Ufdjrw

I'm getting a strange error when trying to start up a docker-swarm with docker-compose. I'm trying to use the following (brief) tutorial to convert a docker-compose swarm using HAProxy to use letsencrypt ssl. You can see the tutorial here: http://blog.armstrongconsulting.com/?p=392.

Here is my docker-compose file:

version: '3.3'
services:
 back:
 image: patientplatypus/lowtechback:latest
 ports:
 - '5000:5000'
 deploy:
 replicas: 3
 restart_policy:
 condition: on-failure
 max_attempts: 5
 window: 120s
 networks:
 - web
 front:
 image: patientplatypus/lowtechfront:latest
 ports:
 - '80:3000'
 depends_on:
 - back
 deploy:
 replicas: 3
 restart_policy:
 condition: on-failure
 max_attempts: 5
 window: 120s
 networks:
 - web
 proxy:
 # image: dockercloud/haproxy
 image: nmarus/haproxy-certbot
 depends_on:
 - back
 - front
 environment:
 - BALANCE=leastconn
 volumes:
 - /var/run/docker.sock:/var/run/docker.sock
 ports:
 - 8080:8080
 expose:
 - "8080"
 - "3000"
 - "5000"
 cap_add:
 - ALL
 - NET_ADMIN
 volumes:
 - ./data/config:/config
 - ./data/letsencrypt:/etc/letsencrypt
 - ./data/certs:/usr/local/etc/haproxy/certs.d
 networks:
 - web
 deploy:
 placement:
 constraints: [node.role == manager]
networks:
 web:
 driver: overlay

In ./data/config/haproxy.cfg there is a file that has configuration options for haproxy to use ssl. The only relevant change I made to the default config (you can see that here: https://hub.docker.com/r/nmarus/haproxy-certbot) that I made was this:

backend my_http_backend
 mode http
 balance leastconn
 option tcp-check
 option log-health-checks
 server back back:5000 check port 5000
 server front front:80 check port 80

to route to my own containers.

When I run the following commands (as root):

 docker swarm init 
 --advertise-addr MY_IP_ADD_SS
docker stack deploy --compose-file=docker-compose.yaml prod2

I get the following:

root@ubuntu-1gb-nyc3-01:/lowteck# docker service ls
ID NAME MODE REPLICAS IMAGE PORTS
ko2xkerpki9f prod2_back replicated 3/3 patientplatypus/lowtechback:latest *:5000->5000/tcp
rly8rrb5uiht prod2_front replicated 3/3 patientplatypus/lowtechfront:latest *:80->3000/tcp
nuf7219sxteu prod2_proxy replicated 0/1 nmarus/haproxy-certbot:latest *:8080->8080/tcp
root@ubuntu-1gb-nyc3-01:/lowteck# docker service logs prod2_proxy
prod2_proxy.1.y2eagrgn52fg@ubuntu-1gb-nyc3-01 | getsockopt failed strangely: Operation not permitted
prod2_proxy.1.ycbj0rojv2tl@ubuntu-1gb-nyc3-01 | getsockopt failed strangely: Operation not permitted
prod2_proxy.1.y4mt1es20q0v@ubuntu-1gb-nyc3-01 | getsockopt failed strangely: Operation not permitted
prod2_proxy.1.ohopcbdmgvwt@ubuntu-1gb-nyc3-01 | getsockopt failed strangely: Operation not permitted

As far as I can tell I've set the cap_add option to allow this operation in the proxy container, I've run the swarm command as root, and I should have read/write/execute permissions on my haproxy.cfg file. Why am I getting this strange error?

I'm guessing the bind-mounts are causing that problem in haproxy, or just something wrong with the nmarus/haproxy-certbot image.

In Swarm it's recommended you use docker volume's to store persistent data like the certs and configs generated by your container. If using multiple Swarm nodes, you need to use shared storage with something like http://rexray.io to ensure volumes are not "stuck" on one node.

Optionally, you could use Swarm Secrets and Configs to inject those things into containers if you're providing them to the container at start, but I'm guessing that image you're using generates them on the fly.

Also, depends_on, cap_add, and expose are not used by Swarm. See the compose file doc on each feature you want to use in the yaml.

Lastly, it looks like the image you're using doesn't support using the docker socket like you have mounted (you have two volumes: objects in the same service) and so you really should look at proxies that are "swarm aware" and can self-update based on services you deploy. Traefik does this, and I go through examples of using it in Swarm on GitHub.