Docker

Docker

There is a Dockerfile and a compose.yaml in the repository: a slim image that runs warden serve as an unprivileged user, and a compose file bringing up a hub with two nodes reporting to it.

The one thing to know first

A warden in a container sees the container's ports, not the host's.

Port probing and warden ports describe the network namespace they run in. A warden in its own namespace is a perfectly good registry for services in that same namespace, and it is blind to everything on the host.

So there are two different things you might want, and they are set up differently:

You want	Run it
A registry other containers ask for ports	In its own namespace, as below
A registry that manages the host's ports	network_mode: host, or not in a container at all

With network_mode: host the warden is on the host's network, where WARDEN_TOKEN is the only thing between it and everyone else on that network. Set one.

One warden

docker build -t warden .
docker run -d --name warden \
  -p 127.0.0.1:7010:7010 \
  -v warden-data:/data \
  -e WARDEN_TOKEN=your-token \
  warden

Database	/data/warden.db, so give it a volume or lose the registry on every restart
Listens on	0.0.0.0:7010 inside the container — publish it to 127.0.0.1 unless something else really has to reach it
Runs as	uid 10001, not root
Healthcheck	/health, every 30 seconds

The image takes the same settings as everything else; see Configuration.

A hub and two nodes

export WARDEN_TOKEN=your-token
export WARDEN_CLUSTER_TOKEN=a-different-one
docker compose up -d
docker compose exec hub warden nodes

NODE      URL                   POOL       VERSION  STATUS  LAST SEEN
build-01  http://build-01:7010  8000-8999  0.1.0    online  4s ago
build-02  http://build-02:7010  8000-8999  0.1.0    online  6s ago

The compose file refuses to start without both tokens rather than shipping defaults that would outlive the demonstration. Each node advertises itself under its compose service name, which is what the hub resolves it by on the compose network — see Cluster.

Each node keeps its own database in its own volume. Two nodes handing out 8000-8999 is not a conflict: they are different machines as far as warden is concerned, and the pool is per node.

What it is not

The image is not a way to manage a developer machine's ports from inside a container. For that, install warden on the machine — Installation — and let the containers register with it through host.docker.internal or the host's address.