Exposing host port to site container?

albatross

I'm very new to Enhance (Read: started with it 2 days ago) and I can't figure out how exactly I can expose a port on the host to a container (Either a singular one or all of them. It doesn't matter much to me). Use case is that one of the application servers is also running Elasticsearch on localhost:9200 and I'd like sites on that server to be able to access Elasticsearch on that port. But no matter what I try, I can't get it working. Is this possible somehow? I'm still getting to grips with exactly how Enhance functions, so apologies if this is a question with an obvious answer.

Yaroslav

I also have troubles with sharing socket/port that I open as root via systemctl service to the isolated container. It seems like due to Linux namespaces isolation we can not do that easily. It would be handy to have some guide of tweaking the Enhance configuration per container.

Yaroslav

I saw @cPFence has some knowledge about Enhance infrastructure. Maybe @cPFence can point us to the right direction or at least share some "hack" of overcoming this problem temporarily?

Nickske00

I have it working for me, I'm running zabbix on one of my enhance servers and the admin interface (php) is installed in a regular enhance website, eg inside a container. Default the admin interface tries to connect to localhost:10051, but this didn't work, after a lot of tinkering I found out connecting to 10.169.0.10:10051 worked. It looks like the containers use a /31 network, which gives two ips if I'm correct.

Easy way to find out your container ip is to login via ssh (as the user, not as root!) and do an 'ip a', the second interface will have an 10.x.x.x ip, if you subtract one (eg container is 10.169.0.11 - 1 = 10.169.0.10) you should get an ip you can use to connect to the localhost.

Not sure if connecting to the localhost like this is a good practice, but it works for me. Maybe @Adam can shed a light on this. 🙂

Yaroslav

Nickske00 Thanks for the information!

I was close to the resolution via private networks that you described, but I decided to run the socket just in the container I need via the Cron of Enhance (check if the socket exists and if not -> run the daemon). I needed that setup for the New Relic monitoring of PHP.

xyzulu

Since Enhance v12 docker containers are not used. Are any of you here using v12?

Yaroslav

xyzulu Yes, I am on 12.11.0 version. There is an isolation via Linux namespaces. You can check them by executing lsns command. Ehnance uses the following namespace types (if I understand correctly):

mnt - Mount points
pid - Process IDs
net - Network devices, stacks, ports, etc.

Nickske00

Yes, it's on v12, the containers still each have their own internal ip. 😉

Adam

The 10.169.x.x is the correct IP to use to access a service running on the host o/s. You can also use the public IP if the port is exposed on that IP. The only IP you can't use is 127.0.0.1 due to the network isolation - 127.0.0.1 belongs to the website container itself and is where services that run inside the container (such as Redis) will be accessible.

We will soon support running Elasticsearch within the container itself for apps that need it, such as Magento.

bdd

Adam

any eta for the elastic search?

Adam

No ETA but it is a priority - most of the work was done for the Node.js feature.