NethServer Docker 1.0.1 released

pagaille · May 17, 2020, 8:46pm

Everything sounds better in Italian

giacomo · May 18, 2020, 7:37am

Just execute make after cloning the repo. If you really want to test it, you need to setup a repo, something like this:

mkdir myrepo
cd myrepo
creatererpo -g groups.xml

But travis will do the job for you, no worry

aosoio85 · May 18, 2020, 9:03am

That’s a really great news …
i would finally switch to nethserver.

My best compliment. Wonderful work!

pagaille · May 18, 2020, 9:20am

@mrmarkuz I updated to 1.0.1 but the aerial network has not been created.

Strangely enough, the log said :

esmith::event[24754]: Action: /etc/e-smith/events/nethserver-docker-update/S20nethserver-docker-create-aeria SUCCESS [0.074652]

I tried to yum reinstall nethserver-docker : no change.

Finally I issued manually the command found in the script :

docker network create -d devplayer0/net-dhcp:latest --ipam-driver null -o bridge=br0 aeria

It worked. Dunno what happened. I had installed the DHCP plugin before but it was deactivated (no network using it) when I updated.

Other side effect : my pihole container lost some configuration settings (DNS servers and local resolution).

mrmarkuz · May 18, 2020, 9:46am

Did you enable the Aeria network?

github.com

NethServer/nethserver-docker/blob/master/README.rst#aeria-network

nethserver-docker
=================

This is a prototype that integrates Docker based applications within
NethServer. 

* It defines a new firewall zone and docker network, ``aqua``. Basically, 
  containers are attached to ``aqua`` and they can talk each other. IP
  traffic from other zones, like ``green`` and ``red`` must be configured with
  the usual ``Firewall rules`` and ``Port forwarding`` pages

* As example to test integration with system services, connections from the
  ``aqua`` zone are allowed to the MySQL/MariaDB port 3306.

More port rules can be opened to the system services with a esmith db command::

  db dockrules set customName aqua TCPPorts 12,23,56,89 UDPPorts 120,230,560,890 status enabled
  signal-event firewall-adjust

* It exposes portainer dashboards through the

This file has been truncated. show original

I am going to check but it should be persistent…

pagaille · May 18, 2020, 10:01am

My bad. I was unaware of this. Sorry.

stephdl · May 18, 2020, 2:26pm

We have made some internal changes

portainer is disabled by default : We would like a dependency for a lot of usage, I might not need portainer, but it is a big plus if I can install it quickly with a command line
Aeria is disabled by default : We cannot presume on which bridge you want to run aeria, you could have several green NIC, how we could decide what is the good one, the first, not sure. The easier solution for us is to ask to create manually the bridge and by the command line set the good bridge name to bridgeAeria

pagaille · May 20, 2020, 12:25pm

BTW the docker-compose tool that is installed is really old and has a bug for docker-compose.yml files version > 3.3 (it pretends to not support them even if it should).

Installing the latest stable version (at the time of writing) can be done easily :

curl -L "https://github.com/docker/compose/releases/download/1.25.5/docker-compose-$(uname -s)-$(uname -m)" -o /usr/bin/docker-compose
chmod +x /usr/bin/docker-compose

Have fun

pcdoc · May 21, 2020, 2:41am

Great job done by the pair of you. Now I can free up ram on dev PC and put docker on the Nethserver.
Thanks for getting the hard yards done.

syntaxerrormmm · May 22, 2020, 7:22am

Kudos to both for pulling this out, much needed. These are the situations where you ask yourself why the are limited to one per person

And at least a beer to each one of you at next meeting is the minimum

pagaille · May 29, 2020, 12:37pm

Found why : I unknowingly deleted the persistent folder on the host. It should be noted that this folder is created right where you are when the “docker run” command is issued.

pagaille · May 29, 2020, 12:38pm

docker run -d --name pihole -e TZ=“Europe/Vienna” -e WEBPASSWORD=“admin” -v “$(pwd)/etc-pihole/:/etc/pihole/” -v “$(pwd)/etc-dnsmasq.d/:/etc/dnsmasq.d/” --cap-add NET_ADMIN --net=aeria --mac-address=0e:6f:47:f7:26:1a --restart=unless-stopped pihole/pihole:latest

For me it was needed to run pihole -r after install and reconfigure the thing because it was linked to an (not existent) eth0 interface instead of the br00 interface used by the aeria network.

mrmarkuz · May 29, 2020, 2:58pm

Sorry for that, it seems hard to find a simple example that makes no problems

The interface could be set with -e INTERFACE="br00@if24" but I think it’s not needed. It’s working in my tests with the wrong eth0 interface.

stephdl · May 29, 2020, 3:37pm

yep it works pretty well

pagaille · May 29, 2020, 4:32pm

Are you sure ? Because the web interface actually runs perfectly but when pihole is set as DNS server it doesn’t resolve anything !

stephdl · May 29, 2020, 4:33pm

you miss the secret settings probably

pagaille · May 29, 2020, 4:34pm

what do you mean ??

stephdl · May 29, 2020, 4:35pm

github.com

stephdl/nethserver-pihole/blob/ns7/root/etc/e-smith/events/actions/nethserver-pihole-docker-creation

#!/usr/bin/bash

bridgeAeria=$(/sbin/e-smith/config getprop docker bridgeAeria)

if [[ -z ${bridgeAeria} ]]; then
    echo "# Bridge for aeria doesn't exist"
    exit 0
fi

HasNetwork=$(docker network ls -f name=aeria -q)
if [[ $? != 0 ]]; then
    exit 1
fi

if [[ -z ${HasNetwork} ]]; then
    echo "# Aeria doesn't exist"
    exit 0
fi

HasPihole=$(docker ps -f name=pihole -q -a)

This file has been truncated. show original

pagaille · May 29, 2020, 5:34pm

Haaaaaa. I missed that new module ! Actually I simply ran the pihole container as mentioned in mr_markus’s doc.

stephdl · May 29, 2020, 5:48pm

Relative to pihole I found that my router (livebox4) has continued to serve DNS via IPV6 even If I do not use it. I needed to fully disable IPV6 else the Android/apple mobile still continued to bypass pihole even if the dhcp service attributed the IP of pihole as the dns server