Docker 组合容器通信

Question

我有 7 个 docker 容器

1. es_搜索
2. postgres_db
3. 融合验证
4. mysql_db
5. 授权
6. 后端
7. 用户界面

容器之间的通信应该如下所示

• fusionauth应该能够联系 es_search、postgres_db
• 后端应该能够联系 auth、mysql_db
• auth应该能够联系 fusionauth，后端
• ui应该能够联系后端，进行身份验证

现有的 docker-compose

version: '3.1'

services:
 postgres_db:
   container_name: postgres_db
   image: postgres:9.6
   environment:
     PGDATA: /var/lib/postgresql/data/pgdata
     POSTGRES_USER: ${POSTGRES_USER}
     POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
   ports:
     - ${POSTGRES_PORT}:5432
   networks:
     - postgres_db
   restart: unless-stopped
   volumes:
     - db_data:/var/lib/postgresql/data_test

 es_search:
   image: docker.elastic.co/elasticsearch/elasticsearch:6.3.1
   container_name: es_search
   environment:
     - cluster.name=fusionauth
     - bootstrap.memory_lock=true
     - "ES_JAVA_OPTS=${ES_JAVA_OPTS}"
   ports:
     - ${ES1_PORT}:9200
     - ${ES_PORT}:9300
   networks:
     - es_search
   restart: unless-stopped
   ulimits:
     memlock:
       soft: -1
       hard: -1
   volumes:
     - es_data:/usr/share/elasticsearch/data

 fusionauth:
   image: fusionauth/fusionauth-app:latest
   container_name: fusionauth
   depends_on:
     - postgres_db
     - es_search
   environment:
     DATABASE_URL: jdbc:postgresql://postgres_db:5432/fusionauth
     DATABASE_ROOT_USER: ${POSTGRES_USER}
     DATABASE_ROOT_PASSWORD: ${POSTGRES_PASSWORD}
     DATABASE_USER: ${DATABASE_USER}
     DATABASE_PASSWORD: ${DATABASE_PASSWORD}
     FUSIONAUTH_MEMORY: ${FUSIONAUTH_MEMORY}
     FUSIONAUTH_SEARCH_SERVERS: http://es_search:9200
     FUSIONAUTH_URL: http://fusionauth:9010
   networks:
    - postgres_db
    - es_search
   restart: unless-stopped
   ports:
     - ${FUSIONAUTH_PORT}:9011
   volumes:
     - fa_config:/usr/local/fusionauth/config

 db:
   container_name: db
   image: mysql:5.7
   volumes:
     - /etc/nudjur/mysql_data:/var/lib/mysql
   environment:
     - MYSQL_ROOT_PASSWORD=${MYSQL_PASSWORD}
     - MYSQL_USER=${MYSQL_USER}
   ports:
     - ${MYSQL_PORT}:3306
   command: --default-authentication-plugin=mysql_native_password
   restart: on-failure

 backend:
   container_name: backend
   links:
     - db:${MYSQL_HOST}
   depends_on:
     - db
   image: ${BACKEND_IMAGE}
   volumes:
     - ${ENV_FILE}:/backend/.env
   ports:
     - ${BACKEND_PORT}:${BACKEND_PORT}
   command: >
     bash -c "set -a && source .env && set +a"
   restart: unless-stopped

 UI: 
   container_name: UI
   image: ${UI_IMAGE}
   volumes:
     - ${ENV_FILE}:/nudjur/.env
   ports:
     - ${UI_PORT}:${UI_PORT}
   command: >
     bash -c "PORT=${UI_PORT} npm start"
   restart: unless-stopped

 auth:
   container_name: auth
   network_mode: host
   image: ${AUTH_IMAGE}
   volumes:
     - ${ENV_FILE}:/auth/.env
   ports:
     - ${AUTH_PORT}:${AUTH_PORT}
   command: >
     bash -c "set -a && source .env && set +a && python3 ./auth_bridge.py --log-level DEBUG run -p ${AUTH_PORT}"
   restart: unless-stopped

networks:
 postgres_db:
   driver: bridge
 es_search:
   driver: bridge

volumes:
 db_data:
 es_data:
 fa_config:

我对如何在他们之间建立沟通感到困惑。

有人可以帮我弄这个吗？

Answer 1

我了解您想要限制通信，以便容器只能与其他服务通信，例如：

• fusionauth 应该能够联系 es_search、postgres_db
• 后端应该能够联系 auth、mysql_db
• auth 应该能够联系 fusionauth，后端
• ui 应该能够联系后端，进行身份验证

您可以像在示例中已经部分执行的那样使用networks来启用通信，例如：

• 同一网络上的服务可以使用服务名称或别名相互访问 - 即es_search同一网络上的其他服务可以通过http://es_search:9200
• 不同网络上的服务是隔离的，不能互相通信

然后您可以定义您的网络，例如：

services:

 postgres_db:
   networks:
     - postgres_db

 es_search:
   networks:
     - es_search

  # fusionauth should be able to contact es_search, postgres_db
  fusionauth:
    networks:
     - fusionauth
     - postgres_db
     - es_search

  db:
    networks:
    - mysql_db

  # backend should be able to contact auth, mysql_db
  backend:
    networks:
    - backend
    - auth
    - mysql_db

  # ui should be able to contact backend, auth
  UI: 
    networks:
    - backend
    - auth

  # auth should be able to contact fusionauth, backend
  auth:
    networks:
    - auth
    - fusionauth
    - backend


networks:
  fusionauth:
  backend:
  auth:
  postgres_db:
  es_search:
  mysql_db:

其中所有服务（除了ui）都有自己的网络，并且另一个服务必须位于该服务的网络上才能与其通信。

注意：我没有使用link它，因为它是遗留的，并且可能会在文档中所述的未来版本中删除。