Solved How is port allocation managed

[dualarrow]

It seems that when you deploy a docker app (eg uptime-kuma) it puts a port number in, but users can change it. How do you ensure you dont end up with multiple users/containers trying to use the same port, or using ports you prefer to reserve. What about firewalls. Do you just pick a range, dst-nat them and let the users fight for a port or is it somehow managed ?

I'm starting to guess that perhaps you should permit docker for external clients unless you have an IP you can dedicate to each client. Let me know if this is correct

Maybe IPv6 is a better option, at least for docker as I have more than I know what to do with. The only issue is a much smaller audience.

I found an entry in the docco that says it finds a free port, but it doesn't mention where the port range is defined (it seems to start at 6880) nor does it indicate whether a user keeps the same port. What if a user shuts down their app and it lets another user grab that port, then the user starts their app again and gets a different port. Does anyone have any further info on this ?

 

[admin]

Hello,

Thank you for the detailed questions. The case you describe at the end was a real problem, and it has been fixed.

Before, the panel only checked whether something was listening on a port at that moment. A stopped container listens on nothing, so its port could be given to the next deployment, and the stopped container could then not start again.

How ports are handled now

• A published host port belongs to its container until the container is deleted, also while the container is stopped. No other user or container can be given it, so a user keeps the same port when they stop and start their app.
• When the panel chooses a port itself (for example when a template's default port is taken), it never picks one that another container holds, running or stopped. A port entered by hand that another container holds is refused.
• As ROOT you can set a port range for customer containers in Docker Manager > Ports (https://your-server:8443/docker/manager#ports). Set it when your firewall or NAT forwards only certain ports: new customer containers then get ports only from this range. Existing containers keep their ports, and ROOT's own containers are not limited.
• The same page lists every host port with its container and owner. A port that is set on two containers (left over from before the fix) is marked there, and you can give one of them a new port; the container is recreated with it and keeps its data.

Dedicated IPs per customer for Docker containers are also on our roadmap, and we will be working on them.

The fix is already in the beta updates. To get it now, set Panel Settings > System Updates > Update Channel to "Stable + Beta" (https://your-server:8443/panel-settings#system_updates) and apply the updates. It will be released to the stable channel on Wednesday, once testing of the updates is finished.

Thank you very much for reporting this.