使用隔离网络扩展Docker容器

Question

I'm using docker-compose (v 3.3) and I have a set of services as shown below.

version: '3.3'

services:
  jboss:
    build:
      context: .
      dockerfile: jboss/Dockerfile
    ports:
      - 8080
    depends_on:
      - mysql
      - elasticsearch
    networks:
      - ${NETWORK}
    #  - front-tier
    #  - back-tier

  mysql:
    hostname: mysql
    image: mysql:latest
    ports:
      - 3306
    networks:
      - ${NETWORK}
    #  - back-tier

  elasticsearch:
    image: elasticsearch:1.7.3
    ports:
      - 9200
    networks:
      - ${NETWORK}
    #  - back-tier

networks:

#  front-tier:
#   driver: bridge

The problem/question is related to the possibility to isolate these services when I scale my containers in a kind of subnet (by the way, I'm not using swarm here) in the sense that jboss1 can only see mysql1 and elasticsearch1. The same for jboss2 - mysql2 - es2 and so on. I know this is quite strange, but the task is to parallelize some tests and they must be completely isolated.

As you probably have realized, I've tried some approaches (that are commented in the compose) of defining some networks, but if I scale the containers, they will obviously be on the same network - which means that I could randomly ping on mysql-n from jboss-1.

Then, I tried another approach explained here by Arun Gupta http://blog.arungupta.me/docker-bridge-overlay-network-compose-variable-substitution/ where he mentioned the variable substitution in the network attribute (for that the ${NETWORK} there). But it turns out that if I try to "up" my containers via:

NETWORK=isolated-net1 docker-compose up -d

and then

NETWORK=isolated-net2 docker-compose up -d

it won't scale the containers, but instead, recreate them all:

Recreating docker_mysql_1 ...
Recreating docker_elasticsearch_1 ...
Recreating docker_jboss_1 ...

In a nutshell: Is there a way to isolate a group of services when doing a docker-compose up --scale ?

Thanks

Answer 1

Well, it turns out that after a few days where I've been beating my brains out and trying to find a proper out-of-the-box solution for the problem, the feasible way to achieve this (actually, the one which fits my needs) was doing the following:

I. Creating the specific volume for the instance that would call the other containers (in this case, JBoss):

jboss:
    build:
      context: jboss
      dockerfile: Dockerfile
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    # ... omitting the rest

II. Slightly editing my Dockerfile with a script that really does the isolation:

FROM my-private-jboss:latest
ADD isolateNetwork.sh /opt/jboss/jboss-eap/jboss-as/server/default/bin/isolateNetwork.sh
RUN chmod +x /opt/jboss/jboss-eap/jboss-as/server/default/bin/isolateNetwork.sh
CMD ["/opt/jboss/jboss-eap/jboss-as/server/default/bin/isolateNetwork.sh"]

III. Finally, the isolateNetwork.sh (warning: I had to install jq on my JBoss container to help in these extractions from docker API):

#!/usr/bin/env bash

curl -s --unix-socket /var/run/docker.sock http://localhost/containers/$(hostname)/json > container.json
export DOCKER_CONTAINER_NUMBER=$(cat container.json | jq -r '.Config.Labels["com.docker.compose.container-number"]')
export DOCKER_PROJECT_NAME=$(cat container.json | jq -r '.Config.Labels["com.docker.compose.project"]')

export MYSQL_CONTAINER_NAME=${DOCKER_PROJECT_NAME}_mysql_${DOCKER_CONTAINER_NUMBER}
export MYSQL_IP=$(curl -s --unix-socket /var/run/docker.sock http://localhost/containers/$MYSQL_CONTAINER_NAME/json | jq -r '.NetworkSettings.Networks[].IPAddress')

#Now it's just required to edit the Datasources
find . -iname "MySql*-ds.xml" -exec sed -i s/mysql:3306/${MYSQL_CONTAINER_NAME}:3306/g {} +

As you can see, the volume created during step 1 serves to access docker API from inside a container. This way, I could query the info mentioned and edit the configuration to invoke just upon the same DOCKER_CONTAINER_NUMBER . Apart from that, it is important to mention that my command to scale has a very specific requirement that is: every Jboss will have the same number of data-sources, which implies that DOCKER_CONTAINER_NUMBER will ever match.

docker-compose up --scale jboss=%1 --scale elasticsearch=%1 --scale mysql=%1 --no-recreate -d