[ Portainer ] [ 2.16.2.0 ] Simple management UI for Docker

[deiniolj]

Also had to re add the TLS certificate for Container Station back into Portainer. I'm back up and running.. Phew..

[stormer]

Hi deiniolj, Changed the port to 2376 as you suggested and ran the command: /share/CACHEDEV1_DATA/.qpkg/Portainer/Portainer.sh start
Here's the result (with fingerprint changed for xxx):

[~] # 2021/03/05 22:18:34 http error: endpoint snapshot error (endpoint=primary, URL=tcp://127.0.0.1:2376) (err=Error response from daemon: Client sent an HTTP request to an HTTPS server.)
2021/03/05 22:18:34 server: Reverse tunnelling enabled
2021/03/05 22:18:34 server: Fingerprint xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx
2021/03/05 22:18:34 server: Listening on 0.0.0.0:8000...
2021/03/05 22:18:34 listen tcp 0.0.0.0:8000: bind: address already in use

Trying to start Portainer from the webUI but still not making a connection on http://NASIP:9123/

[stormer]

Further to the above, in my initial installation of Portainer through the Qnapclubstore qpkg Portainer package, Portainer did not see the containers that I had already installed earlier with Container Station. Now that I had the above issue to get the Portainer qpkg to run after the Container Station as well as a QNAS Firmware upgrade, I removed the Portainer qpkg package and installed Portainer through ssh in de NAS and install Portainer through the CLI by running following commands:

docker volume create portainer_data
docker run -d -p 9000:9000 -p 8000:8000 --name portainer --restart always -v /var/run/docker.sock:/var/run/docker.sock -v portainer_data:/data portainer/portainer-ce

Now the fresh install of Portainer sees the containers that were previously installed via Container Station but does not see the Containers that have been installed via Portainer that was installed via qpkg from the Qnapclubstore.

I probably lack some conceptual Docker understanding here, but I would like to understand how this is possible. Do I need to add an Endpoint to see the Containers that have been installed with the Qnapclubstore qpkg version? If so, what would be the Endpoint information?

[jezd]

QNAP have just released yet another CS update - 'minor fixs) - I've not had a chance to test yet

Quick test done, no fix

[stormer]

Hi All,

I have lost access to containers that I have running on my system after having to reinstall Portainer. The two containers have been installed with Portainer but no longer appear in Container Station nor are they appearing in Portainer even though they are still running as I have web access to them. This happened after upgrade of QNAP firmware and new version of Container Station.

How can I kill these containers that still run on my system and remove them and reinstall them in the newly installed Portainer.

I have tried running command docker ps in ssh but it does not show the two containers that I am looking to kill and reinstall.

Thx

[QNAP_Stephane]

updated

[nasaes]

Hi,
Same problem here.
I have updated to 2.5.1 version, updated portainer.sh to use port 2377, changed endpoint port and restarded nas.
What I think understand is:
- we have 2 daemon of docker, 1 used by container station and the other one by portainer qnap pkg.
daemon for CS use -H unix:///var/run/system-docker.sock and Portainer use -H tcp://0.0.0.0:2376 -H unix:///var/run/docker.sock
Is that correct ?

[QNAP_Stephane]

portainer need to connect to docker port 2376

[nasaes]

Hi Stephane,
I have changed to port 2376 but same error: "Failed loading endpoint. Unable to connect to the Docker endpoint"
My setting on portainer for endpoint url is 127.0.0.1:2376.
Any ideas ?

[QNAP_Stephane]

let me check ... may be due to socket name changed

[Coberras]

Hello, update possible?? Latest version is 2.9.1

[QNAP_Stephane]

Updated

be careful, not sure if it can impact on upgrade

now it uses UNIX socket to connect to docker, and template scheme force has been removed

[Coberras]

Upgraded to 2.9.1. Everythings seems to be fine.
Thanks!

[paponius]

Two "environments"

There is a confusion about seeing or not seeing Images and Containers seen in CS (Container Station)

Below I show how both can be added.
Purpose of portainer.io is to manage multiple dockers in one place, QNAP has two so why not do that.

QNAP runs two dockers.
One is for users where CS is creating Images and Containers and where Containers and Images are created using directly docker CLI on QNAP through SSH.
Second is for internal QNAP use, where Containers like "Browser Station QNAP App" exists.
The second one is not exposed to the user by Container Station.

We can get better understanding by looking at how both are started:

container-station/dockerd
-H tcp://0.0.0.0:2376
-H unix:///var/run/docker.sock
--bridge=lxcbr0
--tlsverify
--tlscacert=/etc/docker/tls/ca.pem
--tlscert=/etc/docker/tls/server.pem
--tlskey=/etc/docker/tls/server-key.pem
--storage-driver=overlay2
--dns 10.0.3.1
--data-root=/var/lib/docker
--exec-root=/var/run/docker
--pidfile=/var/run/docker.pid
-D
--userland-proxy=false
--config-file /share/CACHEDEV1_DATA/.qpkg/container-station/etc/docker.json

container-station/dockerd
-H unix:///var/run/system-docker.sock
--bridge=docker0
--storage-driver=overlay
--dns 10.0.5.1
--data-root=/var/lib/system-docker
--exec-root=/var/run/system-docker
--pidfile=/var/run/system-docker.pid
-D
--userland-proxy=false
--config-file /share/CACHEDEV1_DATA/.qpkg/container-station/etc/system-docker.json


The user's docker is accessible by both unix socket and TCP with TLS and there is no plain 2375 anymore. System's docker has only the unix socket.
You can see paths to TLS pem files, they are those exact files you can download from CS interface.

It also explains a confusion I encountered lately about Docker Containers using lxcbr0 network interface and not docker0. The later being used by the "system" docker and not visible even in "QTS > Control Panel > Network & Virtual Switch"


How can both be added

portainer.io > Environments > Add Environment > Environment type: Docker (blue button) >
Name: ANY_NAME (e.g. system, or container station)
Connect via socket: ON
Override default socket path: ON
Socket path: /var/run/system-docker.sock
or /var/run/docker.sock, depending on what your "primary" already is.

I did not find good way of automating the process.
1. parameter 'portainer -H' does not accept two values.
https://docs.portainer.io/v/ce-2.9/advanced/cli
Killing and restarting portainer with second -H will not help, -H is processed only once per install.
It's ignored on second and consequent start. (or until deletion of data dir)

2. pre-creating ./Portainer/data/portainer.db would probably work, but it's doubtfully a good idea to have pre generated password and instance ID common for all QNAP users.

3. Using API seems doable, but complicated
https://docs.portainer.io/v/ce-2.9/admi ... ts/add/api
User must be created, with OAuth, and maybe it can't be removed again using this API after finishing this init.


Many questions here are about struggle to connect using TCP with TLS
Is there a reason to use tcp:// when unix socket is available? It's the same machine, or even in a variation where portainer runs from docker, the socket can be mounted.


Limited user (vs root)
As is customary in QPKG apps, portainer runs as root (renamed admin)
I try to create dedicated "disabled" users without login for the purpose of running programs which expose a port. like: '[App_portainer]' user
I did change group on both /var/run/*docker.sock and files in ./.qpkg/Portainer to include this new user '[App_portainer]'
Started portainer using: sudo --user='[App_portainer]' --preserve-env ./portainer --bind=":9123" --data="${QPKG_ROOT}/data" -H unix:///var/run/docker.sock

It seems to work OK so far.

[Coberras]

Hello, anyone tried to deploy portainer agent in Qnap? I have got multiple instances of portainers on linux machines and qnap NAS and would like to manage them all from one portainer server instance outside qnap.