Port assignment with docker-compose.yml

[Struck713]

With Dokploy (and more specifically Traefik) we do not need to bind ports. As long as we specify the port mapping for the service in Dokploy (typically configured to 3000), Traefik will reverse proxy it without the port needing to be binded to a port in the host.

Not sure if there is a specific reason for this, but I don't like just exposing the port. Feels like a security concern. I noticed that it is done here:

hacksu-website/docker-compose.yml

Line 34 in 92ce5ca

- "3001:8000"

[cseitz]

Internal port exposures shouldn't be a problem with a properly configured firewall. Assuming. You're still using Ubuntu, it'd be "ufw status".

You should look into using traefik labels to specify ports. I've heard of Dokploy and used it extremely briefly on my own in the past but ultimately traefik labels is an excellent way to provide infrastructure-as-code by configuring a containers ingress in its own compose.yml.

Looks like Dokploy still supports the labels in their documentation: you might want to put the port as a label on the container that way Dokploy only needs to know the traefik router name and the app effectively configured itself regarding the port to use.

version: '3.8'

services:
  your-app:
    image: your-app-image
    # Ports mapping on the host is not required for Traefik to work,
    # provided they are on the same network.
    # ports:
    #   - "8080:8000" 
    labels:
      # Enable Traefik for this container
      - "traefik.enable=true" 
      # Define the routing rule (e.g., based on the Host header)
      - "traefik.http.routers.your-app-router.rule=Host(`your-app.example.com`)"
      # Specify the internal port the application is listening on (e.g., 8000)
      - "traefik.http.services.your-app-service.loadbalancer.server.port=8000"
    networks:
      - traefik-proxy # Ensure it's on the same network as Traefik

networks:
  traefik-proxy:
    external: true # Assumes you have a pre-existing Traefik network

[Monster0506]

Dokploy does override certain Traefik labels, and that is intentional. In particular, it manages the router and domain-related labels itself so that services are correctly wired up to Dokploy-managed domains rather than relying on manually defined host rules. Dokploy does this automatically on clone.

Because of that, we do not need to expose ports on the host at all. As long as the service declares the internal port it listens on, Dokploy and Traefik will handle the reverse proxying entirely within the Docker network.

Traefik already has access to the container, and external access is strictly mediated through Traefik itself. Leaving the port unbound on the host also means we don't have conflicting ports open on our server, so we can run multiple services at the same internal port.

Here is what is automatically inserted into the compose file by Dokploy running with Traefik.

labels:
  - "traefik.enable=true"

  # Networking
  - "traefik.docker.network=dokploy-network"
  - "traefik.swarm.network=dokploy-network"

  # HTTP -> HTTPS redirect
  - "traefik.http.routers.hacksu-web.rule=Host(`hacksu.com`)"
  - "traefik.http.routers.hacksu-web.entrypoints=web"
  - "traefik.http.routers.hacksu-web.middlewares=redirect-to-https@file"
  - "traefik.http.routers.hacksu-web.service=hacksu-web"

  # HTTPS router
  - "traefik.http.routers.hacksu-websecure.rule=Host(`hacksu.com`)"
  - "traefik.http.routers.hacksu-websecure.entrypoints=websecure"
  - "traefik.http.routers.hacksu-websecure.tls.certresolver=letsencrypt"
  - "traefik.http.routers.hacksu-websecure.service=hacksu-websecure"

  # Service definition (internal port only)
  - "traefik.http.services.hacksu-web.loadbalancer.server.port=8000"
  - "traefik.http.services.hacksu-websecure.loadbalancer.server.port=8000"