Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Traefik, Now With Native Go Plugins

traefik.io

Post reply on HN
Print view View original

11–20 of 65 posts

Re: Traefik, Now With Native Go Plugins

#11

Post by alufers »

sagichmal wrote: post #8

> Rather than being pre-compiled and linked, however, plugins are executed on the fly by Yaegi, an embedded Go interpreter. Woof, no thank you. Go is basically incompatible with any kind of plugin-like dynamic linking. There are basically two reasonable models for doing something like plugins: the HashiCorp model, where plugins are actually separate processes that do some kind of intra-process communication with the…

There is the "plugin" package which seems really cool and fits the simplistic style of Go (tbh I haven't tried this module myself, only glanced at the documentation), but it does not work on Windows, which I think is the reason it is not used. The ticket about adding Windows support to the plugin package is one of the highest rated ones on Go's GitHub, yet it is still open.

Re: Traefik, Now With Native Go Plugins

#13

Post by kayson »

codethief wrote: post #3

I've been wanting to use Traefik for a long time but there's this security issue[0] that's almost two(!) years old now that's been keeping me from deploying it in production. As far as I can tell, there's still no out-of-the-box solution that's not overly complicated and won't come back to haunt me a year or two from now. [0] https://github.com/traefik/traefik/issues/4174 [1] https://doc.traefik.io/traefik/providers/…

This is very easily solved by using a proxy for the docker socket:

https://github.com/Tecnativa/docker-socket-proxy

https://github.com/traefik/traefik/issues/4174#issuecomment-

Create a private network that only connects Traefik and the proxy, and limit Traefik's access to only the GET requests it needs to operate. Now the socket is only exposed to a local container.

Re: Traefik, Now With Native Go Plugins

#14

Post by Spivak »

emilevauge wrote: post #7
codethief wrote: post #3

I've been wanting to use Traefik for a long time but there's this security issue[0] that's almost two(!) years old now that's been keeping me from deploying it in production. As far as I can tell, there's still no out-of-the-box solution that's not overly complicated and won't come back to haunt me a year or two from now. [0] https://github.com/traefik/traefik/issues/4174 [1] https://doc.traefik.io/traefik/providers/…

This security issue is not that simple to manage as you probably know. It's mainly due to the fact that there is now way to have authorization on the the docker API. This is not the case on Kubernetes for example where you have RBAC to prevent this kind of issue. We have described this in detail in our documentation, and you have many solutions/workarounds to address this: https://doc.traefik.io/traefik/providers/doc…

Yeah, I'm surprised that this is such a sticking point. There's nothing that anyone who isn't Docker Inc. can do to fix the problem that, by default, Docker is all or nothing. It would be nice if Docker could expose a read-only endpoint but c'est la vie.

The only solution I've seen/used that wasn't convoluted or brittle is running a little daemon to just shovel container metadata into Consul and going from there.

Re: Traefik, Now With Native Go Plugins

#17

Post by saurik »

sagichmal wrote: post #8

> Rather than being pre-compiled and linked, however, plugins are executed on the fly by Yaegi, an embedded Go interpreter. Woof, no thank you. Go is basically incompatible with any kind of plugin-like dynamic linking. There are basically two reasonable models for doing something like plugins: the HashiCorp model, where plugins are actually separate processes that do some kind of intra-process communication with the…

How can they possibly be calling this "native"? :/

Re: Traefik, Now With Native Go Plugins

#20

Post by JanMa »

I am really happy to finally see them adding some functionality to add custom middlewares to Traefik. However it leaves a bad taste in my mouth that in order to use it, you have to sign up to their new SaaS. Especially when keeping in mind that this is the "most requested feature" of the community.
Post reply on HN