Can we make it possible to enable the Traefik Docker provider so non-DDEV service can be routed?

[jerrac]

First, the docs make it clear that DDEV generates static file configuration for Traefik, and that the way to modify Traefik configuration is via static files. (Not to mention the utter lack of anyone else asking about this when I searched....) So I get that this request might not fit in very well. But I'm going to try anyway. :)

Before I get into the details of my request, I did try a few different methods of modifying the router config using ~/.ddev/.router-compose.custom.yaml and ~/.ddev/traefik/static_config.watch_docker.yaml files. It feels like it should be possible, but I kept getting Cannot connect to the Docker daemon at unix://< whichever path I tried mounting /var/run/docker.sock at for the current try >. Is the docker daemon running errors after applying the config via poweroff and then start. (If this should be possible, let me know and I'll switch to a support request...)

On to why I am asking.

I use Traefik in production via the Docker and Docker Swarm providers. Which means there are times I need to test how my labels are applied locally before deploying to production. DDEV, also, is a development tool, and can't represent my production environment.

The specific issue that triggered my attempts to get this work is that I'm modifying how I configure some services that run inside the image I use in production. Since that config is completely outside of DDEV's scope, I am running a custom docker compose that uses labels to tell Traefik how to route to it. This is how I used to do my development before I found DDEV. Those labels would let me visit the website/app I'm working on to confirm my configuration changes work.

Now, I could run another instance of Traefik. But I've done that. And it introduces the need to change which port is in the url every time DDEV needs to change. And that can happen frequently enough that it makes using DDEV frustrating.

I could also copy my Dockerfile settings into my project's .ddev web image, but then I have to remember to update both that file, and my main file. Plus, that would result in an image based on DDEV, which is not what my production image is going to look like.

The TL;DR boils down to DDEV being a development environment that doesn't represent production close enough for certain kinds of configurations to be worked on. Therefore I need a way to route traffic to my non-DDEV service when I'm working on something DDEV can't help with.

Does that all make sense?

For implementation, I'm not familiar with DDEV's internals at all, and therefore have no real clue how it should be implemented.

Thanks for taking the time to read, and maybe consider, this. :)

[rfay]

Hi @jerrac - Until a few years ago we mounted the docker sock into the router and used docker notifications to get updates. That unfortunately is a security disaster, because on a normal rootful docker instance it means that the container has full control of docker and thus of anything the docker server has access to on the host (which on rootful docker is a lot). You can find many, many discussions about this on google especially

• https://doc.traefik.io/traefik/reference/install-configuration/providers/docker/#docker-api-access
• https://docs.docker.com/engine/security/#docker-daemon-attack-surface

However, you might be able to make it work with:

~/.ddev/router-compose.docker.yaml (note: no leading dot, must match glob router-compose.*.yaml, I think you fiddled with .router-compose.yaml, which gets overwritten, is owned by DDEV

services:
  ddev-router:
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro

~/.ddev/traefik/static_config.docker.yaml:

providers:
  docker:
    endpoint: "unix:///var/run/docker.sock"
    watch: true
    exposedByDefault: false

I note that the traefik swarm provider is not the same as the docker provider, so you might have different results.

Another technique you could use for your particular application is to run a simple docker listener or traefik instance whose only job is to log labels it hears about.

[jerrac]

Oh. That explains why I didn't find anyone asking for it, it'd already been done and wasn't the best idea out there.

I had tried modifying the compose file owned by DDEV. But I hadn't realized I'm not supposed to name my custom files without the leading ..

Swarm mode requires docker have root access. Due to networking, I think. It's been a while since I checked. That's been my excuse for putting off figuring out rootless docker. Guess it's time to revisit that and do better at security.

Thanks for the quick reply. :)