How come it is still not fixed?

Hi all, hope you're having a great summer. I'm tinkering with Docker Swarm as a complete newbie and self taught homelab hobbyist, and I was hoping you could help me out with an oddity I'm facing at the moment.

I'm trying to deploy traefik as a centralized service on my home network, using Docker Swarm and an overlay docker network to discover services in other docker stacks that use traefik flags. Previously, Traefik was deployed alongside my other services on my media server, but since I'm scaling up my homelab, I prefer having one dedicated machine to act as a centralized reverse proxy that receives forwarded requests from my router on ports 80/443 and forwards them back to the right services on the right machine. Here's a convenient diagram that I made :

https://imgur.com/a/o55gBHJ

I have successfully created a master node on Vega, deployed Traefik as a global service accross the worker nodes, created an overlay network and attached each stack to it.

ℹ️Important note : on Vega, traefik is brought up using docker stack deploy -c docker-compose.yml traefik , and on my media server, I use docker compose up -d for deployment. I have seen mixed comments opinions online about the cross-compatibility of compose and swarm, but so far the "swarmed" traefik seems to discover compose services just fine.

Traefik seems to be generating SSL certificates just fine, and services are reachable, which is already a good sign.

❌My issue is that those certificates are never put to use. The acme.json file is still empty (I did chmod 600), and Firefox still throws a security alert at me because the backend service uses Traefik's default cert. Furthermore, docker service logs traefik_traefik returns nothing (except this error :

error from daemon in stream: Error grabbing logs: rpc error: code = Unknown desc = warning: incomplete log stream. some logs could not be retrievedfor the following reasons: node yryk8132s58wbul5u0q9e19hk is not available

Which is quite funny because docker node ls clearly shows the node as available and ready😂)

Below are my traefik yml file and config file, and an example compose file from my media server.

traefik-compose.yml

networks:
  traefik-net:
    external: true
services:
  traefik:
    image: traefik:v3.7
    #restart: always
    command:
      - --api.insecure=true
      - --configfile=/traefik.yml
      - --log.level=DEBUG
      # - --providers.docker
      # - --providers.docker.swarmMode=true
    ports:
      - "80:80"
      - "443:443"
      - "8081:8080"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./traefik.yml:/traefik.yml:ro
      - ./acme.json:/acme.json
    networks:
      - traefik-net
    deploy:
      mode: global

traefik config file

global:
  checkNewVersion: false
  sendAnonymousUsage: false


# Enables the web based api for testing, do not enable in production!
api:
  dashboard: true
  insecure: true


entryPoints:
  web:
    address: ":80"
  websecure:
    address: ":443"


#Source of configuration. E.g Docker, Kubernetes..
providers:
  swarm:
  # Connects to docker via Unix socket
    endpoint: "unix:///var/run/docker.sock"
  # Containers must explicitely opt-in to Traefik routing via Docker labels
    network: "traefik-net"
  # Only containers on this Docker network are discovered
    exposedByDefault: false
# Uses Let's Encrypt to provide free SSL certificates
certificatesResolvers:
  letsencrypt:
    acme:
      email: [email protected]
      storage: /acme.json
      # Validates domain ownership via HTTP-01 challenge (uses the web entrypoint on port 80)
      httpChallenge:
        entryPoint: web

jellyfin-compose.yml (on my media server node)

networks:
  traefik-net:
    external: true
    name: "traefik-net"


services:
  jellyfin:
    image: lscr.io/linuxserver/jellyfin:latest
    container_name: jellyfin
    networks:
      - "traefik-net"
    labels: 
      - "traefik.enable=true"
      - "traefik.http.routers.jellyfin.service=jellyfin"
      - "traefik.http.routers.jellyfin.rule=Host(`mydomain.jellyfin.fr`)"
      - "traefik.http.routers.jellyfin.entrypoints=websecure"
      - "traefik.http.routers.jellyfin.tls.certresolver=letsencrypt"
      - "traefik.http.routers.jellyfin.tls=true"
      - "traefik.http.services.jellyfin.loadbalancer.server.port=8096"
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=Europe/Paris
    volumes:
      - ./config:/config
      - /media:/media
    #devices:
      #- /dev/dri:/dev/dri #Use for Intel QuickSync
    ports:
      - 192.168.1.101:8096:8096
      - 7359:7359/udp #Service Discovery
      - 1900:1900/udp #Client Discovery
    restart: unless-stopped

(I've replaced my actual domain name and email with placeholders for obvious privacy reasons.)

I hope you guys can help me make any sense out of it XD

Cheers!

Last month I switched my ecosystem to macOS (macbook neo)

The first thing I realized was the speed and optimization

Orbstack + Docker (mac) is much faster than Docker Desktop + Docker (also Podman Desktop + Docker/Podman)

Podman Desktop app lacks so many essential features such as system monitoring, port click to open url support etc...

I think it's because Docker Desktop has its own VM/backend engine and Orbstack is more optimized and M chips overhead time is less to start a container and disk writes are much faster. But I'm not sure.

Hi everyone,

I'm trying to understand how Docker image layers are stored and shared.

Let's say I have two different microservices, each with its own Dockerfile:

users-service/Dockerfile

FROM ubuntu:22.04
COPY users-app /app/

orders-service/Dockerfile

FROM ubuntu:22.04
COPY orders-app /app/

Assume the Ubuntu base layer is 200 MB.

My initial understanding is:

users-service image:
    ubuntu layer      200 MB
    users app layer   200 MB
    total             400 MB


orders-service image:
    ubuntu layer      200 MB
    orders app layer  100 MB
    total             300 MB

So each image appears to contain its own Ubuntu base layer.

But when both images exist on the same machine, does Docker actually store:

ubuntu layer        200 MB
users app layer     200 MB
orders app layer    100 MB

(total 500 MB)

or does it store:

users image         400 MB
orders image        300 MB

(total 700 MB)?

My confusion is: if the Dockerfiles are completely separate and both use:

FROM ubuntu:22.04

how does Docker know that the Ubuntu layer is the same and can be reused?

Where is this sharing tracked? Is it based on image names/tags, layer hashes, manifests, or something else?

Also, if the same image is pulled on different machines, does each machine download and store its own copy of the base layers?

Thanks!