带有 Traefik 的 Docker 群堆栈中的 Portainer 拒绝连接

Question

我正在尝试将 Portainer 包含在由 WordPress + MySQL 和 Traefik（反向代理）组成的 docker-compose 群中。我正在使用以下定义：

version: '3'

services:
  traefik:
    image: "traefik:v2.0.0-rc3"
    command:
      - "--api.insecure=true"
      - "--providers.docker=true"
      - "--providers.docker.swarmmode=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entrypoints.web.address=:80"
    ports:
      - "80:80"
      - "8080:8080"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    networks:
      - traefik
    deploy:
      mode: global
      placement:
        constraints: [node.role==manager]

  portainer:
    image: portainer/portainer:latest
    command: -H unix:///var/run/docker.sock
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ./portainer:/data
    networks:
      - traefik
    deploy:
      mode: replicated
      replicas: 1
      placement:
        constraints: [node.role==manager]
      restart_policy:
        condition: on-failure
        delay: 5s
        max_attempts: 3
      labels:
        - "traefik.enable=true"
        - "traefik.http.routers.portainer.entrypoints=web"

  db:
    image: mysql:5.7
    volumes:
      - ./db/initdb.d:/docker-entrypoint-initdb.d
    networks:
      - traefik
    environment:
      MYSQL_ROOT_PASSWORD: <root_password>
      MYSQL_DATABASE: <db_name>
      MYSQL_USER: <db_user>
      MYSQL_PASSWORD: <user_password>
    deploy:
      replicas: 1
      restart_policy:
        condition: on-failure
        delay: 5s
        max_attempts: 3

  app:
    image: my-repo/wordpress:latest
    networks:
      - traefik
    deploy:
      replicas: 2
      restart_policy:
        condition: on-failure
        delay: 5s
        max_attempts: 3
      labels:
        - "traefik.enable=true"
        - "traefik.http.routers.app.rule=Host(`example.org`)"
        - "traefik.http.routers.app.entrypoints=web"
        - "traefik.http.services.app.loadbalancer.server.port=80"

networks:
  traefik:

除搬运工外，一切正常。当我访问 localhost:9000 时，我只是得到一个拒绝的连接。但是，以下非集群模式 docker-compose 可以工作：

version: '3'

services:
  traefik:
    image: "traefik:v2.0.0-rc3"
    container_name: "traefik"
    restart: always
    command:
      - "--api.insecure=true"
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entrypoints.web.address=:80"
    ports:
      - "80:80"
      - "8080:8080"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    networks:
      - traefik

  portainer:
    image: portainer/portainer
    command: -H unix:///var/run/docker.sock
    restart: always
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ./portainer:/data
    ports:
      - "9000:9000"
      - "8000:8000"
    networks:
      - traefik
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.portainer.entrypoints=web"

  db:
    image: mysql:5.7
    restart: always
    volumes:
      - ./db/initdb.d:/docker-entrypoint-initdb.d
    networks:
      - traefik
    environment:
      MYSQL_ROOT_PASSWORD: <root_password>
      MYSQL_DATABASE: <db_name>
      MYSQL_USER: <db_user>
      MYSQL_PASSWORD: <user_password>

  app:
    image: my-repo/wordpress:latest
    restart: always
    depends_on:
      - db
    networks:
      - traefik
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.app.rule=Host(`example.org`)"
      - "traefik.http.routers.app.entrypoints=web"

networks:
  traefik:

我做错了什么？每种情况下的日志都是相同的。在非集群模式下，我可以登录到 Portainer UI 并查看我所有的容器正在运行等。但集群版本只是拒绝连接，即使我通过了主机规则 (portainer.example.org)。我只使用 Traefik 几天，很可能会犯一个简单的配置错误（希望如此！）。

Answer 1

端口检测

Docker Swarm 不向 Traefik 提供任何 port detection 信息。

因此，您必须使用标签 traefik.http.services..loadbalancer.server.port 指定用于通信的端口（查看routing section for Docker 中此标签的参考）。