Your browser does not seem to support JavaScript. As a result, your viewing experience will be diminished, and you may not be able to execute some actions.

Please download a browser that supports JavaScript, or enable it if it's disabled (i.e. NoScript).

How to link containers in a "icc=false" bridge?

A
Amritpal last edited by
I'd like to connect several services with a reverse proxy. But the services can't communicate with each others.

I'm using a compose file for each service.

I'm trying to use the same external bridge (icc=false).

After that, I don't understand how to allow the different communication with the reverse proxy. I've tried links and external_links but it doesn't work. Then, I have read that link will be deprecated...

Sorry for my english, I'm not a native speaker. Thanks, have a good day.
```
#Example of Test1 compose file:
version: '3'
services:
  app:
    image: nicolaka/netshoot:latest
    tty: true
    restart: always
    networks:
      app-net:
    external_links:
      - test2-app-1
networks:

app-net:

external:

name: bridge_icc_false #created with com.docker.network.bridge.enable_icc=false
```
Reply Quote 0
1 Reply Last reply
briley last edited by

icc=false means that inter-container communications are not allowed. If you want to allow inter-container communications, you need to run your containers on a network without this setting.
Reply Quote 0
1 Reply Last reply

2
Posts

0
Views

Suggested Topics

Best practice for Jenkins docker to deploy to other container
Continuous Integration and Delivery (CI, CD) • docker jenkins docker compose • • inna

2

0
Votes

2
Posts

1
Views

E

Where you say: Building the docker container from another docker container is also said to be bad practice and I also understand the reasoning for that, so that's a no-go, too. Perhaps there are bad ways of doing that but it can be a solid pattern. By way of example if you use openshift Kubernetes it runs s2i as builder images on your cluster. s2i checks out your code from git, compiles it, and pushes it to a new layer in your docker repo. It has an incremental flag where it will tar up your library deps folders at the end of a build and store as a docker layer. Then the next time you build it does a clean checkout then untars the libraries from the last build. That speeds up the next build a lot as it has the local maven cache from the last build. It also means the s2i build container can be launched on a different host in the cluster at each execution and it just connects to git and the central container registry and does a fast repeatable build. s2i is a stand alone tool that can use your local docker demon. So it acts as a single commandline ”compile my stuff into an updated docker image”. There are community supported s2i images for php7, node.js, Java etc. I recall that the java s2i will run a maven build with the “openshift” profile and expects your to copy the built WAR to “./deployment”. When you run the image that s2i writes out to your container registry it launches wildfly that is in the base layers and it deploys whatever finds in the deployment folder (but double check its been a while since I looked at it). In your case If you are using Jenkins I suggest you take advantage that it supports building docker images. Append a docker pipeline step to create your image and push it to your chosen container registry. Enterprises that use Jenkins to build and Nexus for storing JARs and WARs are now using Nexus as their container registry. They can stick with Jenkins and Nexus and simply reconfiguration things to move into the world of containers. I should also point out that you can be more “microservice-like” by skipping installing tomcat. You can use maven jetty plugin or maven tomcat plugin to just run the code with “mvn jetty:run” or “mvn tomcat7:run”. You can set a full blown config file for the servlet container via the plugins. Maven let's your set whatever jvm options you want. (note: after Tomcat 7 there doesn't seem to be support for this modern approach see the next paragraph where the mainstream now uses Jetty for this). If you like spring you can use spring boot to build an excutable JAR that runs your webapp. The JAR will be large as it has everything to run the webapp including the servlet container packed into a single JAR. You can run it as “java -jar” and it runs your webapp in an embedded servlet container. Better yet configure it's maven plugin to make an executable jar you can simply run as “./my-app-1.0.0.jar” and it will lunch. That makes building a docker image trivial. You don’t have to install tomcat you only need a container with Java on it and copy in your spring boot executable JAR and run it as the CMD. Spring Boot is very mainstream for Java microservices and it runs Jetty under the bonnet.
J

How to get the IDs of Docker Containers that belong to a Service, given the Service name or id
Continuous Integration and Delivery (CI, CD) • ssh docker containers docker swarm • • jules

2

0
Votes

2
Posts

1
Views

Answering my own question & accepting it because it works - this is the solution: Step 1: So I start by finding the Docker Service I recognise as my Drupal site "that's the site" node1 $ docker service ls As before, shown in the question, the output of that command is: ID NAME MODE REPLICAS IMAGE PORTS sr2w12kl8bg1 site1_db replicated 1/1 animage2/mariadb:latest *:13306->3306/tcp e083ij8abje1 site1_drupal replicated 1/1 animage2/drupal:d7 *:7150->80/tcp sejb0f2mfo22 site1_drush replicated 0/1 drush/drush:latest kbae02doa8rs site1_haproxy replicated 2/2 haproxy:alpine khgmnu1566rb site2_db replicated 1/1 mariadb:latest notoc1fam1gk site3_drupal replicated 1/1 animage1/drupal:d8 *:7160->80/tcp 0xtxx4jmmwa3 site4_db replicated 1/1 mariadb:latest I pick out the site animage1/drupal:d8, second from bottom in the list above and find the corresponding Service ID, notoc1fam1gk Step 2: I use this, Service ID, notoc1fam1gk, to list all the tasks for that Service, by doing this command node1 $ docker service ps notoc1fam1gk The output of that command is: ID NAME IMAGE NODE DESIRED STATE CURRENT STATE ERROR PORTS yiofs723gc89 site3_drupal.1 animage1/drupal:d8 node2 Running Running 6 days ago pgdgf783ff9v \_ site3_drupal.1 animage1/drupal:d8 node2 Shutdown Shutdown 2 weeks ago 1gfdsgcb0p2q \_ site3_drupal.1 animage1/drupal:d8 node2 Shutdown Shutdown 2 weeks ago 175lfds2jbjy \_ site3_drupal.1 animage1/drupal:d8 node2 Shutdown Shutdown 2 weeks ago qo312e143p1q \_ site3_drupal.1 animage1/drupal:d8 node2 Shutdown Shutdown 3 weeks ago Step 3: Now for the crucial bit - I still don't have a Container ID to be able to ssh into. So This command will do it for me: docker inspect -f "{{.Status.ContainerStatus.ContainerID}}" <task_id> ( Credit: https://stackoverflow.com/a/42465558/227926 ) In my example, this looks like: node1 $ docker inspect -f "{{.Status.ContainerStatus.ContainerID}}" yiofs723gc89 The output of the above command is just: 72d6a20c3d15dd9f0db4b1a60d93a91c0514946881f2dc00ca62d6a7a9ef1290 This is the container ID in the format of the 64 character SHA-256 ID. But I'm familiar with the 12 character length Container IDs that docker ps shows. The explaination is that the 12 character Container ID is just a truncated version of the full length 64 character ID - it takes the first 12 characters. So in my case, 72d6a20c3d15dd9f0db4b1a60d93a91c0514946881f2dc00ca62d6a7a9ef1290 will be 72d6a20c3d15 in the 12 character format. Step 4: So now, when I docker ps on node1 to go looking for that container ID I can use the 12 character format for the ID, 72d6a20c3d15 I'm on my Docker Swarm Node node1 and I do a docker ps: node1 $ docker ps CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES d5d45a94d45e haproxy:alpine "/docker-entrypoint.…" 3 days ago Up 3 days db_proxy_haproxy.2.91aw0apofd3iw537d249pyi62 6a4676df2b3a 22dbb7890585 "docker-entrypoint.s…" 3 days ago Up 3 days 3306/tcp site2_db.1.xxizdccg9a2hgf83tcgg1tkaej 538172a86a57 site1/drupal:asite "docker-php-entrypoi…" 3 days ago Up 3 days 80/tcp site3.1.uofsfssl72aj867r0hfs86i7m24linae8 2d487ea3788e 22dbb7890585 "docker-entrypoint.s…" 3 days ago Up 3 days 3306/tcp site4_db.1.3lnd0f9sl027f0skgza3kq373c0 d671069584d7 mariadb:latest "docker-entrypoint.s…" 3 days ago Up 3 days 3306/tcp site5.1.xoy0r6720362hlkhksu2qd beb6bcb66f43 mariadb:latest "docker-entrypoint.s…" 3 days ago Up 3 days 3306/tcp site2.1.kobk423624kljfs1uhpflfs3 But 72d6a20c3d15 isn't in the list. Why is that? Well, in my case it is on the node2 of my Docker Swarm. How do I know this? I know because the earlier command docker service ps notoc1fam1gk listed the task as node2, so I know that this task's corresponding container will be on node2. Step 5: So I connect to node2 where my container is located node1$ ssh node2 Then list the Docker Containers, by ID. And I can see 72d6a20c3d15 in this list, bottom entry: node2$ docker ps CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES 2e3bc7158d61 89up/drupal:unity "docker-php-entrypoi…" 7 days ago Up 7 days 80/tcp someothersite_drupal.1.tg33od888aj6krqqhdx0tp8ta 53122123d035 haproxy:alpine "/docker-entrypoint.…" 7 days ago Up 7 days someothersite_haproxy.1.t1x7exq98huu8q3aaok57d22 9348345f84cb haproxy:alpine "/docker-entrypoint.…" 10 days ago Up 10 days something-m_haproxy.2.02haarnwe1ssfo0x9rypx2yud 72d6a20c3d15 animage1/drupal:d8 "docker-entrypoint.s…" 2 weeks ago Up 2 weeks 80/tcp site3_drupal.1.5fqfizaxt0plh1tzt6caq0zon Step 6: I can now ssh into that container: node2$ docker exec -it 72d6a20c3d15 /bin/bash Triumph! (In your case, your Container ID may be on your node1, or whatever. I've only added this extra step for node2 to illustrate the point that one should be aware of the node that the task (and corresponding container is running on))
Z

Test automation for .NET / Java Project relying on app container
Continuous Integration and Delivery (CI, CD) • java continuous integration • • zymir

2

0
Votes

2
Posts

2
Views

K

You might start with Jenkins. It is free, open source, and popular, and it has a lot of extension points. You can use it to launch arbitrary shell or script files. A moment ago, I Googled for "Jenkins .NET" and found several articles about using Jenkins to install/run .NET applications.
E

Could other people steal my Internet connection if they had my PPPoE data?
Security, Penetration Testing • encryption authentication network internet • • esther

2

0
Votes

2
Posts

1
Views

J

I actually tried this with my neighbor who is connected to same ISP. PPPoE required 3 things: Username Password MAC if Binding is enabled by your ISP I was able to get these things from my neighbor. I spoofed the MAC address, started PPPoE connection with his credentials. And BOOM I was able to use his IP. But before that the PPPoE session of my neighbor has to be shut down. There could be only one PPPoE session at a particular time.
A

Will data contained withing Persistent Volume survive cluster deletion?
Continuous Integration and Delivery (CI, CD) • kubernetes rancher persistent volumes • • Anderson

2

0
Votes

2
Posts

1
Views

K

It depends on what your persistentVolumeReclaimPolicy is. If you manually created/defined the PersistentVolume, then the default action is to keep the data. (This sounds like what you're doing.) If you are using something like EKS on Amazon, your PV's are dynamically generated EBS volumes. In that case, they will be deleted by default. A little bit more about reclamation: https://kubernetes.io/docs/concepts/storage/persistent-volumes/#reclaiming
R

Sonar:6.7 docker container restart loop
Continuous Integration and Delivery (CI, CD) • docker • • rielyn

2

0
Votes

2
Posts

1
Views

J

I ran into the same issue and found this docker-compose file that is able to start postgres and sonarqube. https://github.com/SonarSource/docker-sonarqube/blob/master/recipes.md version: "2" services: sonarqube: image: sonarqube ports: - "9000:9000" networks: - sonarnet environment: - SONARQUBE_JDBC_URL=jdbc:postgresql://db:5432/sonar volumes: - sonarqube_conf:/opt/sonarqube/conf - sonarqube_data:/opt/sonarqube/data - sonarqube_extensions:/opt/sonarqube/extensions - sonarqube_bundled-plugins:/opt/sonarqube/lib/bundled-plugins db: image: postgres networks: - sonarnet environment: - POSTGRES_USER=sonar - POSTGRES_PASSWORD=sonar volumes: - postgresql:/var/lib/postgresql # This needs explicit mapping due to https://github.com/docker-library/postgres/blob/4e48e3228a30763913ece952c611e5e9b95c8759/Dockerfile.template#L52 - postgresql_data:/var/lib/postgresql/data networks: sonarnet: driver: bridge volumes: sonarqube_conf: sonarqube_data: sonarqube_extensions: sonarqube_bundled-plugins: postgresql: postgresql_data:
How to resolve a problem "certificate signed by unknown authority" in GKE on pulling image
Continuous Integration and Delivery (CI, CD) • docker kubernetes ssl google cloud platform google kubernetes engine • • emmalee

2

0
Votes

2
Posts

1
Views

If your on Standard Mode for your GKE cluster, go into Computer Engine > SSH into every node and put into /etc/docker/certs.d//ca.cert. Create folder if it does not exists. This works for me. The method will not work for Autopilot Mode. My exact steps on each node: mkdir -p /etc/docker/certs.d/1.2.3.4:5000 cd /etc/docker/certs.d/1.2.3.4:5000 vi /etc/docker/certs.d/1.2.3.4:5000/ca.crt Lastly, create and use the imagepullsecrets in your deployment kubectl create secret docker-registry my-secret \ --docker-server=1.2.3.4:5000 \ --docker-username='testuser' \ --docker-password='testpassword' \ --docker-email='test@example.com' cat <<EOF | kubectl apply -f ... spec: containers: - name: hello image: 1.2.3.4:5000/test:7.12.0 imagePullSecrets: - name: my-secret EOF
T

On-site Whitelisting vs. Off-site Cisco VPN
Security, Penetration Testing • web application network vpn whitelist • • Trenton

2

0
Votes

2
Posts

1
Views

N

From a very basic perspective, yes, being onsite is safer. The key reason being that there is a smaller attack surface. If you are connecting in via a VPN, there are numerous additional items which could be attacked (yes, in a perfect world, you would have a secure VPN that couldn't be broken/hacked/misconfigured, but this world is definitely not perfect) so the number of potential exploits increases. The difference may not be much in a well managed environment, but there are many organisations which still see the increase in risk as too far.
N

Webcam hack while laptop is offline
Security, Penetration Testing • network malware hardware exploit attac languageks • • nishika

2

0
Votes

2
Posts

0
Views

A

If by offline, you mean the PC is turned-off then obviously not. If you mean not connected to the Internet, then possibly. Since you could still have a local network infection or one via USB or via a document opened. But you've specified that the machine is "not infected". So that only leaves remote control via a non-infection route. If we further assume Windows, that leaves you with someone running a script remotely using a valid but unapproved account. Clearly that would need either a network or someone with physical access logging in without your permission. Take your pick. OK, so if the computer itself is turned off. It is certainly possible to remotely start a computer if it has been configured for it (WOL = Wake On LAN). This is normally disabled for obvious reasons. If the attacker also has access to your account or a system account then they can remotely run scripts on Windows using PowerShell. Much of what you can do locally with PowerShell can be run by a remote "administrator" with the right level of access. See this script as an example of capturing an image using PowerShell. It is then trivial in PowerShell to send that image, maybe via a webpage or via your own email application. This is a pretty unlikely scenario in most cases. It is far more likely that the camera is accessed via malware on the PC. However, it is trivially easy to make sure you are never spied on. Just put a flap of paper over the camera, secured with some tape across the top edge. When you want to use it, fold the paper up. You can get plastic sliders that are a little more sophisticated but basically, they do the same job.
R

Is SSL/HTTPS Needed Between Docker Containers on the Same Network?
Continuous Integration and Delivery (CI, CD) • docker nginx ssl tomcat • • rielyn

2

0
Votes

2
Posts

1
Views

B

Generally - no, I don't think you need TLS between your reverse proxy and service containers within same Docker network (or possibly 2 Docker networks: 1 internal for workers, 1 with internet access where reverse proxy sits and bridges the gap into internal network). A wider answer would primarily depend on whether you trust your Docker host and services on it. Then consider how containers address each other, do they need to leave docker network (like public name resolution) at any time. And what you'd be looking for from TLS: identity verification or transport encryption. Each of those considerations would have some caveats.
K

Finding how many filtered ports of a host that would be listed as “filtered” on Nmap
Security, Penetration Testing • network nmap ports • • Kadir

2

0
Votes

2
Posts

1
Views

D

Filtered ports can be differs according to your scan method. I think the purpose of the question is to understand this. so run it with all possible switches and compare the output to see which one is better to bypass firewall
How to count unique IP addresses with wireshark
Software Programming • network wireshark ip address • • Laycee

2

0
Votes

2
Posts

0
Views

R

Statistics > Endpoints > IPv4 または IPv6 The total number is displayed in the tab.
N

Should a backup server be on a separate subnet / vlan from other machines on the network?
Security, Penetration Testing • backup network vlans • • Nykeriab

2

0
Votes

2
Posts

0
Views

E

The reason for backups is to add redundancy, allow for business continuity and disaster recovery. Having the backup server on a separate VLAN and having access controls around it is also a good idea. From a network and security architecture point of view all servers should be on separate VLAN from clients ideally with a Firewall in between, it makes sense to take this a step further and give your ‘crown jewels’ (i.e. potentially valuable, business critical data) an extra layer of protection. Network segmentation could potentially contain malware outbreaks and/or limit how far an attacker can pivot around the network. From this point of view alone it is sensible to contain your backup server. You should only allow exactly what traffic is required, no more or no less. This goes for protocols, routes etc. In the same vein you should only allow the for the minimum administrative controls as well, for example any users that look after the backups should only have backup rights rather than full domain rights. Remember however that is the fact that clients are backing up to the server in the first place means that there is some kind of communication between clients and the server. This maybe via CIFS, SMB, a management protocol etc. So there is still a residual risk if even if configured or protected correctly. Ideally you want to go further than this and have off-site backups if possible as well as offline backups stored in a secure location with appropriate controls protecting against physical destruction.
G

Why isn't my docker a heroku container?
Software Programming • docker heroku docker compose drilling • • gionna

2

0
Votes

2
Posts

0
Views

O

Try not to merge everything into one container, but to use the container network, so you need to create a network:docker network create resources But we don't point out a network drive because default networks are being created with a type. bridgewhich connect isolated containers between themselves.Specify for each containernetworks: - resources and change the annex to make the treatment Not ♪ localhost:5432and in the name of the container, for example:container_name: postgresI need an address. postgres:5432 There is no need to separate ports.Plus this communication system, Annex grad-grade OBD is not required to separate the OBD for each project. Just add the necessary bases.
C

docker-compose exec does not execute command even when container is running
Continuous Integration and Delivery (CI, CD) • docker docker compose • • chanisef

2

0
Votes

2
Posts

0
Views

J

You can use docker exec -it to execute a command in a running container (see https://docs.docker.com/engine/reference/commandline/exec/#run-docker-exec-on-a-running-container ). Notably, this enables you to start an interactive shell session within the container, which is really handy for all sorts of things. I do wonder why you would need to call npm, though. If this is necessary to run your application, it should be done in the Dockerfile. (Alternatively it could be done in a start-up script.) Do note that your container will only stay up while it is actually running an application (that is, while the entry point call did not return), so starting up an inactive container and then manually running applications won't work. The container would simply be stopped immediately.

How to link containers in a "icc=false" bridge?

Suggested Topics

Best practice for Jenkins docker to deploy to other container Continuous Integration and Delivery (CI, CD) • docker jenkins docker compose • • inna

How to get the IDs of Docker Containers that belong to a Service, given the Service name or id Continuous Integration and Delivery (CI, CD) • ssh docker containers docker swarm • • jules

Test automation for .NET / Java Project relying on app container Continuous Integration and Delivery (CI, CD) • java continuous integration • • zymir

Could other people steal my Internet connection if they had my PPPoE data? Security, Penetration Testing • encryption authentication network internet • • esther

Will data contained withing Persistent Volume survive cluster deletion? Continuous Integration and Delivery (CI, CD) • kubernetes rancher persistent volumes • • Anderson

Sonar:6.7 docker container restart loop Continuous Integration and Delivery (CI, CD) • docker • • rielyn

How to resolve a problem "certificate signed by unknown authority" in GKE on pulling image Continuous Integration and Delivery (CI, CD) • docker kubernetes ssl google cloud platform google kubernetes engine • • emmalee

On-site Whitelisting vs. Off-site Cisco VPN Security, Penetration Testing • web application network vpn whitelist • • Trenton

Webcam hack while laptop is offline Security, Penetration Testing • network malware hardware exploit attac languageks • • nishika

Is SSL/HTTPS Needed Between Docker Containers on the Same Network? Continuous Integration and Delivery (CI, CD) • docker nginx ssl tomcat • • rielyn

Finding how many filtered ports of a host that would be listed as “filtered” on Nmap Security, Penetration Testing • network nmap ports • • Kadir

How to count unique IP addresses with wireshark Software Programming • network wireshark ip address • • Laycee

Should a backup server be on a separate subnet / vlan from other machines on the network? Security, Penetration Testing • backup network vlans • • Nykeriab

Why isn't my docker a heroku container? Software Programming • docker heroku docker compose drilling • • gionna

docker-compose exec does not execute command even when container is running Continuous Integration and Delivery (CI, CD) • docker docker compose • • chanisef

Best practice for Jenkins docker to deploy to other container
Continuous Integration and Delivery (CI, CD) • docker jenkins docker compose • • inna

How to get the IDs of Docker Containers that belong to a Service, given the Service name or id
Continuous Integration and Delivery (CI, CD) • ssh docker containers docker swarm • • jules

Test automation for .NET / Java Project relying on app container
Continuous Integration and Delivery (CI, CD) • java continuous integration • • zymir

Could other people steal my Internet connection if they had my PPPoE data?
Security, Penetration Testing • encryption authentication network internet • • esther

Will data contained withing Persistent Volume survive cluster deletion?
Continuous Integration and Delivery (CI, CD) • kubernetes rancher persistent volumes • • Anderson

Sonar:6.7 docker container restart loop
Continuous Integration and Delivery (CI, CD) • docker • • rielyn

How to resolve a problem "certificate signed by unknown authority" in GKE on pulling image
Continuous Integration and Delivery (CI, CD) • docker kubernetes ssl google cloud platform google kubernetes engine • • emmalee

On-site Whitelisting vs. Off-site Cisco VPN
Security, Penetration Testing • web application network vpn whitelist • • Trenton

Webcam hack while laptop is offline
Security, Penetration Testing • network malware hardware exploit attac languageks • • nishika

Is SSL/HTTPS Needed Between Docker Containers on the Same Network?
Continuous Integration and Delivery (CI, CD) • docker nginx ssl tomcat • • rielyn

Finding how many filtered ports of a host that would be listed as “filtered” on Nmap
Security, Penetration Testing • network nmap ports • • Kadir

How to count unique IP addresses with wireshark
Software Programming • network wireshark ip address • • Laycee

Should a backup server be on a separate subnet / vlan from other machines on the network?
Security, Penetration Testing • backup network vlans • • Nykeriab

Why isn't my docker a heroku container?
Software Programming • docker heroku docker compose drilling • • gionna

docker-compose exec does not execute command even when container is running
Continuous Integration and Delivery (CI, CD) • docker docker compose • • chanisef