4 ms·

I was just looking into Harbormaster. Does it play well with Traefik? Seems like a good combo in theory at least. I'm already running Traefik, but haven't found

I was just looking into Harbormaster. Does it play well with Traefik? Seems like a good combo in theory at least. I'm already running Traefik, but haven't found a nice way to automatically upgrade and make sure docker-compose is running for all projects I'm hosting.

stavros 5y ago
Hmm, I've never used Traefik with it, I use Caddy in host mode. Does Traefik autodetect the containers from the Docker socket? I might look into it because that would make automatic ingress painless. Harbormaster is basically a thin layer/manager over Compose. If Traefik works with a bunch of running containers, it'll work with Harbormaster.
- detaro 5y ago
  > Does Traefik autodetect the containers from the Docker socket? Yes, it can do that. you can put annotations(? tags? I forget what the docker terminology is) on containers that Traefik reads so it knows "expose port xyz on this container as https://example.com https://example.com".
  - stavros 5y ago
    Hmm very interesting, I'll need to play with that and add annotation support on Harbormaster so it works out of the box, thanks!
    - andrelaszlo 5y ago
      That would be really cool. I might mess around with it around Christmas. If I run into any rough edges around labels (Traefik uses labels like `traefik.enable=true` https://doc.traefik.io/traefik/reference/dynamic-configuration/docker/ https://doc.traefik.io/traefik/reference/dynamic-configurati...) I'll submit an issue or PR.
      - stavros 5y ago
        Excellent, thanks! I think a label config item should be enough to get Traefik working, but I'll know more after I look at it.
- codethief 5y ago
  > Does Traefik autodetect the containers from the Docker socket? Given the overall expertise you've demonstrated here on HN time and again, I'm sure you are aware of this but a general warning to everyone else reading this might be in order: Careful with exposing the Docker socket to Traefik, see https://github.com/traefik/traefik/issues/4174 https://github.com/traefik/traefik/issues/4174
  - stavros 5y ago
    Ah, yes, I'm unclear on whether Docker intends to be secure these days (though there are things like Sysbox or running rootless that help), but exposing the socket inside a root container is removing a few layers of defense, thank you for pointing this out. Unfortunately I don't think there's a way for Harbormaster to do anything about it, but I'll play around with Traefik and see if there's a more secure way to deploy it, thank you.

stavros 5y ago

Hmm, I've never used Traefik with it, I use Caddy in host mode. Does Traefik autodetect the containers from the Docker socket? I might look into it because that would make automatic ingress painless. Harbormaster is basically a thin layer/manager over Compose. If Traefik works with a bunch of running containers, it'll work with Harbormaster.

detaro 5y ago
> Does Traefik autodetect the containers from the Docker socket? Yes, it can do that. you can put annotations(? tags? I forget what the docker terminology is) on containers that Traefik reads so it knows "expose port xyz on this container as https://example.com https://example.com".
- stavros 5y ago
  Hmm very interesting, I'll need to play with that and add annotation support on Harbormaster so it works out of the box, thanks!
  - andrelaszlo 5y ago
    That would be really cool. I might mess around with it around Christmas. If I run into any rough edges around labels (Traefik uses labels like `traefik.enable=true` https://doc.traefik.io/traefik/reference/dynamic-configuration/docker/ https://doc.traefik.io/traefik/reference/dynamic-configurati...) I'll submit an issue or PR.
    - stavros 5y ago
      Excellent, thanks! I think a label config item should be enough to get Traefik working, but I'll know more after I look at it.
codethief 5y ago
> Does Traefik autodetect the containers from the Docker socket? Given the overall expertise you've demonstrated here on HN time and again, I'm sure you are aware of this but a general warning to everyone else reading this might be in order: Careful with exposing the Docker socket to Traefik, see https://github.com/traefik/traefik/issues/4174 https://github.com/traefik/traefik/issues/4174
- stavros 5y ago
  Ah, yes, I'm unclear on whether Docker intends to be secure these days (though there are things like Sysbox or running rootless that help), but exposing the socket inside a root container is removing a few layers of defense, thank you for pointing this out. Unfortunately I don't think there's a way for Harbormaster to do anything about it, but I'll play around with Traefik and see if there's a more secure way to deploy it, thank you.