docker + dat deployment

[joehand]

Current status on docker + dat networking troubleshooting. This is a general issue to keep visibility and update progress, not related directly to cli.

We're still having trouble accessing exposing ports directly.e.g.:

docker run -d --name some-image -p 3282 -p 3282/udp

We had an issue with using IPTables before (#503), which docker uses. So it may be related to that, not Docker directly. This is what some of our IPTables rules (generated via docker) look like:

Details

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination         
MASQUERADE  tcp  --  172.19.0.7           172.19.0.7           tcp dpt:3282
MASQUERADE  udp  --  172.19.0.7           172.19.0.7           udp dpt:3282

Chain DOCKER (2 references)
target     prot opt source               destination         
DNAT       tcp  --  anywhere             anywhere             tcp dpt:32769 to:172.19.0.7:3282
DNAT       udp  --  anywhere             anywhere             udp dpt:32768 to:172.19.0.7:3282

See also:

• Ports to expose when running dat doctor in docker? #841 (may not be docker related)
• exposing docker ports
• docker networking

[joehand]

Seems like it is related to a bug in discovery-swarm/channel (mafintosh/discovery-swarm#32) where the internal port doesn't match the external port and the wrong one gets reported.

[joehand]

Switching Docker networking to "host" mode works. This will use the OS ports instead of Docker's networking interface, getting around the external/internal port bug.

[mitar]

I think you are running it wrong. If you just do -p 3282 then the host port will be randomly chosen. Which means that port dat inside will think it has will be different on the outside.

I am running hypercored inside Docker using -p 3282:3282/tcp -p 3282:3282/udp and it works perfectly.

[SvenDowideit]

interestingly, I've been having issues with dat sharing that are related to this:

docker run --rm -it -p 3282:3282/udp -p 3282:3282/tcp -v share_share:/data -v share_secretkeys:/root/.dat svendowideit/dat share /data

pretty much doesn't work. I'm going to compare to running hypercored in a bit - cos this is ew!

whereas using --net host does...

[SvenDowideit]

I'm kinda wondering if there's not enough error reporting going on - I was able to run 2 dat shares on one computer - how are they both listening on the same ports?

[mitar]

@SvenDowideit see #945 about port question.

[SvenDowideit]

@mitar merci! - that would pretty much make issues when using it in docker impossible to debug

[mitar]

Also see #947.

[nettiopsu]

I have experienced the same thing while trying to dockerize dat in my local machine. I tried exposing port 3282 and with --net host as well, but local host machine does not connect to dat in docker. I did not manage to connect to it from dat cli neither from Beaker browser. However, non dockerized dat works fine in local machine and you can access it directly e.g. from Beaker.

You can connect also from any remote machine directly to local dat docker (!). It is enough just to expose 3282, no need in --net host

Agree here with @SvenDowideit that it is almost impossible to understand where dat fails without proper debugging messages. I was able to guess that only local machine is not working by trying and guessing