": {
"docker": {
"image": "example/postgres:centos7-10.0-1.6.0",
"network": "BRIDGE",
"parameters": [{
"key": "hostname",
"value": "pgprimary"
}],
"portMappings": [
]
},
"type": "DOCKER",
"volumes": [
{
"hostPath": "/mnt/nfsfileshare/pgdata",
"containerPath": "/pgdata",
"mode": "RW"
}
]
},
"env": {
"PG_MODE": "primary",
"PG_USER": "testuser",
"PG_PASSWORD": "testuser",
"PG_DATABASE": "userdb",
"PG_ROOT_PASSWORD": "password",
"PG_PRIMARY_USER": "primaryuser",
"PG_PRIMARY_PASSWORD": "password",
"PG_PRIMARY_PORT": "5432"
},
"labels": {},
"healthChecks": [
{
"protocol": "COMMAND",
"command": {
"value": "/usr/pgsql-10/bin/pg_isready --host=pgprimary.marathon.mesos"
},
"gracePeriodSeconds": 300,
"intervalSeconds": 60,
"timeoutSeconds": 20,
"maxConsecutiveFailures": 3,
"ignoreHttp1xx": false
}
]
}
The command I'm using to deploy the Marathon app:
marathonctl -h http://10.0.2.15:8080 app create postgres.json
Not image, but docker is what marathon cannot find.
Specify the use of the Docker containerizer:
echo 'docker,mesos' > /etc/mesos-slave/containerizers
Provisioning Containers with the Docker Containerizer
https://mesosphere.github.io/marathon/docs/native-docker.html

How to pull docker image with marathon which need to be authorized

I wan to deploy a docker container with marathon, if the docker image without authorized, the image can be pull normally, but when I try to pull an image from repository which need to be authorized, task deploy fail, the response is
Failed to launch container: Failed to run 'docker -H unix:///var/run/docker.sock pull example.com/web:laest': exited with status 1; stderr='Error response from daemon: repository example.com/web not found: does not exist or no pull access '
I changed the permission of /var/run/docker.sock file to 777 on node, and master, but the issue is still appeared, that seems permission is not the root cause for the issue; I try to run "docker login" on the node, and pull the image manually, then the marathon task run correctly, my marathon json like below:
{
"id": "/web",
"cmd": "docker login --username='sam' --passwoer='123456' example.com/web:latest",
"cpus": 0.3,
"mem": 32,
"disk": 0,
"instances": 1,
"env": {
"EMAIL_USE_TLS": "False",
"DATABASE_URI": "mysql://user:123456#RDS:3306/test"
},
"container": {
"type": "DOCKER",
"volumes": [
{
"containerPath": "/data/supervisor/",
"hostPath": "/data/workspace/logs/supervisor/",
"mode": "RW"
}
],
"docker": {
"image": "daocloud.io/gizwits2015/gwaccounts:1.6.0",
"network": "BRIDGE",
"portMappings": [
{
"containerPort": 0,
"hostPort": 0,
"servicePort": 10000,
"protocol": "tcp",
"labels": {}
}
],
"privileged": false,
"parameters": [
{
"key": "add-host",
"value": "RDS:10.66.125.161"
}
],
"forcePullImage": false
}
},
"portDefinitions": [
{
"port": 10000,
"protocol": "tcp",
"name": "default",
"labels": {}
}
]
}
How can I pull the image with authorized with marathon?
You should read: https://mesosphere.github.io/marathon/docs/native-docker-private-registry.html
Follow step 1, and in step 2 replace the uris section with
"fetch" : [
{
"uri" : "https://path.to/file",
"extract" : true,
"outputFile" : "dockerConfig.tar.gz"
}
]
I've written more detailed explanation here: http://blog.itaysk.com/2017/05/22/using-a-custom-private-docker-registry-with-marathon

Resources