Network handling

[datablitz7]

Is there a particular reason for creating the proxy network outside the docker-compose file? It seems counter-intuitive to have an additional step. Personally I use the default bridge that is implicitly created up docker-compose up, but you can still name it and stand it up all in the yaml file:

networks:
  t2_proxy:
    name: t2_proxy
    driver: bridge
  docker_socket_proxy:
    name: docker_socket_proxy
    driver: bridge

[gzecchi]

Hi @datablitz7,

the reason being of creating the proxy network outside the docker-compose file is to select a custom subnet, that doesn't overlap with your existing networks, instead of letting docker choosing it.

In this way, you are able to specify the IP address of any container and reference it in some specific configuration that doesn't allow DNS reference.

If you select the Bridge mode, all the containers can talk to each other and can reach (and be reached by) any outside resource without any limitation.
For security reasons, you probably don't want that anyone in your network can run containers so you use the docker-socket-proxy that is connected to an "internal" connection, in this way only the containers that run in the same host and are connected to that network can access to the docker daemon.

GZ

[tehniemer]

just a note, name: only works with compose v3.5 and higher.

[datablitz7]

Indeed, but since the docker-compose files in this repo are for 3.7, I thought it could go without saying.

[datablitz7]

Interesting. I am going to try and implement this.

EDIT: This works and is much cleaner. I will roll this out in future.

I have put this together in a PR. #126

[android-808]

At the moment I tend to test containers in a separate docker-compose. This way I can leave the normal file and services alone and running and just test the new services on their own. If the network is defined in the compose file, will this still work with this config or is the network then only available to services in the main compose file?

[PrplHaz4]

At the moment I tend to test containers in a separate docker-compose. This way I can leave the normal file and services alone and running and just test the new services on their own. If the network is defined in the compose file, will this still work with this config or is the network then only available to services in the main compose file?

You can use external networks in the other test compose to reference your "prod" compose network:
https://docs.docker.com/compose/networking/#use-a-pre-existing-network

networks:
  prodnet:
    external:
      name: t2_proxy

[SimpleHomelab]

I implemented this in the latest commit: ec9b3b2