Does -allowfrom work with hostnames in swarm?

[Yaytay]

Hi,

I really like socket-proxy, but I can't get allowfrom to work with hostnames in swarm (it works with IP addresses and it's on a private network so nothing else should be able to reach it, but hostnames would look better - would make the compose file work in more situations without needing use 0.0.0.0/0).
This is my compose file:

networks:

  internal:
    driver: overlay
    driver_opts:
      encrypted: 'true'
  monitoring-ingress:
    name: monitoring-ingress
    external: true

services:
  dockerproxy:
    image: wollomatic/socket-proxy:1.3.1 # see https://github.com/wollomatic/socket-proxy for reference
    deploy:
      mode:
        global
    networks:
      - internal
    command:
      - '-loglevel=debug' # set to debug for far more logging
      - '-allowfrom=swarmview'
      - '-listenip=0.0.0.0'
      - '-allowGET=/v1\.4[0-9]/(.+)' # this regexp allows readonly access to anything
      - '-shutdowngracetime=5'
      - '-watchdoginterval=600'
      - '-stoponwatchdog'
      - '-allowhealthcheck'
    user: 65534:998 # replace <<docker-gid>> with the docker gid on your host system
    read_only: true
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro

  swarmview:
    image: ghcr.io/yaytay/swarmview:0.0.27
    deploy:
      replicas: 2
      resources:
        limits:
          cpus: '1'
          memory: 64M
    environment:
      - DOCKER_PROXY_ENDPOINT=dockerproxy:2375
      - DOCKER_PROXY_SERVICE=swarmview_dockerproxy
    networks:
      - internal
      - monitoring-ingress
    read_only: true

The logs for socket-proxy report this:

time=2024-08-22T08:02:14.373Z level=WARN msg="blocked request" reason="forbidden IP" method=GET URL="/v1.45/services?status=true" client=10.0.18.6:60958 response=403
time=2024-08-22T08:02:14.685Z level=WARN msg="blocked request" reason="forbidden IP" method=GET URL="/v1.45/services?status=true" client=10.0.18.5:48102 response=403
time=2024-08-22T08:02:15.869Z level=WARN msg="blocked request" reason="forbidden IP" method=GET URL="/v1.45/services?status=true" client=10.0.18.6:60978 response=403
time=2024-08-22T08:02:16.186Z level=WARN msg="blocked request" reason="forbidden IP" method=GET URL="/v1.45/services?status=true" client=10.0.18.5:48126 response=403
time=2024-08-22T08:02:16.777Z level=WARN msg="blocked request" reason="forbidden IP" method=GET URL=/v1.45/tasks client=10.0.18.6:32784 response=403
time=2024-08-22T08:02:17.071Z level=WARN msg="blocked request" reason="forbidden IP" method=GET URL=/v1.45/tasks client=10.0.18.5:48158 response=403
time=2024-08-22T08:02:17.383Z level=WARN msg="blocked request" reason="forbidden IP" method=GET URL="/v1.45/services?status=true" client=10.0.18.6:49778 response=403
time=2024-08-22T08:02:17.388Z level=WARN msg="blocked request" reason="forbidden IP" method=GET URL=/v1.45/nodes client=10.0.18.5:48192 response=403
time=2024-08-22T08:02:17.982Z level=WARN msg="blocked request" reason="forbidden IP" method=GET URL="/v1.45/services?status=true" client=10.0.18.6:49796 response=403

Using nsenter I can do a bit of rummaging around DNS:

$ sudo nsenter -n -t 1478780 dig @127.0.0.11 +short swarmview_swarmview.2.75bd9yjxfc7nu1d2xel853lv1
10.0.18.12
$ sudo nsenter -n -t 1478780 dig @127.0.0.11 +short swarmview_swarmview.1.bkgm9nqf3afo92l0xwsezrzwp
10.0.18.13
$ sudo nsenter -n -t 1478780 dig @127.0.0.11 +short swarmview_swarmview
10.0.18.2
$ sudo nsenter -n -t 1478780 dig @127.0.0.11 +short swarmview
10.0.18.2

None of which match the client IP that socket-proxy is seeing.

Do you know whether there is a hostname that can work in this scenario?

Thanks.

[wollomatic]

Hi @Yaytay, thanks for your post.

Socket-proxy resolves the hostname using the Go standard library net.LookupIP (https://pkg.go.dev/net#LookupIP), which looks up the host using the local DNS resolver. So, the resolving should work with Swarm if the hostname is known.

But I haven't worked with Swarm by myself. The hostnames of both replicas look dynamically created, and I don't see where the client IP addresses 10.0.18.6 and 10.0.18.6 come from. I guess an experienced Docker captain like @BretFisher could tell easily :)