fix(hosted): name the ingress network on routed runtime services - #30
Merged
Merged
Conversation
Coolify puts every routed container on two networks: the application network that carries the ingress proxy, and the private runtime network its peers address. Traefik reads a container's address from the first network it iterates when no network is named, and Go randomises that order, so about half of the routed services were resolved to their 172.29.x runtime address after every proxy configuration rebuild and answered nothing on their public route. Restarting one container reshuffled the choice for all of them. Name the network explicitly on the twelve routed services that join both. Coolify exports the application uuid into the environment it runs Compose in, and names the proxy-carrying network after it, so the label resolves without a new operator-set variable and fails the deployment loudly if it is ever absent. Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The failure
After the authority-cells reset deployed, the hosted routes answered
inconsistently:
cra-relay,cra-evidence,nia-evidence,sro-evidence,mosd-programme-evidence,sipf-relayandnagdi-relayreturned 200 whilenia-relay,mosd-programme-relay,sipf-evidenceandnagdi-evidencehunguntil curl timed out with zero bytes. The split held across repeated attempts
over six minutes, so it did not look transient.
Restarting
nia-relayalone then flippedcra-relay, which had not beentouched, from 200 to a hang. That is the tell.
The cause
Coolify puts each routed container on two networks: the application network
named after the application uuid, which carries
coolify-proxy, and thecompose-declared
<uuid>_runtimenetwork on 172.29.x, which does not. Frominside
coolify-proxy, every backend answers on its 10.0.x address and noneanswers on its 172.29.x address.
Coolify generates the Traefik router and service labels itself but emits no
traefik.docker.network, and Traefik v3 with no network named reads theaddress from the first network it iterates. Go randomises map iteration order,
so each proxy configuration rebuild re-rolls the choice for every container,
and any docker event rebuilds the whole configuration.
The live
solmara-lab*fleet never hit this because it uses a single networkper application. The reset introduced the second one.
The fix
Name the network on the twelve routed services that join both. The value comes
from
COOLIFY_RESOURCE_UUID, which Coolify exports into the environment itruns
docker compose upin, so no new operator-set variable is needed. The:?form fails the deployment loudly rather than letting an empty value putTraefik back on the lottery.
The five routed core services that join the ingress network alone
(
static-metadata,scenario-runner,child-benefit-federator,home,portal) have no choice to remove and stay unlabelled.Tests
test_routed_services_on_the_runtime_network_name_the_ingress_networkassertsboth halves of that rule and pins the count at twelve, so a new dual-homed
routed service cannot land unlabelled. It fails on the parent commit.
check-coolify-compose.shand the compose-rendering tests now supplyCOOLIFY_RESOURCE_UUID, which is what Coolify supplies.just lint,just test,just composeandjust relay-checkpass.