|
| 1 | +--- |
| 2 | +title: "Using Telepresence with Docker" |
| 3 | +hide_table_of_contents: true |
| 4 | +--- |
| 5 | +# Telepresence with Docker Golden Path |
| 6 | + |
| 7 | +## Why? |
| 8 | + |
| 9 | +It can be tedious to adopt Telepresence across your organization, since in its handiest form, it requires admin access, and needs to get along with any exotic |
| 10 | +networking setup that your company may have. |
| 11 | + |
| 12 | +If Docker is already approved in your organization, this Golden path should be considered. |
| 13 | + |
| 14 | +## How? |
| 15 | + |
| 16 | +When using Telepresence in Docker mode, users can eliminate the need for admin access on their machines, address several networking challenges, and forego the need for third-party applications to enable volume mounts. |
| 17 | + |
| 18 | +You can simply add the docker flag to any Telepresence command, and it will start your daemon in a container. |
| 19 | +Thus removing the need for root access, making it easier to adopt as an organization |
| 20 | + |
| 21 | +Let's illustrate with a quick demo, assuming a default Kubernetes context named default, and a simple HTTP service: |
| 22 | + |
| 23 | +```cli |
| 24 | +$ telepresence connect --docker |
| 25 | +Connected to context default (https://default.cluster.bakerstreet.io) |
| 26 | +
|
| 27 | +$ docker ps |
| 28 | +CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES |
| 29 | +7a0e01cab325 datawire/telepresence:2.12.1 "telepresence connec…" 18 seconds ago Up 16 seconds 127.0.0.1:58802->58802/tcp tp-default |
| 30 | +``` |
| 31 | + |
| 32 | +This method limits the scope of the potential networking issues since everything stays inside Docker. The Telepresence daemon can be found under the name `tp-<your-context>` when listing your containers. |
| 33 | + |
| 34 | +Start an intercept and a corresponding intercept-handler: |
| 35 | + |
| 36 | +```cli |
| 37 | +$ telepresence intercept echo-easy --port 8080:80 --docker-run -- jmalloc/echo-server |
| 38 | +Using Deployment echo-easy |
| 39 | + Intercept name : echo-easy |
| 40 | + State : ACTIVE |
| 41 | + Workload kind : Deployment |
| 42 | + Destination : 127.0.0.1:8080 |
| 43 | + Service Port Identifier: proxied |
| 44 | + Intercepting : all TCP requests |
| 45 | +Echo server listening on port 8080. |
| 46 | +``` |
| 47 | + |
| 48 | +Using `--docker-run` starts the local container that acts as the intercept handler so that it uses the same network as the container that runs the telepresence daemon. It will also |
| 49 | +have the remote volumes mounted in the same way as the remote container that it intercepts. |
| 50 | + |
| 51 | +If you want to curl your remote service, you'll need to do that from a container that shares the daemon container's network. You can find the network using `telepresence status`: |
| 52 | +```cli |
| 53 | +$ telepresence status | grep 'Container network' |
| 54 | + Container network : container:tp-default-default-cn |
| 55 | +``` |
| 56 | + |
| 57 | +Now curl with a `docker run` that uses that network: |
| 58 | +```cli |
| 59 | +$ docker run --network container:tp-default-default-cn --rm curlimages/curl echo-easy |
| 60 | + % Total % Received % Xferd Average Speed Time Time Time Current |
| 61 | + Dload Upload Total Spent Left Speed |
| 62 | +100 99 100 99 0 0 21104 0 --:--:-- --:--:-- -Request served by 4b225bc8d6f1 |
| 63 | +
|
| 64 | +GET / HTTP/1.1 |
| 65 | +
|
| 66 | +Host: echo-easy |
| 67 | +Accept: */* |
| 68 | +User-Agent: curl/8.6.0 |
| 69 | +-:--:-- 24750 |
| 70 | +``` |
| 71 | + |
| 72 | +Similarly, if you want to start your intercept handler manually using `docker run`, you must ensure that it shares the daemon container's network: |
| 73 | + |
| 74 | +```cli |
| 75 | +$ docker run \ |
| 76 | + --network=container:tp-default \ |
| 77 | + -e PORT=8080 jmalloc/echo-server |
| 78 | +Echo server listening on port 8080. |
| 79 | +``` |
| 80 | + |
| 81 | +### Tip. Use named connections |
| 82 | +You can use the `--name` flag to name the connection and get a shorter network name: |
| 83 | + |
| 84 | +``` |
| 85 | +$ telepresence quit |
| 86 | +$ telepresence connect --docker --name a |
| 87 | +``` |
| 88 | +Now, the network name will be `tp-a` instead of `tp-default-default-cn`. |
| 89 | + |
| 90 | +Naming is also very useful when you want to connect to several namespaces simultaneously, e.g. |
| 91 | + |
| 92 | +``` |
| 93 | +$ telepresence connect --docker --name alpha --namespace alpha |
| 94 | +$ telepresence connect --docker --name beta --namespace beta |
| 95 | +``` |
| 96 | + |
| 97 | +Now, with two connections active, you must pass the flag `--use <name pattern>` to other commands, e.g. |
| 98 | +``` |
| 99 | +$ telepresence intercept echo-easy --use alpha --port 8080:80 --docker-run -- jmalloc/echo-server |
| 100 | +``` |
| 101 | + |
| 102 | +## Key learnings |
| 103 | + |
| 104 | +* Using the Docker mode of telepresence **does not require root access**, and makes it **easier** to adopt it across your organization. |
| 105 | +* It **limits the potential networking issues** you can encounter. |
| 106 | +* It **limits the potential mount issues** you can encounter. |
| 107 | +* It **enables simultaneous intercepts in multiple namespaces**. |
| 108 | +* It leverages **Docker** for your interceptor. |
0 commit comments