Skip to content
\n

Reproduce

\n

Add
\n`[Service]
\nEnvironment=\"DOCKERD_ROOTLESS_ROOTLESSKIT_PORT_DRIVER=slirp4netns\"

\n

in ~/.config/systemd/user/docker.service.d/override.conf `
\nReload the docker daemon and restart it.

\n

Run two containers : traefik and traefik/whoami instance.

\n

Expected behavior

\n

X-Real-Ip: Should contain the real user IP instead of the IP of the docker network gateway.

\n

docker version

\n
Client: Docker Engine - Community\n Version:           23.0.1\n API version:       1.42\n Go version:        go1.19.5\n Git commit:        a5ee5b1\n Built:             Thu Feb  9 19:46:54 2023\n OS/Arch:           linux/amd64\n Context:           default\n\nServer: Docker Engine - Community\n Engine:\n  Version:          23.0.1\n  API version:      1.42 (minimum version 1.12)\n  Go version:       go1.19.5\n  Git commit:       bc3805a\n  Built:            Thu Feb  9 19:46:54 2023\n  OS/Arch:          linux/amd64\n  Experimental:     false\n containerd:\n  Version:          1.6.18\n  GitCommit:        2456e983eb9e37e47538f59ea18f2043c9a73640\n runc:\n  Version:          1.1.4\n  GitCommit:        v1.1.4-0-g5fd4c4d\n docker-init:\n  Version:          0.19.0\n  GitCommit:        de40ad0\n rootlesskit:\n  Version:          1.1.0\n  ApiVersion:       1.1.1\n  NetworkDriver:    slirp4netns\n  PortDriver:       slirp4netns\n  StateDir:         /tmp/rootlesskit3603596150\n slirp4netns:\n  Version:          1.2.0\n  GitCommit:        656041d45cfca7a4176f6b7eed9e4fe6c11e8383
\n

docker info

\n
Client:\n Context:    default\n Debug Mode: false\n Plugins:\n  buildx: Docker Buildx (Docker Inc.)\n    Version:  v0.10.2\n    Path:     /usr/libexec/docker/cli-plugins/docker-buildx\n  compose: Docker Compose (Docker Inc.)\n    Version:  v2.16.0\n    Path:     /usr/libexec/docker/cli-plugins/docker-compose\n  scan: Docker Scan (Docker Inc.)\n    Version:  v0.23.0\n    Path:     /usr/libexec/docker/cli-plugins/docker-scan\n\nServer:\n Containers: 29\n  Running: 29\n  Paused: 0\n  Stopped: 0\n Images: 29\n Server Version: 23.0.1\n Storage Driver: fuse-overlayfs\n Logging Driver: json-file\n Cgroup Driver: systemd\n Cgroup Version: 2\n Plugins:\n  Volume: local\n  Network: bridge host ipvlan macvlan null overlay\n  Log: awslogs fluentd gcplogs gelf journald json-file local logentries splunk syslog\n Swarm: inactive\n Runtimes: io.containerd.runc.v2 runc\n Default Runtime: runc\n Init Binary: docker-init\n containerd version: 2456e983eb9e37e47538f59ea18f2043c9a73640\n runc version: v1.1.4-0-g5fd4c4d\n init version: de40ad0\n Security Options:\n  seccomp\n   Profile: builtin\n  rootless\n  cgroupns\n Kernel Version: 6.1.0-5-amd64\n Operating System: Debian GNU/Linux 11 (bullseye)\n OSType: linux\n Architecture: x86_64\n CPUs: 6\n Total Memory: 15.63GiB\n Name: XXX\n ID: X2LR:NAD7:AJMU:YOIV:TZY3:EPGN:VRCK:ZU3A:VVGV:M23Y:PFX2:B5PH\n Docker Root Dir: /home/virt/.local/share/docker\n Debug Mode: false\n Registry: https://index.docker.io/v1/\n Experimental: false\n Insecure Registries:\n  127.0.0.0/8\n Live Restore Enabled: false\n\nWARNING: No cpu cfs quota support\nWARNING: No cpu cfs period support\nWARNING: No cpu shares support\nWARNING: No cpuset support\nWARNING: No io.weight support\nWARNING: No io.weight (per device) support\nWARNING: No io.max (rbps) support\nWARNING: No io.max (wbps) support\nWARNING: No io.max (riops) support\nWARNING: No io.max (wiops) support\nWARNING: bridge-nf-call-iptables is disabled\nWARNING: bridge-nf-call-ip6tables is disabled
\n

Additional Info

\n

No response

","upvoteCount":1,"answerCount":9,"acceptedAnswer":{"@type":"Answer","text":"

Hello there !
\nThe solution I found to this issue is to set traefik ports mode to \"host\" in my docker compose:

\n
  traefik:\n    image: traefik:latest\n    container_name: traefik\n    restart: always\n    ports:\n      - target: 80\n        published: 80\n        mode: host\n      - target: 443\n        published: 443\n        mode: host\n      - target: 8448\n        published: 8448\n        mode: host\n    volumes:\n      - \"/data/cloud/traefik/:/etc/traefik/\"\n      - \"/run/user/1001/docker.sock:/var/run/docker.sock:ro\"\n    labels:\n      - \"traefik.http.routers.traefik.rule=Host(`traefik.DOMAIN_NAME`) && (PathPrefix(`/api`) || PathPrefix(`/dashboard`))\"\n      - \"traefik.http.routers.traefik.service=api@internal\"\n      - \"traefik.http.routers.traefik.entrypoints=web,websecure\"\n      - \"traefik.http.routers.traefik.tls=true\"\n      - \"traefik.http.routers.traefik.tls.certresolver=myresolver\"\n      - \"traefik.http.routers.traefik.middlewares=sso@docker,https_headers@file\"\n    networks:\n      default:\n      traefik:\n
\n

You might want try the same kind of configuration to your home-assistant container if it is exposed directly or to your reverse proxy like in my case if you have one.

","upvoteCount":0,"url":"https://github.com/moby/moby/discussions/45337#discussioncomment-12955019"}}}

[Traefik] Rootless Docker with slirp4netns doesn't show user IP #45337

Discussion options

You must be logged in to vote

Hello there !
The solution I found to this issue is to set traefik ports mode to "host" in my docker compose:

  traefik:
    image: traefik:latest
    container_name: traefik
    restart: always
    ports:
      - target: 80
        published: 80
        mode: host
      - target: 443
        published: 443
        mode: host
      - target: 8448
        published: 8448
        mode: host
    volumes:
      - "/data/cloud/traefik/:/etc/traefik/"
      - "/run/user/1001/docker.sock:/var/run/docker.sock:ro"
    labels:
      - "traefik.http.routers.traefik.rule=Host(`traefik.DOMAIN_NAME`) && (PathPrefix(`/api`) || PathPrefix(`/dashboard`))"
      - "traefik.http.routers.traefik.service=api@…

Replies: 9 comments 4 replies

Comment options

You must be logged in to vote
0 replies
Comment options

You must be logged in to vote
0 replies
Comment options

You must be logged in to vote
0 replies
Comment options

You must be logged in to vote
0 replies
Comment options

You must be logged in to vote
0 replies
Comment options

You must be logged in to vote
0 replies
Comment options

You must be logged in to vote
0 replies
Comment options

You must be logged in to vote
4 replies
@aureliensoria
Comment options

Answer selected by aureliensoria
@adoyle-h
Comment options

@aureliensoria
Comment options

@adoyle-h
Comment options

Comment options

You must be logged in to vote
0 replies
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Category
Q&A
Labels
status/0-triage status/more-info-needed kind/bug Bugs are bugs. The cause may or may not be known at triage time so debugging may be needed. area/networking area/rootless Rootless mode version/23.0
8 participants
Converted from issue

This discussion was converted from issue #45096 on April 14, 2023 09:59.