[READ-ONLY] Mirror of https://github.com/FoxxMD/blog.
blog.foxxmd.dev
feat(traefik_migrate): Add network types section
+111
-8
+111
-8
_posts/2025-04-07-migrating-to-traefik.md
+111
-8
_posts/2025-04-07-migrating-to-traefik.md
···
139
139
140
140
In each section below I lightly cover the differences between SWAG/Traefik, what was needed to migrate to Traefik, and how I implemented it along with examples, if necessary.
141
141
142
+
> This guide and the [companion repository](https://github.com/FoxxMD/traefik-homelab) use **user-defined docker networks** for all examples. To make these examples work you will first need to create these OR modify the examples to use default bridge networking (`HOST_IP:PUBLISHED_PORT`). [**See networking differences and guide networking setup below for instructions.**](#user-defined-vs-default-bridge-networking)
143
+
{: .prompt-warning}
144
+
142
145
### Web Routing Parity
143
146
144
147
This was the hardest requirement to meet for **edge cases**. Unlike NGINX,
···
1589
1592
1590
1593
See the [traefik repository for a full stack with Logdy config included.](https://github.com/FoxxMD/traefik-homelab/blob/main/traefik_internal/compose.yaml#L77)
1591
1594
1595
+
### User-Defined vs Default Bridge Networking
1596
+
1597
+
This guide and companion repository exclusively use [intra-stack](https://docs.docker.com/compose/how-tos/networking/) and [`external`](https://docs.docker.com/reference/compose-file/networks/#external), [`attachable`](https://docs.docker.com/reference/compose-file/networks/#attachable) [user-defined `bridge`](https://docs.docker.com/engine/network/drivers/bridge/#differences-between-user-defined-bridges-and-the-default-bridge) (or [**overlay**](#swarm-and-overlay)) [networks](https://docs.docker.com/compose/how-tos/networking/).
1598
+
1599
+
Using these networks allows all related services to be addressed by their **container name** and **internal** ports which removes the need to hardcode IP addresses, publish ports, and makes the examples in this guide portable.
1600
+
1601
+
You *should* use user-defined networks if you plan to implement the [separating internal/external sevices section](#separating-internalexternal-services) but for all the other sections its not *required* (but strongly encouraged!). If you do not want to use external networks you can simply replace instances of `container_name:internal_port` in stacks/ENVs with `host_ip:published_port`.
1602
+
1603
+
<details markdown="1">
1604
+
1605
+
<summary>Examples of Differences</summary>
1606
+
1607
+
<details markdown="1">
1608
+
1609
+
<summary>User-Defined Networks</summary>
1610
+
1611
+
```yaml
1612
+
services:
1613
+
traefik:
1614
+
# ...
1615
+
traefik-redis:
1616
+
container_name: traefik_internal_redis
1617
+
image: redis:7-alpine
1618
+
networks:
1619
+
- kop_overlay
1620
+
- default
1621
+
# ...
1622
+
networks:
1623
+
kop_overlay:
1624
+
external: true
1625
+
```
1626
+
{: file="traefik_internal/compose.yaml"}
1627
+
1628
+
```yaml
1629
+
services:
1630
+
traefik-kop:
1631
+
image: "ghcr.io/jittering/traefik-kop:latest"
1632
+
networks:
1633
+
- kop_overlay
1634
+
- default
1635
+
environment:
1636
+
- "REDIS_ADDR=traefik_internal_redis:6379" # automatically resolves to an internal docker network IP like 10.0.2.14
1637
+
# ...
1638
+
networks:
1639
+
kop_overlay:
1640
+
external: true
1641
+
```
1642
+
{: file="traefik_kop/compose.yaml"}
1643
+
1644
+
</details>
1645
+
1646
+
<details markdown="1">
1647
+
1648
+
<summary>Default Bridge Networking</summary>
1649
+
1650
+
```yaml
1651
+
services:
1652
+
traefik:
1653
+
# ...
1654
+
traefik-redis:
1655
+
container_name: traefik_internal_redis
1656
+
image: redis:7-alpine
1657
+
networks:
1658
+
- default
1659
+
ports:
1660
+
- "7000:6379"
1661
+
# ...
1662
+
```
1663
+
{: file="traefik_internal/compose.yaml"}
1664
+
1665
+
```yaml
1666
+
services:
1667
+
traefik-kop:
1668
+
image: "ghcr.io/jittering/traefik-kop:latest"
1669
+
networks:
1670
+
- default
1671
+
environment:
1672
+
- "REDIS_ADDR=192.168.0.100:7000" # IP is docker host machine LAN address
1673
+
# ...
1674
+
```
1675
+
{: file="traefik_kop/compose.yaml"}
1676
+
1677
+
</details>
1678
+
1679
+
</details>
1680
+
1681
+
#### Setup Networks from Guide
1682
+
1683
+
There are four user-defined networks used in this guide and [companion repository.](https://github.com/FoxxMD/traefik-homelab?tab=readme-ov-file#networks)
1684
+
1685
+
If you plan on using this guide to setup Traefik for traffic over multiple machines you will need to setup [Swarm and Overlay](#swarm-and-overlay) networks to use them. If you do not set this up you will need to use Default Bridge Networking for any example that communicates between different machines.
1686
+
1687
+
If all setup is being done on one machine then you can still use the user-defined networks below, just replace `--driver=overlay` with `--driver=bridge`.
1688
+
1689
+
Reference [Creating Docker Networks](https://docs.docker.com/reference/cli/docker/network/create/)
1690
+
1691
+
```shell
1692
+
docker network create --driver=overlay --attachable internal_overlay
1693
+
docker network create --driver=overlay --attachable --subnet=10.99.0.0/24 public_overlay
1694
+
docker network create --driver=overlay --internal --attachable kop_overlay
1695
+
docker network create --driver=overlay --internal --attachable crowdsec_overlay
1696
+
```
1697
+
1698
+
Any unused subnet can be used for `public_overlay`.
1699
+
1592
1700
### Swarm and Overlay
1593
1701
1594
1702
#### What/Why Overlay?
1595
1703
1596
-
[Docker Networks](https://docs.docker.com/engine/network/) provide many benefits to the containers attached to them like network isolation and automatic hostname resolution to private IP in the network (reach by container name IE `http://myContainerName` => `http://10.0.5.26`). However, with (Standalone) Docker all of the [Networks types](https://docs.docker.com/engine/network/drivers/) that can be created (`host bridge ipvlan`) can only be used on the same machine they were created on. If you need containers on different hosts to communicate this can only be done through the [host `bridge`](https://docs.docker.com/engine/network/drivers/bridge/) and the remote container must publish a port to its host IE `http://HOST_IP:PORT` => `http://192.168.0.1:5770`.
1704
+
[User-Defined Docker Networks](https://docs.docker.com/engine/network/drivers/bridge/#differences-between-user-defined-bridges-and-the-default-bridge) provide many benefits to the containers attached to them like network isolation and automatic hostname resolution to private IP in the network (reach by container name IE `http://myContainerName` => `http://10.0.5.26`). However, with (Standalone) Docker all of the [Networks types](https://docs.docker.com/engine/network/drivers/) that can be created (`host bridge ipvlan`) can only be used on the same machine they were created on. If you need containers on different hosts to communicate this can only be done through the [default `bridge` network](https://docs.docker.com/engine/network/drivers/bridge/) and the remote container must publish a port to its host IE `http://HOST_IP:PORT` => `http://192.168.0.1:5770`.
1597
1705
1598
-
There is *another* network type, [**Overlay**](https://docs.docker.com/engine/network/drivers/overlay/), that solves this problem. Overlay networks *span all hosts* by communicating through internal bridges on each host's Docker daemon. All of the benefits (network isolation, hostname resolution, etc...) of a docker network are preserved but the containers can be running on any host attached to the network. However, **to use this network type your hosts must be in a [Docker Swarm](https://docs.docker.com/engine/swarm/).**
1706
+
There is *another* user-defined network type, [**Overlay**](https://docs.docker.com/engine/network/drivers/overlay/), that solves this problem. Overlay networks *span all hosts* by communicating through internal bridges on each host's Docker daemon. All of the benefits (network isolation, hostname resolution, etc...) of a user-defined docker network are preserved but the containers can be running on any host attached to the network. However, **to use this network type your hosts must be in a [Docker Swarm](https://docs.docker.com/engine/swarm/).**
1599
1707
1600
1708
#### Should You Swarm?
1601
1709
···
1658
1766
1659
1767
This must be done from a manager node. After creating the network, it will only be listed on a host's networks (`docker network ls`) *if there is an existing container attached to it.*
1660
1768
1661
-
If you are creating an overlay network for [use with external traefik services (following this guide)](#by-isolated-docker-network) then make sure to [specify an unused subnet](https://docs.docker.com/reference/cli/docker/network/create/#specify-advanced-options) that can be used for firewall rules later (next post!)
1662
-
1663
-
1664
-
```shell
1665
-
docker network create --driver=bridge --attachable --subnet=10.99.0.0/24 public_net
1666
-
```
1769
+
**Follow the instructions from the [networking setup section above](#setup-networks-from-guide) to create the overlay networks needed for this guide.**
1667
1770
1668
1771
To use an overlay network in a compose stack, it must be defined in [top-level networking](https://docs.docker.com/reference/compose-file/networks/) as [`external`](https://docs.docker.com/reference/compose-file/networks/#external):
1669
1772