sinamics
commented
8 months ago With the default configuration, each container is connected to a Docker bridge network 172.31.255.0/29. When you connect the Zerotier container to its own Zerotier network, it becomes isolated from other services running on the local machine. This isolation occurs because, by default, there is no routing set up to handle traffic between the Zerotier network and the Docker bridge network or the local network.
Docker containers are isolated from the local network unless you specifically configure them to use the host network. This isolation is part of Docker's design to ensure that containerized applications run in a predictable and secure environment.
You have two options:
-
Modify the configuration of the Zerotier container to utilize the host's network directly. By doing this, the container can create zt# interfaces on the host system, mimicking the behavior of a native ZeroTier One installation. This change effectively integrates the Zerotier container with the host's network
-
Implement Network Routing and Bridging: Instead of using the host network for the Zerotier container, you can set up manual routes or network bridging to allow traffic between the Zerotier network and the Docker internal network. This involves more complex network configuration but maintains better isolation between your Docker containers and the host system.
Solution 1 Example: Change your docker-compose something like this:
Pay attetion to these lines:
network_mode: "host" in zerotier section
ZT_ADDR: http://10.0.0.214:9993 set the local machine ip address instead of zerotier. Ztnet will connect to zerotier using you local network instead.
Also comment out the port and networks in zerotier.
version: "3.1"
services:
postgres:
image: postgres:15.2-alpine
container_name: postgres
restart: unless-stopped
ports:
- 5432:5432
environment:
POSTGRES_USER: postgres
POSTGRES_PASSWORD: postgres
POSTGRES_DB: ztnet
volumes:
- postgres-data:/var/lib/postgresql/data
networks:
- app-network
zerotier:
image: zyclonite/zerotier:1.12.2
hostname: zerotier
container_name: zerotier
restart: unless-stopped
volumes:
- zerotier:/var/lib/zerotier-one
cap_add:
- NET_ADMIN
- SYS_ADMIN
devices:
- /dev/net/tun:/dev/net/tun
network_mode: "host"
# networks:
# - app-network
# ports:
# - "9993:9993/udp"
environment:
- ZT_OVERRIDE_LOCAL_CONF=true
ztnet:
image: sinamics/ztnet:latest
container_name: ztnet
working_dir: /app
volumes:
- zerotier:/var/lib/zerotier-one
- /etc/localtime:/etc/localtime:ro
restart: unless-stopped
ports:
- 3000:3000
environment:
ZT_ADDR: http://10.0.0.214:9993
POSTGRES_HOST: postgres
POSTGRES_PORT: 5432
POSTGRES_USER: postgres
POSTGRES_PASSWORD: postgres
POSTGRES_DB: postgres
NEXTAUTH_URL: "https://my_awesome_ztnet.com"
NEXTAUTH_SECRET: "random_secret"
networks:
- app-network
links:
- postgres
depends_on:
- postgres
- zerotier
volumes:
zerotier:
postgres-data:
networks:
app-network:
driver: bridge
ipam:
driver: default
config:
- subnet: 172.31.255.0/29
If you type ip a , you will now see the zerotier adapter.
You should be able to access services like bitwarden on the local machine using zerotier ip address.
BrianVB
📝 Describe the Problem You Are Having
I am unable to connect to services that are being hosted on the same machine that ztnet and Zerotier are. My test is with a instance of Vaultwarden I have running on the server. Both Vaultwarden, and ztnet are running in Docker containers on the server, set up through Portainer.
When on the local network, I can connect to Vaultwarden using the IP address of the machine assigned by the router (192.168.1.132) but cannot access it via the IP assigned by Zerotier. I can ping both IPs without any issue.
I was helped in this issue ( https://github.com/sinamics/ztnet/issues/119#issuecomment-1863703877 ) getting the Zerotier node to join the controller on its own machine and it's apparent that there may be some networking things that I do not understand about this setup.
I currently run Zerotier a different local machine using ztncui in this fashion. A self-hosted Zerotier controller is on the machine with ztncui; the node joined its own network; and I have services running on the machine which I am able to access without issue.
Something about the ztnet setup preventing me from connecting to these services using the IP address assigned by Zerotier. Is this something that I can make possible using the configuration provided by ztnet?
🔖 Version
Latest ( ID sha256:6a7ec8eb9744993a8ddf776014afbe2dabb53b82719a3b1a40406167f1788037 )
📋 Docker Logs
💻 Operating System
Ubuntu
📚 Any Other Information That May Be Helpful
No response