Docker Compose Support? Multiple VIPS in 1 config? Multiple Containers across multiple hosts?

[SnowyJaguar1034]

Hi Sorry for putting a bunch of questions into the one discussion, I can split them out if you'd prefer.

I was just wondering if you have a docker-compose.yml for this project?

I used composerize to generate the below docker-compose.yml to use with my portainer instance, I'm just wondering if you have any 'official' docker-compose.yml or any changes I should make to this or if you think I could insert the keepalived.conf variables directly into the docker-compose.yml.

Also, Can I run multiple VIP's from the same container/config?
What about some sort of HA setup, Can I run the same VIP config on multiple containers on different hosts?

version: '3.3'
services:
    keepalived:
        network_mode: host
        volumes:
            - '/data/keepalived.conf:/etc/keepalived/keepalived.conf'
        image: keepalived

[nser77]

Here you can find a lot of interesting informations about keepalived docker-image: #665

I personally agree with the following concern from #665 :

My concern is that keepalived operates quite close to the kernel, significantly more so than most applications, and hence my questions to make sure that it really will work within a Docker environment.

Anyway, even if keepalived docker-image is still a separate project maintained by Bertrand Gouny (https://github.com/osixia/docker-keepalived), seems that it is not upgraded to docker-compose; in this case, my personal opinion is that generating a Pull Request in the original project could be a very good idea for several reasons.

Related to your docker-compose.yml is a very interesting starting point, but you may want to add some kernel capabilities with cap_add, be sure to download the correct image (if I'm not wrong about the syntax) or even more (network_mode: "host"):

version: '3.3'
services:
    keepalived:
        network_mode: host
        volumes:
            - '/data/keepalived.conf:/etc/keepalived/keepalived.conf'
        image: osixia/keepalived
        cap_add:
            - NET_ADMIN 
            - NET_BROADCAST 
            - NET_RAW

---

Also, Can I run multiple VIP's from the same container/config?
What about some sort of HA setup, Can I run the same VIP config on multiple containers on different hosts?

EDIT: I think the answer is yes, but seems you need some work-arounds.

[nser77]

Hi, sorry for answering again after a lot of days, but there are some additional notes, observations and updates:

• The issue Docker image for keepalived #665 mentioned in my previous comment has a lot of interesting concerns and informations about docker-keepalived image, but seems to be a old post.
• The issue Docker image for keepalived #665 says that docker-keepalived should remain a separated project.
• PR Updated docker file #2052 introduce the keepalived Dockerfile into the main project (skeleton for the community?).
• The main keepalived project has a folder named docker with a lot of interesting informations about docker-keepalived and it mentions osixia/docker-keepalived repository.
• Seems that the repository osixia/docker-keepalived - mentioned as official keepalived Docker image - is unmaintened since many years.

It is a bit confused, but I'm a confued guy too so was pretty intresting for me analize it - also many thanks for your input.

I started analyzing osixia/docker-keepalived:

• It is multi process environment.
• It is a very large image.
• It depends on other private projects.
• It has no docker-compose file.
• It does not allow you to dynamically compile your keepalived instance.
• Needs maitenance to change keepalived version.
• Not really worry about security.
• Really hard to maintain.

So I moved to the original project and I analyzed #2052:

• You need to pre-build keepalived to generate the Dockerfile (seems not for kernel module alignment).
• It has no docker-compose file.
• It has not security reccomendations.
• No support.

---

I don't know if I was wrong, but after those analysis I forked osixia/docker-keepalived and then I generated a PR that could help to unlock the full power of keepalived and docker; I tried to generate a PR that can switch the project into a "self-maintened" repository and easy to use for the whole community.

This version of docker-keepalived allows you to build the docker image directly from GitHub and compile keepalived as you want trought the arguments passed via docker-compose file or docker build command.

In this project:

• Based on: Updated docker file #2052
• References to keepalived project and all it's related concerns and informations about docker-keepalived.
• Added docker-compose file.
• Translated some concerns into configurations (stop_grace_period).
• Applied the policy deny-all for the capabilities trought the docker-compose file and added only those required.
• Dynamic build direct from GitHub.
• keepalived version is cloned from GitHub.

For more information please take a look to: pull/60 or README.

The docker-compose file I was able to unlock looks like this (you can remove the build section if you want and try it with your image):

version: '3.7'

services:
    keepalived:
        container_name: keepalived
        image: keepalived
        build:
            cache_from:
                - alpine:latest
            context: https://github.com/nser77/docker-keepalived.git#master:build
            args:
                - GIT_KVER=master
                - MAP_FROM=local
                - __ENABLE_MAGIC__=0
                - __ENABLE_DBUS__=0
                - __DISABLE_IPSET__=0
                - __DISABLE_IPTABLES__=0
                - __DISABLE_NFTABLES__=1
                - __ENABLE_SNMP_VRRP__=0
                - __ENABLE_REGEX__=0
                - __ENABLE_JSON__=1
                - __DISABLE_LVS__=1
                - __DISABLE_VRRP__=0
                - __DISABLE_VRRP_AUTH__=1
                - __ENABLE_BFD__=0
                - __DISABLE_VMAC__=0
                - __ENABLE_LTO__=0
        pid: host
        network_mode: host
        volumes:
            - type: bind
              read_only: true
              source: /etc/keepalived
              target: /etc/keepalived
        cap_drop:
            - ALL
        cap_add:
            - NET_ADMIN
            - NET_BROADCAST
            - NET_RAW
            - NET_BIND_SERVICE
            - CHOWN
            - SETUID
            - SETGID
            - IPC_LOCK
            - KILL
            - SYS_NICE
            - SYS_RESOURCE
            - SYS_MODULE
        restart: on-failure
        healthcheck:
            test: ["CMD", "killall", "-0", "/usr/sbin/keepalived"]
            interval: 5s
            timeout: 3s
            retries: 2
            #start_period: 10s
        stop_grace_period: 1m30s
        entrypoint: ["/usr/sbin/keepalived","--dont-fork","--log-console", "-d", "-D", "-f", "/etc/keepalived/keepalived.conf"]

---

Finally, like other users, I remain skeptical about how keepalived would works in a docker enviroment, so the advice is the same: use at your own risk.

[kryptt]

This works for me, even in a docker_swarm environment:

keepalived:
<<: *default-opts
image: osixia/keepalived
volumes:
- /swarm/ingress/keepalived/keepalived.conf:/usr/local/etc/keepalived/keepalived.conf
- /swarm/ingress/keepalived/data.{{.Task.Slot}}:/tmp
environment:
NODE_ID: "{{.Node.ID}}"
TASK_SLOT: "{{.Task.Slot}}"
DOCKER_IMAGE: '{{index .Service.Labels "com.docker.stack.image"}}'
KEEPALIVED_COMMAND_LINE_ARGUMENTS: "--config-id {{.Task.Slot}} --log-detail --dump-conf"
networks:
- external
cap_add:
- NET_ADMIN
- NET_BROADCAST
- NET_RAW
deploy:
replicas: 3
placement:
constraints:
- node.role == manager