capnspacehook / whalewall

Automate management of firewall rules for Docker containers
BSD 3-Clause "New" or "Revised" License
232 stars 4 forks source link

Add support for docker swarm #25

Open rgomezceis opened 1 year ago

akselerando commented 3 months ago

Has this been tested with Docker Swarm, or what is missing for making this work for Swarms?

This tool looks really promising, so it would be greatly appreciated if it would work in Swarm mode aswell:) @capnspacehook

Matchlighter commented 1 week ago

I too would be interested in Swarm support, but afraid I can't offer a ton of help with Go. It'd be nice if the Docker Socket could return events/info from across the Swarm instead of just the current node, but it doesn't seem to do that.

Some implementation thoughts I came up with:

Whalewall would need to run on each Swarm node (easy). Ideally each instance would be isolated and operate independently (seems fairly realistic, aside from the note below).

I think the biggest issue would be locating IPs and Whalewall annotations of containers running on other nodes. Other than that, it seems like a lot of the rest is the same. Maybe one would take the container param (from Whalewall's config) and equate it to the service name. Then query /tasks?service=X to get the IP - the task response looks like it also contains a ContainerSpec value that might contain the tags as well, abating the need to call /services to find tags.

Reverse look up is the other problem - one would probably need to list all services (though probably not all tasks) and find which ones reference the current container in their tags. If Docker emits events fo tasks (which the docs don't mention it does...), this fetching of all services would probably only need to be done once on startup. Without Task events... each node would probably need to have some awareness of other nodes to relay container events (first trying to map them to a task and or service). Alternatively to full-awareness, the manager node can run a small MQTT (or similar) broker that handles each node pubs/subs to as appropriate.