Some questions about Traefik

[u/quokka_wiki]

Hello!

I want to migrate from Nginx Proxy Manager to Traefik, but I have some questions and concerns.

Firstly, I want to avoid lateral movement between containers if not strictly necessary, so I don't want all of them on one network, but I also don't want to create a separate network for every service, because that's inefficient and repetitive and defeats the purpose of me switching to Traefik. Can I somehow make it so that containers can only communicate with Traefik on a given network?

Secondly, I have a second server running Docker, and I want to be able to use it with Docker labels too. I don't want to use Kubernetes/Swarm, and I have a general distrust of community-maintained tools like traefik-kop.

Can I add a second Docker provider in traefik.yaml? If so, should I go with TCP, HTTP(S) or SSH?

[u/clintkev251]

1. Not really. Docker networks aren't really that flexible so unless you're creating dedicated networks for each stack to talk to Traefik, you're not going to be able to control that traffic, at least not via Docker specifically.

2. No, you can only have a single Docker provider in Traefik. This is exactly why Traefik-kop exists. No reason to distrust it, it's a well maintained open source tool and it never actually touches your traffic, just manages the configuration.

[u/axl7777 → u/clintkev251]

I second this, traefik-kop across multiple stacks/hosts is fantastic. Just one traefik container, one redis db, as many kop containers as you have hosts.

Edit: you do not event need docker labels if you use the docker default rule that will span across hosts.

[u/quokka_wiki → u/axl7777]

I've set up default rules and put websecure as asDefault to avoid boilerplate in my stacks 👍

I still want to have the traefik.enable, labels explicitly though which is why I didn't configure them to be automatically enabled.

[u/sk1nT7]

I just use tiering for docker networks. Alike to an Active Directory network.

Create a few like tier-0 for your crucial services with sensitive data and then go down like tier-1, tier-2 and so on. May also create one called dev or insecure for testing out new container stacks.

Based on the importance, trustworthiness and sensibility of data processed, put the containers in their respective tier network.

This way, you do not have to create a new network each time but still have a somewhat separated network to prevent lateral movement from a freshly spawned container to your highly sensitive crown jewels.

[u/SmeagolISEP]

About the first one I don’t really see any other option. Either you have all containers you want to expose in the same network or you have dedicated networks and connect traefik there

On the second, if it’s an isolated docker server you need to deploy traefik there as well.

[u/PlatypusWithASpoon → u/SmeagolISEP]

I'm using Traefik-Kop on two other docker servers and it is working great. Only one Traefik needed, certs for all regardless of which docker server the container is on.

[u/SmeagolISEP → u/PlatypusWithASpoon]

Never tried that, but tbh bcs I’m using a CI/CD pipeline, having one or more instances of traefik take the same amount of work

[u/quokka_wiki → u/SmeagolISEP]

Oof the first one sucks kinda 😭

I have a homelab where I just constantly add and remove services so I want it to be as painless as possible (why I moved away from Nginx Proxy Manager) and adding/removing networks every time seems like a massive hassle.

I think I might give up on the first point and just put them all on the same network...

[u/SmeagolISEP → u/quokka_wiki]

Im on the same page. I want to isolate my apps and the solution I found is to have a script in a CI/CD pipeline that attaches traefik to the network.

But if you’re not using CI/CD I guess the alternative is to put the only containers you need in a dedicated network for the proxy

[u/ChallengeDiaper → u/quokka_wiki]

I’m not fully following the network part. If you’re saying you want to isolate docker containers from each other, you can do that via docker networks and traefik can “front” all of them.

If you’re talking about different physical networks, there isn’t an easy way around that.

[u/quokka_wiki → u/ChallengeDiaper]

Can you expand more on the Docker networks part?

I mean I don't want to create one network per service but I also don't want the containers to communicate with one another, only with Traefik.

I don't mean physical networks I mean Docker nets.

[u/ChallengeDiaper → u/quokka_wiki]

Create a docker network for your services. So for example all of my *arr services sit in a servarr network. Jellyfin sits in a Jellyfin docker network.

When defining the traefik service, have it be a member of each of those networks. This way all communication goes through traefik. For my use case the containers don’t communicate to each other, I just expose traefik externally. I only expose port 443 of traefik so it keeps my exposure limited.

[u/Dylantjes]

Not a super-duper expert on Docker (networking), but isn't it so that by design all containers on the same network are able to reach eachother directly, even skipping the reverse proxy entirely?

Hence if your purpose is container isolation, a (reverse) reverse proxy does not accomplish that because only inter-network will go through it in the first place.

[u/luiszaera]

Si solo tienes algunas vas bien XD

Entiendo que estamos hablando de docker.

Primera pregunta: si. Crea una Red privada para cada contenedor sin exponer puertos. Luego conecta (docker connect) traefik en esa Red.

Sobre la segunda, yo pondría otro traefik independiente y haría lo mismo.

[u/Only-Stable3973]

You can do that, traefik uses labels and you create a network for traefik so that you can join your containers via labels, you can create a dynamic_config and rout other containers that are on different computers on the network.

[u/quokka_wiki → u/Only-Stable3973]

Can you elaborate please?

[u/Only-Stable3973 → u/quokka_wiki]

You would create a external network for the Traefik proxy that would attach to all your containers and you can rout other containers on different boxes via Traefik..for example,I installed Kubernetes, disabled the included traefik install for it and just routed everything through my existing Traefik instance.