Add documentation for Træfik on docker swarm mode

[vdemeester]

Still a little bit work in progress, I need to add output of commands 👼.

Also small update on the swarm one.

/cc @containous/traefik

🐸

Signed-off-by: Vincent Demeester vincent@sbr.pm

[bvis]

Hi, I've tested this docs with the 1.1.0-rc1 and it is not correct.

In your examples you are missing the needed labels to let traefik check the services. I've tried this instead with success:

docker network create traefik-net --driver overlay

docker service create \
  --name traefik \
  --constraint=node.role==manager \
  --publish 80:80 --publish 8080:8080 \
  --mount type=bind,source=/var/run/docker.sock,target=/var/run/docker.sock \
  --network traefik-net \
  traefik:camembert \
  --docker \
  --docker.swarmmode \
  --docker.domain=docker.localhost \
  --docker.watch \
  --logLevel=DEBUG \
  --web

docker service create \
    --name whoami0 \
    --network traefik-net \
    --label "traefik.backend=whoami" \
    --label "traefik.frontend.rule=Host:whoami.docker.localhost" \
    --label "traefik.port=80" \
    emilevauge/whoami

docker service create \
    --name whoami1 \
    --network traefik-net \
    --label "traefik.backend=whoami" \
    --label "traefik.frontend.rule=Host:whoami.docker.localhost" \
    --label "traefik.port=80" \
    emilevauge/whoami

$ curl -H Host:whoami.docker.localhost http://localhost
Hostname: 640be50494d2
IP: 127.0.0.1
IP: ::1
IP: 10.0.6.7
IP: 10.0.6.6
IP: fe80::42:aff:fe00:607
IP: 172.21.0.4
IP: fe80::42:acff:fe15:4
GET / HTTP/1.1
Host: whoami.docker.localhost
User-Agent: curl/7.43.0
Accept: */*
Accept-Encoding: gzip
X-Forwarded-For: 10.255.0.4
X-Forwarded-Host: whoami.docker.localhost
X-Forwarded-Proto: http
X-Forwarded-Server: 57dd126575c5

 $ curl -H Host:whoami.docker.localhost http://localhost
Hostname: c5c321cac154
IP: 127.0.0.1
IP: ::1
IP: 10.0.6.5
IP: 10.0.6.4
IP: fe80::42:aff:fe00:605
IP: 172.21.0.3
IP: fe80::42:acff:fe15:3
GET / HTTP/1.1
Host: whoami.docker.localhost
User-Agent: curl/7.43.0
Accept: */*
Accept-Encoding: gzip
X-Forwarded-For: 10.255.0.4
X-Forwarded-Host: whoami.docker.localhost
X-Forwarded-Proto: http
X-Forwarded-Server: 57dd126575c5

Probably create a PR for this PR does not worth it. ;)

[ralphtheninja]

is published

[ralphtheninja]

remove parenthesis

[ralphtheninja]

The cluster consists of

[ralphtheninja]

to speak to the docker daemon

[weitzj]

It would be nice to have 2 separate networks for the whoami backends.
I wilk probably add an example with traefik, docker-compose bundle, docker service deploy where separate networks are even more important

[vdemeester]

@ralphtheninja thanks 👼

@bvis Yes, I forgot --label "traefik.port=80" in my example, thanks 👼. I can make an example of what you describe but that's not what I was going for here. I'm using the same image twice because I'm lazy 😂 but I really want 2 different service served by Træfik as they were different app.

@weitzj I definitely went for the simplest example ever here 😅. We could enhance the documentation with multiple network (one for each app served) and a way to update the traefik service to connect to those as needed (but doesn't look like there is a docker service update --add-network yet though 😓).

[emilevauge]

Needs a rebase :)

[tlvenn]

Unless I am mistaken there is a slight error with how the placement contraint is declared, the official syntax is --constraint string not --constraint=string

https://docs.docker.com/engine/reference/commandline/service_create/#/specify-service-constraints---constraint

[vdemeester]

@tlvenn both should work the same 👼

[tlvenn]

Ya I didnt check but figured it would however I believe it would be a little bit better to stick with the official syntax, especially given that's the one you are already using for the other options ;)

Anyway, I am nitpicking, thanks in any case, for putting the doc together.

[vdemeester]

😝

[tlvenn]

One new question, did you investigate the --endpoint-mode option ? By default docker will use and create a virtual ip to load balance itself the service. One can use --endpoint-mode dnsrr to disable VIP and rely on simple dns round robin. Their documentation seems to suggest to use this when using your own load balancer, which is what we are doing.

You can configure the service to use DNS round-robin directly without using a VIP, by setting the --endpoint-mode dnsrr when you create the service. DNS round-robin is useful in cases where you want to use your own load balancer.

Should we update the doc to reflect that ?

[ralphtheninja]

Should we update the doc to reflect that ?

Make a PR and lets discuss that instead ;)

[tlvenn]

Well there is no point to create a PR if we dont even agree it should be amended...
The doc works perfectly fine as it is, it just create an un necessary IP for the service being load balanced by Traefik.

In the end, there are 3 choices:

1. Keep it simple and dont mention --endpoint-mode dnsrr
2. Amend the doc to use --endpoint-mode dnsrr and explain it.
3. Amend the doc to mention --endpoint-mode dnsrr as an option to avoid creating the VIP.

In case we choose 2 or 3, I am happy to create the PR.

[tlvenn]

One last comment, for security purpose, the docker socket should really be mounted in read only mode so that in the unlikely event the container is compromised, it does not mean the whole cluster has been taken over...