Docker apps on Fangtooth - separate IP?

Apps and Virtualization
,
1

I haven’t quite followed all the discussion of per-app IPs, and don’t recall seeing discussion about Docker apps outside of the catalog–if I’ve missed it, please point me in the right direction.

tl;dr: I’d like for my apps to listen on a different IP than the TrueNAS UI. They can all be on the same IP for all I care, just not on the same one as the TrueNAS UI.

I’m currently running the Dockge app, with everything else (including Traefik) as a compose stack managed by Dockge. This means that the TrueNAS UI needs to listen on non-standard ports, and Traefik needs to be up and running (and suitably configured) to access the UI on standard ports. My main purpose is to move Traefik to its own IP so that this isn’t necessary. I’d prefer Dockge itself also be on a different IP than the TrueNAS UI, but that isn’t critical. So, questions:

  • Is this arrangement currently possible under Fangtooth?
    • If so, how?
  • If not, will that change next month with the release of apps supporting per-app IPs?
2

I’ve never tried myself, but you should be able to add a macvlan to your compose files like this

networks:
      macvlan_network:
          driver: macvlan
          driver_opts:
              parent: eth0
          ipam:
            config:
                - 
                  subnet: 192.168.88.0/24
                  gateway: 192.168.88.1
1 Like
3

I have the same goal, all my apps on a single separate IP.

As far as I can tell the status is the following:

Not supported, but doable with something like @Stux explained here.

No, unfortunately not, the coming change is to apps in the catalogue only:

4

The change allows apps to bind to ip aliases

Custom compose can already do this.

1 Like
5

Thank you.
Is your linked post still the way you recommend doing that, or is there a method that doesn’t involve running docker and ip link commands manually in the shell? (ip link-ing only required if you want inter-app communication)

6

I’m tracking this closely also, and have already discovered a few apps with IP support added.

After June 1st’s upgrade, it will be a native option in the catalog apps, from what I understand. You add an extra IP, or 2, or 5, to your main host ip in the networking section. Then, those aliases will be available in the GUI for apps that support it.

This is what it looks like for mariadb right now, in the GUI:

image
image336×461 5.13 KB

There are workarounds as mentioned, but this is much more native support, closer to what I would expect, coming from Core 13. I don’t know if you can pick the same IP over and over for all your apps as some have requested. Doesn’t make sense to me but I’m sure there are valid reasons. One app, one address, keeps it simple on my LAN.

7

If you want to give an app its own IP, much like how a VM would have its own IP, or a jail, then the MACVLAN approach is the way.

If you want to just bind an app’s port to a specific IP, which is often times sufficient then just use the format

<ip>:<external port>:<internal port> when defining the port maps.

IP has to be an IP Alias

1 Like
8

OK, so let’s talk specifics. The NAS is on 192.168.1.10. I’ve also set 192.168.1.11 as an alias on that interface. If I’m understanding you correctly, I can set the GUI to listen only on 192.168.1.10 (which I’ve already done), and then set this in my Traefik compose file:

    ports:
      - 192.168.1.11:80:80
      - 192.168.1.11:443:443/tcp # Uncomment if you want HTTP3
      - 192.168.1.11:443:443/udp # Uncomment if you want HTTP3

Right? I don’t think the separate lines for TCP and UDP are necessary; they were in the sample I copied.

1 Like
9

This is blowing my mind.

It does appear to work when I try it with Nginx Proxy Manager in a 25.04 VM, setup exactly as @dan says with an alias, TN webgui on a specific port on a different alias and so on (can’t speak to the tcp/udp part though).

Still need to test inter-app communication.

10

Yes. This should work, and AFAIK, is basically what the new App IP feature is. Essentially by default “0.0.0.0” is used, which means “bind to all IPs”

Also, I do think the tcp/udp is necessary, as by default, I think only the TCP port is bound, but I haven’t bothered to confirm that for you :wink:

11

The apps can communicate through the IP if they want… or if they share a bridge

12

I’d like to hear of any experiences using the Ip alias binding for the newer Apps that support it already. That will be the same experience for all other Apps… so early feedback is useful.

13

If you’re taking requests, add that feature to qbittorrent and sonarr and I’ll check it out. I have it on mariadb and homarr so far but haven’t configured either one enough to have an opinion.

14

AFAIK, those apps have been around a while and will only convert on June 1st

15

There’s a list of apps that currently support it here (click Read More on the Support Timeline): https://www.truenas.com/docs/scale/25.04/gettingstarted/scalereleasenotes/#truenas-apps.

Any apps that existed in the catalog before December 24, 2024 can’t have the feature enabled without a breaking change affecting the migration script, which is why the June 1 switchover is scheduled.