feat(compose): opt-in skipDefaultNetwork to avoid Traefik multi-network routing issues#4808
Open
myagizmaktav wants to merge 1 commit into
Open
Conversation
…etwork routing issues When a domain is attached to a compose service, addDokployNetworkToService unconditionally attaches that service to both "dokploy-network" and the project's implicit "default" network (introduced in Dokploy#3562 so sibling services stay reachable via Compose's own default networking). For services that don't rely on the default network for inter-service connectivity (e.g. single-service compose apps, or apps that already manage their own explicit network topology), being attached to two networks can make Traefik's Docker provider select the wrong network's IP for routing. In a live incident this produced a container that Docker reported "healthy" while Traefik returned a persistent 502 through Cloudflare — and neither restarting the same container nor reloading Traefik's config recovered it; only fully removing and recreating the container (new container ID, new network endpoint) did. This adds a new per-domain boolean, `skipDefaultNetwork` (default false, so all existing behavior and tests are unchanged), that lets a domain opt out of the "default" network attachment while still keeping dokploy-network. Mirrors the existing `stripPath`-style per-domain flag pattern. - packages/server/src/db/schema/domain.ts: new column + pick lists - packages/server/src/db/validations/domain.ts: zod validation for the compose domain schema - packages/server/src/utils/docker/domain.ts: addDokployNetworkToService now accepts an optional skipDefaultNetwork flag; call site passes domain.skipDefaultNetwork - apps/dokploy/drizzle/: migration for the new column - New tests in network-service.test.ts covering the opt-in behavior; existing tests for the default (unchanged) behavior still pass - Updated 4 existing test fixtures (Domain mock objects) that needed the new required field to keep typecheck green Note: apps/dokploy/drizzle/meta/*_snapshot.json was not regenerated — I don't have a local Postgres/drizzle-kit toolchain to run `drizzle-kit generate` against. The schema.ts change and migration SQL are correct and minimal (single boolean column, matching the existing 0174 migration's style); happy to update the snapshot if pointed at how you'd like it generated, or if CI regenerates it automatically. All 146 existing tests in apps/dokploy/__test__/compose/ pass, plus 5 new ones for this change. `pnpm --filter=@dokploy/server run typecheck` and `pnpm --filter=dokploy run typecheck` are clean (the one remaining handle-tag.tsx Zod-version error pre-exists on canary and is unrelated).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #4807
Problem
addDokployNetworkToServiceunconditionally attaches every domain-linked compose service to bothdokploy-networkand the project's implicitdefaultnetwork (the fix for #3562). For services that don't need default-network connectivity (single-service compose apps, or apps managing their own explicit network topology), this dual attachment can make Traefik's Docker provider pick the wrong network's IP for routing — producing a persistent 502 that neither a same-container restart nor a Traefik config reload fixes, only a full container recreate does. Full repro/evidence in #4807.Change
Adds an opt-in, backward-compatible per-domain boolean
skipDefaultNetwork(defaultfalse) that lets a domain skip thedefaultnetwork attachment while keepingdokploy-network. Mirrors the existingstripPath-style per-domain flag pattern (same schema/validation/pick-list shape).packages/server/src/db/schema/domain.ts— newskipDefaultNetworkcolumn (NOT NULL, default false) + added toapiCreateDomain/apiUpdateDomainpick listspackages/server/src/db/validations/domain.ts— added to thedomainComposezod schema (compose-only, since this only matters for compose deployments)packages/server/src/utils/docker/domain.ts—addDokployNetworkToServicetakes an optionalskipDefaultNetworkparam (defaults tofalse, i.e. unchanged behavior); call site passesdomain.skipDefaultNetwork ?? falseapps/dokploy/drizzle/0175_skip_default_network.sql+ journal entry — migration for the new columnnetwork-service.test.tscovering the opt-in path (5 new cases); all existing cases for the default/unchanged path still pass as-isDomainmock objects inhost-rule-format.test.ts,labels.test.ts,forward-auth.test.ts,traefik.test.ts) that needed the new required field for typecheckTesting
Note on the migration snapshot
I don't have a local Postgres/drizzle-kit toolchain to regenerate
apps/dokploy/drizzle/meta/*_snapshot.json. Theschema.tschange and migration SQL are minimal and correct (single boolean column, matching the style of the existing0174migration) — happy to update the snapshot if you can point me at how you'd like it generated, or if this is something CI/your usual flow regenerates.Open to discussion
This is meant as a starting point, not a final word on the design — happy to adjust naming (
skipDefaultNetworkvs something else), whether this belongs onDomainvsCompose, or add a UI toggle if you'd like one wired in as a follow-up. Wanted to keep this PR focused on the minimal backend capability + tests first.