bretfisher/dogvscat

Sample Docker Swarm cluster stack of tools

Oh hi 👋

apiVersion: v48
kind: Human
metadata:
  name: Bret Fisher
spec:
  purpose: Help others learn container DevOps
  sponsorship: bretfisher.com/members
  locations:
    - 
      type: YouTube Live Stream on Thursdays
      where: bret.live
    - 
      type: Newsletter
      where: bret.news
    - 
      type: Homepage
      where: bretfisher.com
    - 
      type: Discord Server
      where: devops.fan
    -
      type: Podcast
      where: bretfisher.com/podcast
  favorites:
    number: 42
    animal: 🐶
    emoji: 🤦
    food: 🥩
    drink: 🥃

🙋‍♀️ You can Ask-Me-Anything in my ama repository, or tweet @BretFisher.

💬 Join my 12k+ member DevOps community on Discord: devops.fan.

📰 Read my Cloud Native Newsletter: bret.news

☕️ 🤑 Please support my DevOps YouTube Live show, podcast, and open source content by buying me a coffee every month at bretfisher.com/members!

🧑‍🏫 My course repositories

• All my Udemy course coupon codes: bretfisher.com/courses
• Automate Your Kubernetes Deployments with GitHub Actions and Argo GitOps
• Docker Mastery (with Kubernetes, Swarm, Compose, and more)
• Kubernetes Mastery (go deeper in K8s)
• Docker for Node.js (learn advanced ways to use local Docker with Node.js projects)
• Swarm Mastery (learn more about Docker's built-in orchestrator)
• More DevOps courses coming!

My examples and templates (New stuff on top)

• Awesome Swarm - A list of resources, tools, and learning on Docker/Mirantis Swarm (SwarmKit)
• Kubernetes initContainer Examples and Good Defaults - Learn Kubernetes Init Containers by example, and when to not use them.
• Kubernetes Pod Specification (podspec) Good Defaults - Good Defaults for the most common Kubernetes workloads. Adds security and uptime (optional) features.
• Node.js Rocks in Docker - Video and examples of multi-stage docker builds, k8s healthcheck probes, etc.
• GitHub Actions for Docker: examples and video walkthrough - Video and examples of GitHub Actions for advanced docker builds, automated testing, and CVE scanning.
• GitHub Actions DevOps Templates - reusable GitHub Actions templates for DevOps stuff (linting, docker builds, CVE scanning, etc.)
• Docker Build GitHub Action Template - My custom GitHub Actions workflow using Docker's official build-and-push Actions.
• Super Linter GitHub Action Template - My custom all-in-one linter workflow. I lint all my repositories, and I recommend you do to.
• Node.js Docker Good Defaults - A sample Node.js project that uses Docker.
• Docker Compose local TLS for devs - A sample Compose file that uses a Traefik proxy for TLS, and optionally, Let's Encrypt.
• Docker Build Multi-platform Readme - Explains some ways to build Docker images for multiple platforms in a single Dockerfile.
• Voting App Docker Example - My favorite multi-container example app that I often use to for learning Docker, K8s, CI/CD, and GitOps.
• PHP Docker Good Defaults (outdated) - A sample PHP project that uses Docker.
• Java Docker Petclinic Example - A sample Java project that uses Docker.
• dogvscat Using the voting app in Docker Swarm to explain orchestration, proxies, secrets, and networking.

My tools (often used for learning Containers, Kubernetes, and Docker)

• shpod - Common Kubernetes tools in a single pod.
• httping - Ping with HTTP. Fantastic for testing zero-downtime rolling updates.
• jekyll - Jekyll in a container.
• vackup - Docker Volume backup and restore.
• browncoat - A utility container for simulating failures like slow startup, failing healthchecks, etc.

dogvscat's Issues

Thank you

Here is the place to say thank you to folks who are working hard on this project.

« One of the greatest ways to show your appreciation to open source projects you enjoy is to open an issue that let people say thank you »

Disclaimer: I don't have any kind of connexion or personal interest with maintainers(s) of this project. Pure gratitude here.

Cheers!

Add terraform example for creating cluster

Create a simple example of creating instances, installing docker, setting up security groups, LB's, etc. with Terraform, ideally for digital ocean and AWS.

Some examples:
https://github.com/Praqma/terraform-aws-docker
https://github.com/mlabouardy/terraform-aws-labs/tree/master/docker-swarm-cluster

Does it use the internal network?

Hi Bret,

Question regarding the creation of Swarm on DO.

https://github.com/BretFisher/dogvscat/blob/master/create-swarm.sh#L5
Does eth1 is the internal network (therefore there is no bandwidth limit )?

Thanks!

New Traefik/Consul doesn't work well with Portainer

Hi Bret,

Great work on this repo, I have been following it for some time! I was trying out the new Traefik HA and I have found that the Portainer stack does some weird things through this new Traefik stack.

1. When creating the Admin user it shows that it could not create the user but it in fact has
2. when adding an endpoint, selecting that endpoint to view the settings brings up blank settings
3. Unable to view any containers, services etc
4. A lot of 404 errors being returned in the browser console so it looks like some traffic is getting lost along the way.

This is not reproducible when using the single instance traefik. I have also tested older traefik and portainer versions but I still get the same results.

Add Swarm secrets support to Ghost Blog

Inspired by this issue docker-library/ghost#125, we need a PR that does this for the Ghost stack.

Add rolling update defaults to all services

Many of the services, especially for the demo apps like menu, ghost, and voting should have custom deploy settings for updates, such as rollback, healthchecks, etc. This first requires healthchecks everywhere:

• add healthchecks to each service that needs HA rolling updates
• update stack files with update settings needed for auto rollback, etc.

add service autoscaling example with orbiter

repo: https://github.com/gianarb/orbiter

blog: https://gianarb.it/blog/orbiter-docker-swarm-autoscaler

Add socat support to traefik proxy stack

For improved security, we should use socat to offload incoming web traffic hitting the traefik proxies, from being on Swarm managers. Ideally, managers are only "managing" and putting socat in the proxy stack can do that for us.

Mike talks about it in his block post here: https://blog.mikesir87.io/2018/07/letting-traefik-run-on-worker-nodes/

Thanks @pascalandy for the reference: https://github.com/pascalandy/docker-stack-this/blob/master/traefik_stack5/toolproxy.yml

I added a sample stack yaml here but don't think it worked the first time I tried, so needs to have more time testing to see how it should be configured for dogvscat: https://github.com/BretFisher/dogvscat/blob/master/stack-socat-proxy.yml

Update swarmprom

swarmprom has been archived by the owner for a while. This does however not mean that the stack does not work.

As we needed a working version, we adapted it in our own repos. Would you be interested in a PR to this repository that links to that code or even a PR that rips out the vendor specific things from our repository and moves the code here (we are using Hetzner in our repo)? I think this would help people a lot especially since this repository here is kind of the bible for docker swarm in production.

Create example of traefik on host network for obtaining ingress source IP's

The ingress routing mesh loses the client source IP, and some web apps need this. This enhancement would add an example/option for placing traefik on --network host so it can capture those source IP's and send them as host headers to backend services on an overlay network.

With traefik this makes the whole thing a bit more complex because we now must have a traefik replica on every node (global mode) which means we can't cheat with the TOML config file and cert files like we can with a single-replica traefik service. We'll need a config backend for traefik to make this work.

PR: create node in parallel (instead of one after the other)

As we can execute bash commands to run in parallel, I manage to create y nodes in parallel :)
Much faster.

Support Traefik multi-node HA

By default, Traefik uses a file configuration and file storage for LE certificates. In order to support a Traefik cluster for HA, it'll need a key/value store. Traefik docs give details on how to set this up. We'll need to enhance the current stack file to add consul and needed config details.

Add cache to Ghost blog service

Since the Ghost service can only have a single replica (Ghost design limitation), it's expected to have a caching proxy in front of it, which itself could be multi-replica for better LB/HA. I'm thinking the best options here are varnish or nginx, which would be another service in the Ghost stack file.

screenshot

Create servers script has invalid virtualbox memory value

VBoxManage: error: Invalid RAM size: 2 MB (must be in range [4, 2097152] MB)

I'm assuming you meant to provision 2 GB of memory per virtual machine.

diff --git a/create-servers.sh b/create-servers.sh
index 0d6ec0b..fdb729f 100755
--- a/create-servers.sh
+++ b/create-servers.sh
@@ -27,7 +27,7 @@ done
 #for server in {1..3}; do
 #docker-machine create \
 #  --driver=virtualbox \
-#  --virtualbox-memory=2 \
+#  --virtualbox-memory=2048 \
 #  dvc${server} &
 #done

Step to create rexray secrets

Hi @BretFisher

Following the steps of deployment in README,
in Step 1, the REXRAY_DO_TOKEN env. variable is set and in Step 5, external secrets rexray_do_token is used during deployment of the rexray stack.

However this secret is not created at any step prior to Step 5.

A command such as echo $REXRAY_DO_TOKEN | docker secret create rexray_do_token - could be included in Step 5, prior to the stack deployment command or a new step 5 can be added can be added and subsequent steps renumbered.

I could open a PR for the same, if you agree.

PR: create labels

If it makes sense with you, I'll do a PR.

prerequisite

# machine name prefix
export node_prefix="alga"

label my nodes

#!/bin/bash
# set -x

# add label on managers
for server_id in {1..3}; do

  this_node=$(docker-machine ls | awk '{print $1}' | grep ${server_id} | tail -n1)

  docker-machine ssh ${node_prefix}${server_id} docker node update --label-add nodeid=${server_id} ${this_node}
  docker-machine ssh ${node_prefix}${server_id} docker node update --label-add nodename=${this_node} ${this_node}
  docker-machine ssh ${node_prefix}${server_id} docker node update --label-add nodetype="manager" ${this_node}
  docker-machine ssh ${node_prefix}${server_id} docker node update --label-add nodetag=${node_prefix} ${this_node}

done

# add label on workers (in the future I'll have more)
#.
#.
#.
#.

Make Ghost HA with GlusterFS "shared nothing" option rather then shared storage limitation

Right now, since Ghost Blog is designed to run on a single-host (a current design limitation) then caching and MTTR are the best ways to keep downtime to a minimum.

For storing content/images and content/data volumes on persistent storage, we're currently using digitalocean block storage with rexray, but a more inclusive option would be shared-nothing storage that's replicated between nodes using the default local volume driver.

I've not yet set this up with GlusterFS but it would be cool to have that running in a global service if possible, replicating a named volume (local driver) between 3 nodes, while the ghost service uses the same named volume on whatever node the task is running on.

New Feature: use sticky sessions for one app

We need an example of how sticky sessions work in Swarm with Traefik. Maybe we can use the Voting app for this.

RexRay doesn't work on Docker latest (19)

https://github.com/BretFisher/dogvscat/blob/master/stack-rexray.yml

Using docker stack deploy -c stack-rexray.yml rexray gives back the following error:

network "bridge" is declared as external, but it is not in the right scope: "local" instead of "swarm"

Would love to see what those TODO notes resolve into as well as this has been very useful for my swarm.