Multi-tenant VirtualHost isolation with OriginMapStore in Docker Swarm clustering

[Mengsreang-Chhoeung]

Problem

I'm building a multi-tenant livestreaming platform on OME with Docker Swarm orchestration. Each tenant gets their own VirtualHost with a unique broadcaster subdomain (e.g., user1-stream.cm.com, user2-stream.cm.com).

The issue is: How do I isolate streams between VirtualHosts when using OriginMapStore in a single Docker network?

Currently:

• Origin and Edge run as Docker Swarm services in the same network
• Multiple VirtualHosts exist on both origin and edge
• All VirtualHosts on origin are configured with the same originHostName: "ome-origin"

Current Setup

Origin OriginMapStore config:

{
  "originMapStore": {
    "originHostName": "ome-origin",
    "redisServer": {
      "host": "cloud-redis.local:6379"
    }
  }
}

Edge OriginMapStore config:

{
  "originMapStore": {
    "redisServer": {
      "host": "cloud-redis.local:6379"
    }
  }
}

Origin (multiple VirtualHosts):

{
  "name": "vhost-user-1",
  "distribution": "vhost-user-1",
  "host": {
    "names": [
      "user1-stream.cm.com",
      "ome-origin"
    ]
  }
}

{
  "name": "vhost-user-2",
  "distribution": "vhost-user-2",
  "host": {
    "names": [
      "user2-stream.cm.com",
      "ome-origin"
    ]
  }
}

The Challenge

Since all VirtualHosts point to the same originHostName, OME can't decide which VirtualHost owns a stream. The question is: Is there a better pattern for multi-tenant isolation with OriginMapStore?

To note that: Please correct me if I'm wrong.

What I've tried

1. Using the same originHostName for all VirtualHosts (ambiguous stream routing)

Any guidance would be appreciated!

[Mengsreang-Chhoeung]

Anybody can help me with this?

[getroot]

OME identifies a VirtualHost by its domain (the host.names).
originHostName is where the Origin registers its own domain name. The Origin publishes each stream into OriginMapStore (Redis) as ovt://{originHostName}/app/stream, and the Edge pulls from that URL.
Two issues in your setup:
Both vhosts share ome-origin in host.names, so it cannot work as a VirtualHost discriminator. A request to ome-origin/app/stream will only route to the first matching VirtualHost.
Both vhosts also use the same originHostName: "ome-origin", so every stream is registered as ovt://ome-origin/app/stream. The Edge cannot tell which VirtualHost owns the stream.
The fix is to give each tenant its own domain, used as both the VirtualHost name and the originHostName:

vhost-user-1 → originHostName: "user1-stream.cm.com"
vhost-user-2 → originHostName: "user2-stream.cm.com"

Each stream is then registered under a unique domain (ovt://user1-stream.cm.com/app/stream), and the Edge resolves it to the correct VirtualHost.

As a side note, with Docker Swarm we'd suggest running one VirtualHost per OME container for cleaner isolation and scaling.

[Mengsreang-Chhoeung]

Thanks for your help.