docker-swarm - Traefik无法路由到具有已发布端口的容器

我正在尝试在Docker Swarm中在Traefik后面运行GitLab。只要GitLab容器不发布任何端口，我就能成功地做到这一点。如果我发布端口（即用于SSH），则Traefik在尝试路由到该端口时会给出网关超时。

我尝试仅在Traefik后面运行裸机nginx服务器，如果我在nginx容器中发布了任意端口，Traefik将不再能够路由到它-因此，这不是GitLab容器特有的问题。

这是我的功能性docker-compose.yml：

version: "3.7"

services:
  socat:
    image: alpine/socat
    command: tcp-listen:2375,fork,reuseaddr unix-connect:/var/run/docker.sock
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    networks:
      - mgmt
    deploy:
      mode: global
      placement:
        constraints:
          - node.role == manager

  traefik:
    image: traefik:latest
    configs:
      - source: traefik
        target: /etc/traefik.toml
    command: --etcd --etcd.endpoint=stateful_etcd-1:2379,stateful_etcd-2:2379,stateful_etcd-3:2379 --etcd.useAPIV3
    ports:
      - 80:80
      - 443:443
      - 8080:8080
    networks:
      - mgmt
      - gitlab
      - stateful_etcd
    deploy:
      replicas: 2
      placement:
        constraints:
          - node.role == worker
    depends_on:
      - socat

  gitlab:
    image: 'gitlab/gitlab-ce:latest'
    networks:
      - gitlab
    environment:
       GITLAB_OMNIBUS_CONFIG: |
        external_url 'https://example.com'
        nginx['listen_port'] = 80
        nginx['listen_https'] = false
        gitlab_rails['gitlab_shell_ssh_port'] = 10022
        user['username'] = "root"
        user['group'] = "root"
    volumes:
      - test-gitlab-logs:/var/log/gitlab
      - test-gitlab-data:/var/opt/gitlab
    deploy:
      labels:
        traefik.docker.network: gitlab
        traefik.enable: "true"
        traefik.frontend.rule: "Host:example.com"
        traefik.port: 80
        traefik.protocol: http
      placement:
        constraints:
          - node.role == worker

networks:
  mgmt:
  gitlab:
  stateful_etcd:
    external: true

configs:
  traefik:
    file: ./traefik.toml

volumes:
  test-gitlab-logs:
    external: true
  test-gitlab-data:
    external: true

和我的traefik.toml：

debug = false

logLevel = "ERROR"
defaultEntryPoints = ["http", "https"]

[entryPoints]
  [entryPoints.http]
  address = ":80"
    [entryPoints.http.redirect]
    entryPoint = "https"
  [entryPoints.https]
  address = ":443"
  [entryPoints.https.tls]

[api]
entrypoint = "traefik"
dashboard= true
debug = true

[retry]

[docker]
endpoint = "tcp://socat:2375"
watch = true
swarmMode = true
exposedByDefault = false

[etcd]
endpoint = "stateful_etcd-1:2379,stateful_etcd-2:2379,stateful_etcd-3:2379"
watch = true
prefix = "/traefik"
useAPIV3 = true

[acme]
caServer = "https://acme-staging-v02.api.letsencrypt.org/directory"
email = "me@me.com"
storage = "traefik/acme/account"
entryPoint = "https"
onHostRule = true
[acme.httpChallenge]
entryPoint = "http"

仅供参考，我在另一个存储配置的堆栈中有3个etcd实例。

此设置有效-我可以转到https://example.com并访问GitLab。但是，如果我将其添加到GitLab容器中：

ports:
  - 10022:22

我去https://example.com时得到网关超时。

这是预期的行为吗？有没有更好的方法来发布容器的SSH端口？

谢谢！

我无法直接解决该问题，但是我可以通过将SSH代理作为单独的服务来解决此问题：

ssh-proxy:
    image: tecnativa/tcp-proxy
    networks:
      - gitlab
    ports:
      - 10022:10022
    environment:
      LISTEN: ":10022"
      TALK: "gitlab:22"

Traefik无法路由到具有已发布端口的容器

1 个答案: