It works with Docker swarm ?

[D0wn3r]

Do this works with docker swarm ?

I have a

level=WARN msg="blocked request" reason="forbidden IP" method=GET URL=/v1.24/version client=10.0.2.67:60802 response=403

When I try to use it with Traefik v3. I guess this is supposed to be allowed with the option -allowfrom=reverse-proxy in the command but with swarm is that works ?

(reverse-proxy in the name of my traefik service in the stack)

Thanks

[D0wn3r]

It works if I set ip (but I would like it dynamic) and if I allow all GET

services:
  dockerproxy:
    image: wollomatic/socket-proxy:1 # see https://github.com/wollomatic/socket-proxy for reference
    command:
      - '-loglevel=info' # set to debug for far more logging
      - '-allowfrom=10.0.2.67,10.0.2.68,10.0.2.62'
      - '-listenip=0.0.0.0'
      - '-allowGET=.*' # this regexp allows readonly access only for requests that traefik needs
      - '-shutdowngracetime=5'
      - '-watchdoginterval=600'
      - '-stoponwatchdog'

[wollomatic]

The above error message is caused by the -allowfrom configuration.

If the hostnames in Swarm are dynamically generated, it is difficult to set an allowlist for them. A possibility would be to allow a local network range, e.g., -allowfrom=10.0.2.0/24. Please keep in mind that this can easily result in insecure configurations (on the other hand, most of the other Socket-Proxy-Software allows access from any IP).

---

The -allowGET option depends on how you use Traefik:

If you use the docker provider (https://doc.traefik.io/traefik/providers/docker/), the '-allowGET=/v1\..{1,2}/(version|containers/.*|events.*)' is fine for socket-proxy.

You probably need another configuration for the allowlist if you use the swarm provider (https://doc.traefik.io/traefik/providers/swarm/): Maybe -allowGET=.* is fine in that case. You can enable the debug logging and see how the requests look. After that, you can create a more specific working regexp.

Also, see #30

(I'll convert this issue to a discussion)