Socket Proxy Issue

[undaunt]

Description

I've looked through some related issues #368 and #126 and as far as I can tell, I think my socket proxy configuration with host networking should be working, but it is not.

With bridge networking, docker works pointed at my socket proxy. With host, it does not, but host of course provides network reporting. I'm not sure what I'm missing here.

Thanks!

OS / Architecture

linux/amd64 6.6.68-Unraid

Beszel version

0.9.1

Installation method

Docker

Configuration

services:
  beszel:
    image: henrygd/beszel:latest
    container_name: beszel
    restart: unless-stopped
    networks:
      - ${PROXY_NETWORK}
      - ${APP_NETWORK}
    volumes:
      - ${APPDATA_DIR}/beszel:/beszel_data
    environment:
      TZ: ${TZ}
      PUID: ${PUID}
      PGID: ${PGID}
      DISABLE_PASSWORD_AUTH: true
    extra_hosts:
      - host.docker.internal:host-gateway

  beszel-agent:
    image: henrygd/beszel-agent:latest
    container_name: beszel-agent
    restart: unless-stopped
    networks:
      - ${APP_NETWORK}
      - ${SOCKET_NETWORK}
    environment:
      PORT: 45876
      KEY: 'xxx'
      DOCKER_HOST: tcp://socket-proxy:2375
      LOG_LEVEL: debug

  beszel-agent-host:
    image: henrygd/beszel-agent:latest
    container_name: beszel-agent-host
    restart: unless-stopped
    network_mode: host
    environment:
      PORT: 45876
      KEY: 'xxx'
      DOCKER_HOST: tcp://127.0.0.1:2375
      LOG_LEVEL: debug

  socket-proxy:
    image: tecnativa/docker-socket-proxy:latest
    container_name: socket-proxy
    restart: always
    networks:
      - ${SOCKET_NETWORK}
    privileged: true
    ports:
      - 127.0.0.1:2375:2375 # Port 2375 should only ever get exposed to the internal network.
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    environment:
      LOG_LEVEL: info # debug,info,notice,warning,err,crit,alert,emerg
      # Variables for permissions of the socket API (eg: AUTH grants access to /auth/*)
      # 0 to revoke, 1 to grant
      # Granted By Default
      EVENTS: 1
      PING: 1
      VERSION: 1
      # Revoked by default
      # Security critical
      AUTH: 0
      SECRETS: 0
      POST: 1 # Watchtower
      # GET Options
      BUILD: 0
      COMMIT: 0
      CONFIGS: 0
      CONTAINERS: 1 # Traefik, Portainer, etc.
      DISTRIBUTION: 0
      EXEC: 0
      IMAGES: 1 # Portainer, Watchtower
      INFO: 1 # Portainer
      NETWORKS: 1 # Portainer, Watchtower
      NODES: 0
      PLUGINS: 0
      SERVICES: 1 # Portainer
      SESSION: 0
      SWARM: 0
      SYSTEM: 0
      TASKS: 1 # Portainer
      VOLUMES: 1 # Portainer

Hub Logs

No response

Agent Logs

Host:

2025/01/23 23:12:10 DEBUG Error getting docker stats err="Get \"http://localhost/containers/json\": dial tcp 127.0.0.1:2375: connect: connection refused"
2025/01/23 23:12:10 DEBUG Extra filesystems data=map[]

Bridged:

2025/01/23 23:12:25 DEBUG Docker stats data="[0xc00028fd50 0xc000394380 0xc00028fab0 0xc0000ab490 0xc00027c5b0 0xc0000e4a80 0xc000428380 0xc0002deee0 0xc000163340 0xc0001a6380 0xc000245960 0xc00027c310 0xc0000e45b0 0xc0004740e0 0xc000474690 0xc00011bd50 0xc000348310 0xc000244690 0xc0004749a0 0xc000349880 0xc0000aa380 0xc000017110 0xc00028f1f0 0xc0002de000 0xc0002456c0 0xc000245e30 0xc00027d880 0xc0000e57a0 0xc0003488c0 0xc0003495e0 0xc00027d5e0 0xc0000e5a40 0xc000349d50 0xc000394070 0xc000017810 0xc0002442a0 0xc000244e00 0xc0000e5260 0xc0002de8c0 0xc000017d50 0xc0002de3f0 0xc000163880 0xc0000175e0 0xc0002de620 0xc0000abc70 0xc000348ee0 0xc0003942a0 0xc000162b60 0xc000016700 0xc000016bd0 0xc000348b60 0xc0001a65b0 0xc000475180 0xc00027ce00 0xc0000e5b20 0xc00011b420 0xc00011b650 0xc00027cb60 0xc00027ddc0 0xc0000e5d50 0xc0002debd0 0xc000016930 0xc0000173b0 0xc000244070 0xc00027d0a0 0xc0000e4fc0 0xc000016e70 0xc000244bd0 0xc000245030 0xc0000e4070 0xc00011a9a0 0xc00028f810 0xc000474c40 0xc0000ab730 0xc0000e4310 0xc00027d340 0xc00028efc0 0xc00011a310 0xc000163b20 0xc0000e49a0 0xc000475b20 0xc000245260 0xc000348070 0xc000475420 0xc00027c850 0xc000475dc0 0xc0001635e0 0xc0000ab1f0 0xc000474150 0xc0000aa930 0xc0004756c0 0xc000162380 0xc0001628c0 0xc000163dc0 0xc00011b8f0 0xc00011a620 0xc000245c00 0xc0000abd50 0xc0000e4d20 0xc000349b20 0xc0002de310 0xc0000aabd0 0xc000162e00 0xc000162620 0xc000474ee0 0xc00028e7e0 0xc000474000 0xc000482070 0xc00028ed20 0xc0000aaf50 0xc000244930 0xc0000ab9d0 0xc000348620 0xc0004280e0 0xc0001a68c0 0xc000394460 0xc00028e230 0xc00028ea80 0xc000348c40 0xc00027db20 0xc00028f500 0xc0004743f0 0xc000349340 0xc00028e540 0xc0001630a0 0xc000017ab0 0xc00011bb20 0xc0000e5500]"
2025/01/23 23:12:25 DEBUG Extra filesystems data=map[]

[henrygd]

What version of Docker and Docker Compose are you running? I tested the stack below and it connects without issue.

Are you able to curl 127.0.0.1:2375/containers/json from the host?

I'm working on an alternative to host network which should be available in the next release.

services:
  beszel-agent-host:
    image: henrygd/beszel-agent:latest
    container_name: beszel-agent-host
    restart: no
    network_mode: host
    environment:
      PORT: 45876
      KEY: "xxx"
      DOCKER_HOST: tcp://127.0.0.1:2375
      LOG_LEVEL: debug

  socket-proxy:
    image: tecnativa/docker-socket-proxy:latest
    container_name: socket-proxy
    restart: no
    networks:
      - socket-network
    privileged: true
    ports:
      - 127.0.0.1:2375:2375 # Port 2375 should only ever get exposed to the internal network.
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    environment:
      LOG_LEVEL: info # debug,info,notice,warning,err,crit,alert,emerg
      # Variables for permissions of the socket API (eg: AUTH grants access to /auth/*)
      # 0 to revoke, 1 to grant
      # Granted By Default
      EVENTS: 1
      PING: 1
      VERSION: 1
      # Revoked by default
      # Security critical
      AUTH: 0
      SECRETS: 0
      POST: 1 # Watchtower
      # GET Options
      BUILD: 0
      COMMIT: 0
      CONFIGS: 0
      CONTAINERS: 1 # Traefik, Portainer, etc.
      DISTRIBUTION: 0
      EXEC: 0
      IMAGES: 1 # Portainer, Watchtower
      INFO: 1 # Portainer
      NETWORKS: 1 # Portainer, Watchtower
      NODES: 0
      PLUGINS: 0
      SERVICES: 1 # Portainer
      SESSION: 0
      SWARM: 0
      SYSTEM: 0
      TASKS: 1 # Portainer
      VOLUMES: 1 # Portainer

networks:
  socket-network:
    external: true
    name: $SOCKET_NETWORK

[undaunt]

I could not, but I then added a second overlay network to my socket proxy which is not explicitly declared as internal only and suddenly I could hit it from the host level. So, it seems that if the socket proxy container has a port exposed to host, but its only overlay network is marked as internal, the host cannot hit that port?

    networks:
      - ${SOCKET_NETWORK}
      - ${APP_NETWORK}

  app-bridge:
    name: ${APP_NETWORK}
    ipam:
      config:
        - subnet: 172.19.0.0/24
          gateway: 172.19.0.1
    driver_opts:
      com.docker.network.bridge.name: ${APP_NETWORK}
  socket-proxy:
    name: ${SOCKET_NETWORK}
    internal: true
    ipam:
      config:
        - subnet: 172.21.0.0/24
          gateway: 172.21.0.1
    driver_opts:
      com.docker.network.bridge.name: ${SOCKET_NETWORK}

Edit: I'm not sure if I'm being overly cautious by having my socket proxy container only live traditionally on an internal only network, or as long as I'm mapping it to 127.0.0.1:2375:2375, it can safely live on an overlay network that is not internal as long as that network is not the same network as the Traefik proxy network.