设置 Traefik 拦截 Docker 容器之间的流量

Question

I have Traefik container (traefik v. 2.8) running as reverse proxy for local development. I also use docker-compose.yml file to define my services.

Also, I have exposed the services present in docker-compose.yml via host.docker.internal by setting these lines in my /etc/hosts file:

127.0.0.1       host.docker.internal
localhost       host.docker.internal

My setup is as such:

• host.docker.internal:8443 used for service_a
• host.docker.internal:8453 used for service_b

I have setup Traefik route from a.localhost that goes to host.docker.internal:8443. I can access a.localhost from the host outside the containers just fine, and Traefik does really route the traffic to host.docker.internal:8443 as I want.

Problem is that I have a reason to have service B (host.docker.internal:8453) call service A via the a.localhost hostname. This does not work, as in service B, I get unknown host when trying to access a.localhost

Here is extract from my docker-compose.yml file:

version: '3'
services:
  reverse_proxy:
  image: traefik:v2.8
    # Enables the web UI and tells Traefik to listen to docker
    command: --api.insecure=true --providers.docker
    ports:
      - "80:80"
      - "443:443"
      # The Web UI (enabled by --api.insecure=true)
      - "9000:8080"
    volumes:
      # So that Traefik can listen to the Docker events
      - /var/run/docker.sock:/var/run/docker.sock
      - ./dev-traefik/traefik.yml:/etc/traefik/traefik.yml
      - ./dev-traefik:/configurations
  
  service_a:
    ports:
      - "8443:8443"

  service_b:
    ports:
      - "8453:8453"

Also I'm using a yml-based configuration for Traefik, present in dynamic-config.yml :

http:
  routers:
    service-a-router:
      service: service-a
      rule: "Host(`a.localhost`)"
      tls: "true" # using tls
  services:
    service-a:
      loadBalancer:
        servers:
          - url: "https://host.docker.internal:8443" # service A

tls:
  certificates:
    - certFile: "/etc/https/tls.crt"
      keyFile: "/etc/https/tls.key"
  stores:
    default:
      defaultCertificate:
        certFile: "/etc/https/tls.crt"
        keyFile: "/etc/https/tls.key"

It seems like Traefik is able to listen to requests made from host network, as accessing https://a.localhost from browser outside the container network works just fine. On the other hand, requests made by service_a container don't seem to be caught by Traefik.

What I have also tried is to add a.localhost to /etc/hosts in the host machine running the containers like this:

127.0.0.1   a.localhost
localhost   a.localhost

And then using curl inside service B container to access service A.

This resulted in getting connection refused as opposed to Could not resolve host: a.localhost . This leads me to suggest that traefik couldn't intercept traffic from service b container

What am I doing wrong? Is there a way to make such setup work? I do have a legit reason for it, which relates to having as close setup as possible in local development as on other environments which are deployed to cloud.

Answer 1

I wasn't able to have Traefik intercept container -> container traffic the way I originally specified I'd want, but was able to actually nevertheless get similar setup working.

Here's the scenario:

I have two services that are accessed via HTTP & TLS:

• service_a
• service_b

I want to be able to use host.docker.internal special DNS name to my advantage and actually have Traefik to proxy traffic from https://host.docker.internal/service_a to service_a port 8443 both outside Docker container network (from the host machine running Docker) AND from service_b via the fact that both the host machine running Docker can access host.docker.internal and also hosts inside the Docker network. Using this fact to my advantage, I just defined a path for service_a as such in Traefik's YML configuration file:

http:
  routers:
    service-a-router:
      service: service-a
      rule: "Host(`host.docker.internal`) && PathPrefix(`/service_a`)"
      tls: "true" # using tls
  services:
    service-a:
      loadBalancer:
        servers:
          - url: "https://host.docker.internal:8443" # service A

tls:
  certificates:
    - certFile: "/etc/https/tls.crt"
      keyFile: "/etc/https/tls.key"
  stores:
    default:
      defaultCertificate:
        certFile: "/etc/https/tls.crt"
        keyFile: "/etc/https/tls.key"

And docker-compose.yml was made to look like this:

version: '3'
services:
  reverse_proxy:
  image: traefik:v2.8
    # Enables the web UI and tells Traefik to listen to docker
    command: --api.insecure=true --providers.docker
    ports:
      - "80:80"
      - "443:443"
      # The Web UI (enabled by --api.insecure=true)
      - "9000:8080"
    volumes:
      # So that Traefik can listen to the Docker events
      - /var/run/docker.sock:/var/run/docker.sock
      - ./dev-traefik/traefik.yml:/etc/traefik/traefik.yml
      - ./dev-traefik:/configurations
  
  service_a:
    ports:
      - "8443:8443"

  service_b:
    ports:
      - "8453:8453"

Now as I use host.docker.internal in Host rule in my Traefik YML config, Traefik is in fact able to intercept both traffic from the Docker host machine and from the Docker container service_b .

service_b just need to configure URL of https://host.docker.internal/service_a to access service_a through Traefik.