Example for traefik

[lonix1]

I've noticed docker-socker-proxy in many blog articles and tutorials, but there's never any configuration - it is just added to a docker-compose.yml file. But the readme in this repo shows that's not enough - we need to configure it. As the docs say:

Revoke access to any API section that you consider your service should not need

Does someone have a working traefik example to share, which shows how to configure this to allow traefik with the access it needs, but without exposing everything?

[maxfield-allison]

https://github.com/htpcBeginner/docker-traefik/blob/master/docker-compose-t2.yml

[miguelarios]

Hi do you know where else this is hosted as that file is gone now.

[maxfield-allison]

https://github.com/anandslab/docker-traefik

[Rohaq]

Here's an minimum required example I just got working off the back of the above link:

networks:
  default:
    driver: bridge
  socket_proxy:
    name: socket_proxy
    driver: bridge
  # ⬇ Run "docker network create web" to create - attach other services you want to serve through traefik to this network
  web:
    external: true

services:
  reverse-proxy:
    image: traefik:v3.1
    container_name: traefik
    restart: always
    command:
      - "--api.insecure=true"
      - "--api.dashboard=true"
      - "--providers.docker=true"
      - "--providers.docker.endpoint=tcp://socket-proxy:2375"
      - "--providers.docker.exposedByDefault=false"
      - "--providers.docker.network=web"
      - "--entrypoints.web.address=:80"
    ports:
      - "80:80"
    networks:
      - web
      - socket_proxy
    labels:
      - "traefik.enable=true"
      # ⬇ Serves your Traefik dashboard on http://traefik.localhost
      - "traefik.http.routers.traefik-rtr.entrypoints=web"
      - "traefik.http.routers.traefik-rtr.rule=Host(`traefik.localhost`)"
      - "traefik.http.routers.traefik-rtr.service=traefik-svc"
      - "traefik.http.services.traefik-svc.loadbalancer.server.port=8080"
    depends_on:
      - socket-proxy

  socket-proxy:
    image: tecnativa/docker-socket-proxy
    container_name: socket-proxy
    restart: unless-stopped
    networks:
      - socket_proxy
    ports:
      - "2375:2375"
    security_opt:
      - no-new-privileges:true
    environment:
      - CONTAINERS=1
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock"

[koelle25]

Here is a minimum example if you are using Docker Swarm-Mode:

services:
  traefik:
    image: traefik:v3.5
    command:
      - "--providers.swarm"
      - "--providers.swarm.endpoint=tcp://socket-proxy:2375"
      - "--providers.swarm.exposedByDefault=false"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.websecure.address=:443"
      # Enable the Traefik log, for configurations and errors
      - "--log"
      - "--log.level=INFO"
      # Enable the Dashboard
      - "--api=true"
    deploy:
      labels:
        - "traefik.enable=true"
        - "traefik.http.routers.dashboard.rule=(PathPrefix(`/api`) || PathPrefix(`/dashboard`))"
        - "traefik.http.routers.dashboard.service=api@internal"
        - "traefik.http.services.dummy-svc.loadbalancer.server.port=9999"
    networks:
      - default
      - socket_proxy
    ports:
      - 80:80
      - 443:443

  socket-proxy:
    image: tecnativa/docker-socket-proxy:v0.4.1
    networks:
      - socket-proxy
    environment:
      - CONTAINERS=1
      - NETWORKS=1
      - NODES=1
      - SERVICES=1
      - SWARM=1
      - TASKS=1
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock

networks:
  default:
  socket_proxy:

Note: security_opt is not supported in Swarm-Mode.