{"id":5987,"date":"2022-01-24T15:22:32","date_gmt":"2022-01-24T15:22:32","guid":{"rendered":"https:\/\/mailinvest.blog\/index.php\/2022\/01\/24\/how-to-route-traffic-to-docker-containers-with-traefik-reverse-proxy-cloudsavvy-it\/"},"modified":"2022-01-24T15:22:32","modified_gmt":"2022-01-24T15:22:32","slug":"how-to-route-traffic-to-docker-containers-with-traefik-reverse-proxy-cloudsavvy-it","status":"publish","type":"post","link":"https:\/\/mailinvest.blog\/index.php\/2022\/01\/24\/how-to-route-traffic-to-docker-containers-with-traefik-reverse-proxy-cloudsavvy-it\/","title":{"rendered":"How to Route Traffic to Docker Containers With Traefik Reverse Proxy \u2013 CloudSavvy IT"},"content":{"rendered":"

<\/a>\n<\/p>\n

\n

\"Traefik<\/p>\n

Traefik is<\/a> a leading reverse proxy and load balancer for cloud-native operations and containerized workloads. It functions as an edge router that publishes your services to the internet.<\/p>\n

Traefik routes requests to your containers by matching request attributes such as the domain, URL, and port. The proxy incorporates automatic service discovery so you can add new containers in real-time, without restarting the Traefik service.<\/p>\n

In this guide, we\u2019ll put together a simple Traefik v2 deployment that will publish multiple Docker containers. This lets you use one Docker installation to provide several services over the same port, such as a web application, API, and administration panel.<\/p>\n

Getting Started<\/h2>\n

It\u2019s easiest to deploy Traefik using its own Docker image<\/a>. We\u2019ll assume you\u2019re running Traefik with Docker for the remainder of this guide. Single-file binaries are available<\/a> as an alternative option if you\u2019d prefer Traefik to sit outside your Docker installation.<\/p>\n

You must create a config file before you can start using Traefik. Add the following content to a traefik.toml<\/code> file \u2013 we\u2019ll explain what it does below:<\/p>\n

\n
\n
\n
\n
\n
\n
\n
[entryPoints]
\n  [entryPoints.http]
\n      address = \":80\"
\n      [entryPoints.http.http.redirections.entryPoint]
\n          to = \"https\"
\n          scheme = \"https\"
\n  [entryPoints.https]
\n      address = \":443\"
\n\u00a0\n[providers]
\n  [providers.docker]
\n    network = \"traefik\"<\/pre>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n
This config file configures Traefik with two \u201centrypoints.\u201d Entrypoints describe how requests reach the Traefik service. HTTP and HTTPS entrypoints are created to listen on ports 80 and 443 respectively. In the case of an HTTP request, a redirection rule is used to forward it to the https<\/code> entrypoint instead. Remove the redirection section if you want to be able to serve content over plain HTTP.<\/p>\n
The \u201cproviders\u201d section configures the sources that define your network routes. Providers are simply infrastructure components which can issue Traefik with routing instructions. If you wanted to, you could write a custom HTTP API endpoint<\/a> to define your routes.<\/p>\n
In this example, we\u2019re keeping it simple and using the docker<\/code> provider. This monitors the Docker containers running on your host. When a new container appears with Traefik-specific labels, those values will be used to set up a route to the container. The containers will need to be attached to the traefik<\/code> Docker network for this to work as that\u2019s the network specified in the config file. Create the network now:<\/p>\n
docker network create traefik<\/pre>\n
Starting Traefik<\/h2>\n
Now you\u2019re ready to start Traefik! Deploy a new container with the Traefik image. Bind ports 80 and 443 to your host, allowing Traefik to listen for incoming requests. You should also join the container to the traefik<\/code> network created earlier.<\/p>\n
\u00a0<\/p>\n
Mount your host\u2019s Docker socket into the Traefik container with the -v<\/code> flag. This gives Traefik the ability to access other containers running on your host, enabling automatic detection of routes via the docker<\/code> provider set up in your config file. The config file itself is mounted to \/traefik.toml<\/code> inside the Traefik container.<\/p>\n
\"\"<\/p>\n
docker run -d \\
\n  -p 80:80 \\
\n  -p 443:443 \\
\n  -v $PWD\/traefik.toml:\/traefik.toml \\
\n  -v \/var\/run\/docker.sock:\/var\/run\/docker.sock \\
\n  --name traefik \\
\n  --network traefik \\
\n  traefik:2.6<\/pre>\n
Next start a couple of containers to test that Traefik is working:<\/p>\n
docker run -d \\
\n  --label traefik.http.routers.apache.rule=Host\\(\\`apache.example.com\\`\\) \\
\n  --name apache \\
\n  --network traefik \\
\n  httpd:latest
\n
\ndocker run -d \\
\n  --label traefik.http.routers.nginx.rule=Host\\(\\`nginx.example.com\\`\\) \\
\n  --name nginx \\
\n  --network traefik \\
\n  nginx:latest<\/pre>\n
Make sure you\u2019ve added DNS records for apache.example.com<\/code> and nginx.example.com<\/code> that map to your Traefik host. You should be able to visit those domains in your browser to see the default Apache and NGINX landing pages respectively. The two containers are joined to the Traefik network; their traefik.http.routers<\/code> labels set up basic routes that match incoming requests by the value of their Host<\/code> header.<\/p>\n
Routing Traffic<\/h2>\n
Traefik supports several different \u201cmatchers\u201d for routing<\/a> your traffic. We\u2019ve used the Host matcher above but you can also route by HTTP method, headers, URI, IP address, and query string parameters. Add multiple matchers to your containers to build up more complex routing rules.<\/p>\n
Traefik also supports middlewares<\/a> that let you modify the request before it reaches your services. You might want to add a prefix<\/a>, adjust headers<\/a>, or apply Basic Authentication<\/a> at the proxy level. Here\u2019s an example of using the Headers<\/code> middleware to add an extra X-Proxied-By<\/code> request header:<\/p>\n
docker run -d \\
\n  --label traefik.http.routers.nginx.rule=Host\\(\\`nginx.example.com\\`\\) \\
\n  --label traefik.http.middlewares.demo.headers.customrequestheaders.X-Proxied-By=traefik
\n  --name nginx \\
\n  --network traefik \\
\n  nginx:latest<\/pre>\n
Traefik routes traffic to the exposed ports of<\/a> your containers. You can specify a different port by setting the traefik.http.services.<demo-service>.loadbalancer.server.port=8080<\/code> label.<\/p>\n
Adding SSL<\/h2>\n
Next you should add SSL to ensure your traffic is fully protected. Traefik includes Let\u2019s Encrypt<\/a> integration so we\u2019ll that use now to automate certificate generation.<\/p>\n
Add the following section to your traefik.toml<\/code> file:<\/p>\n
\n
\n
\n
\n
\n
\n
\n
[certificatesResolvers.lets-encrypt.acme]
\n  email = \"you@example.com\"
\n  storage = \"\/acme.json\"
\n  [certificatesResolvers.lets-encrypt.acme.tlsChallenge]<\/pre>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n
This configures Traefik to use the Let\u2019s Encrypt ACME provider when resolving certificate requests. Make sure to replace the email address with your own so you receive any certificate expiry reminders sent by Let\u2019s Encrypt. The tlsChallenge<\/code> section defines how certification verification occurs; leaving it empty will use the default flow of serving a unique file which Let\u2019s Encrypt will request and validate during certificate issuance.<\/p>\n
Restart or replace your Traefik container to apply the new configuration. You should also mount a new file to \/acme.json<\/code> inside the container \u2013 Traefik will use this to store certificates.<\/p>\n
docker run -d \\
\n  -p 80:80 \\
\n  -p 443:443 \\
\n  -v $PWD\/acme.json:\/acme.json \\
\n  -v $PWD\/traefik.toml:\/traefik.toml \\
\n  -v \/var\/run\/docker.sock:\/var\/run\/docker.sock \\
\n  --name traefik \\
\n  --network traefik \\
\n  traefik:2.6<\/pre>\n
Using the Dashboard<\/h2>\n
Traefik includes a web UI that offers a graphical view of the endpoints, providers, and services (containers) active in your deployment. You can expose the UI by setting up a route for it in your config file.<\/p>\n
\"\"<\/p>\n
First modify your existing traefik.toml<\/code> with the following section:<\/p>\n
\n
\n
\n
\n
\n
\n
\n
[api]
\n  dashboard = true
\n\u00a0\n[providers.file]
\n  filename = \"\/traefik_dashboard.toml\"<\/pre>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n
Next create traefik_dashboard.toml<\/code> with the following content:<\/p>\n
\n
\n
\n
\n
\n
\n
\n
[http.middleware.dashboard_auth.basicAuth]
\n  users = [
\n    \"admin:$123...\"
\n  ]
\n\u00a0\n[http.routers.api]
\n  rule = \"Host(`traefik.example.com`)\"
\n  entrypoints = [\"https\"]
\n  middlewares = [\"dashboard_auth\"]
\n  service = \"api@internal\"
\n  [http.routers.api.tls]
\n    certResolver = \"lets-encrypt\"<\/pre>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n
The new file is needed as Traefik as doesn\u2019t support \u201cdynamic\u201d configuration (services and routers) alongside the \u201cstatic\u201d values in your main traefik.toml<\/code>. The dashboard config file manually defines a route that maps traefik.example.com<\/code> to the internal web UI service. The providers.file<\/code> line added to traefik.toml<\/code> registers the new route definition with the file<\/code> provider.<\/p>\n
Use htpasswd<\/code> to generate a set of HTTP Basic Auth credentials. Add the generated string to the users<\/code> array in the dashboard_auth<\/code> middleware. You\u2019ll need to use this username and password to access the dashboard.<\/p>\n
sudo apt install apache2-utils
\nhtpasswd -nb admin your_password
\n
\n# Outputs admin:$123...<\/pre>\n
Now restart Traefik with your updated configuration, remembering to mount the new traefik_dashboard.toml<\/code> file too:<\/p>\n
docker run -d \\
\n  -p 80:80 \\
\n  -p 443:443 \\
\n  -v $PWD\/acme.json:\/acme.json \\
\n  -v $PWD\/traefik.toml:\/traefik.toml \\
\n  -v $PWD\/traefik_dashboard.toml:\/traefik_dashboard.toml \\
\n  -v \/var\/run\/docker.sock:\/var\/run\/docker.sock \\
\n  --name traefik \\
\n  --network traefik \\
\n  traefik:2.6<\/pre>\n
You should be able to access the dashboard by heading to traefik.example.com<\/code> in your browser. If you don\u2019t want to expose the web UI as a route and will always access it from your local machine, you can publish port 8080<\/code> on your Traefik container instead. Modify your traefik.toml<\/code> file with the following section:<\/p>\n
\n
\n
\n
\n
\n
\n
\n
[api]
\n  dashboard = true
\n  insecure = true<\/pre>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n
docker run -d \\
\n  -p 8080:8080 \\
\n  -p 80:80 \\
\n  -p 443:443 \\
\n  -v $PWD\/acme.json:\/acme.json \\
\n  -v $PWD\/traefik.toml:\/traefik.toml \\
\n  -v \/var\/run\/docker.sock:\/var\/run\/docker.sock \\
\n  --name traefik \\
\n  --network traefik \\
\n  traefik:2.6<\/pre>\n
This will let you access the dashboard via http:\/\/localhost:8080<\/code>. This approach should not be used in secure production environments but makes for quicker set up of local experiments.<\/p>\n
Conclusion<\/h2>\n
Traefik is a versatile reverse proxy solution for your containers. In this article, we\u2019ve only covered the most fundamental of its capabilities. Beyond basic use with Docker, Traefik also works with<\/a> leading container orchestration solutions including Kubernetes, Docker Swarm<\/a>, and Mesos.<\/p>\n
Traefik provides a REST API as well as metrics in formats understood by Prometheus<\/a>, InfluxDB, Datadog, and Statsd. These capabilities let you automate and instrument Traefik deployments alongside the other infrastructure components in your stack. It\u2019s an ideal way to publish containerized workloads to the world without using a full orchestration<\/a> solution.<\/p>\n<\/div>\n