How to deploy Portainer stack inside Docker Swarm cluster

Deploy Portainer stack inside the Docker Swarm cluster.

Initial information

Docker version.

$ docker version

Client:
 Version:           19.03.8
 API version:       1.40
 Go version:        go1.13.8
 Git commit:        afacb8b7f0
 Built:             Tue Jun 23 22:26:12 2020
 OS/Arch:           linux/amd64
 Experimental:      false
Server:
 Engine:
  Version:          19.03.8
  API version:      1.40 (minimum version 1.12)
  Go version:       go1.13.8
  Git commit:       afacb8b7f0
  Built:            Thu Jun 18 08:26:54 2020
  OS/Arch:          linux/amd64
  Experimental:     false
 containerd:
  Version:          1.3.3-0ubuntu2
  GitCommit:
 runc:
  Version:          spec: 1.0.1-dev
  GitCommit:
 docker-init:
  Version:          0.18.0
  GitCommit:

Cluster details.

$ docker node ls

ID                            HOSTNAME            STATUS              AVAILABILITY        MANAGER STATUS      ENGINE VERSION
wholwgyqszoxv644ryv5xxuyf     swarm-cerberus      Ready               Active                                  19.03.8
medtf6p57iirdou5evwt6rmwr *   swarm-hydra         Ready               Active              Leader              19.03.8
td230ieplzm6z1uhszbrom8vr     swarm-kraken        Ready               Active                                  19.03.8

Portainer stack configuration

Define environment variables using portainer-stack.env configuration file.

$ cat portainer-stack.env

AGENT_TOKEN=$(openssl rand -base64 16)

Define stack using portainer-stack.yml YAML file.

$ cat portainer-stack.yml

version: '3.4'
services:
  agent:
    image: portainer/agent
    env_file: portainer-stack.env
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - /var/lib/docker/volumes:/var/lib/docker/volumes
    networks:
      - portainer_agent
    deploy:
      mode: global
      placement:
        constraints:
          - "node.platform.os == linux"
  manager:
    image: portainer/portainer
    command: -H tcp://tasks.agent:9001 --tlsskipverify
    env_file: portainer-stack.env
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - portainer_data:/data
    ports:
      - target: 9000          # for user interface
        published: 9000
        protocol: tcp
        mode: host
        # - target: 8000      # for EDGE agent
        #   published: 8000
        #   protocol: tcp
        #   mode: host
    networks:
      - portainer_agent
    deploy:
      placement:
        constraints:
          - "node.platform.os == linux"
          - "node.role == manager"
          - "node.hostname == swarm-hydra"
volumes:
  portainer_data:
networks:
  portainer_agent:
    driver: overlay
    attachable: true

Change swarm-hydra manager node name to reflect your configuration.

Play with the stack

Deploy Portainer stack.

$ docker stack deploy --compose-file=portainer-stack.yml container_management

Creating network container_management_portainer_agent
Creating service container_management_agent
Creating service container_management_manager

List stacks.

$ docker stack ls

NAME                   SERVICES            ORCHESTRATOR
container_management   2                   Swarm

Display stack services.

$ docker stack services container_management

ID                  NAME                           MODE                REPLICAS            IMAGE                        PORTS
5rw7smlcgo9j        container_management_manager   replicated          1/1                 portainer/portainer:latest
q7g6w3x2cujb        container_management_agent     global              3/3                 portainer/agent:latest

Display stack tasks.

$ docker stack ps container_management

ID                  NAME                                                   IMAGE                        NODE                DESIRED STATE       CURRENT STATE           ERROR               PORTS
wn2tihvxlhj5        container_management_agent.wholwgyqszoxv644ryv5xxuyf   portainer/agent:latest       swarm-cerberus      Running             Running 3 minutes ago
963x6kpq39ma        container_management_agent.td230ieplzm6z1uhszbrom8vr   portainer/agent:latest       swarm-kraken        Running             Running 3 minutes ago
icg69pmacnn1        container_management_agent.medtf6p57iirdou5evwt6rmwr   portainer/agent:latest       swarm-hydra         Running             Running 3 minutes ago
slnadoef7jn0        container_management_manager.1                         portainer/portainer:latest   swarm-hydra         Running             Running 3 minutes ago                       *:9000->9000/tcp

Remove stack.

$ docker stack rm container_management

Removing service container_management_agent
Removing service container_management_manager
Removing network container_management_portainer_agent

Remove volume used by this stack.

$ docker volume rm container_management_portainer_data

container_management_portainer_data

Reverse proxy

Basic HAProxy configuration.

[...]
frontend web-frontend
  bind 1.2.3.4:443 ssl crt /etc/haproxy/ssl/cloudflare.pem
  mode http
  acl is-swarm-manager  hdr(host) -i portainer.example.org
  default_backend no-match
[...]
backend backend-local-portainer
  server swarm-manager 172.16.0.10:9000 check
[...]
backend no-match
  http-request deny deny_status 400

Read How can I configure ngnix/traefik reverse proxy to serve Portainer? for more information.

Issues

I have experienced two issues. The first one was described in Consoles don’t work over nginx reverse proxy and produce 401 #3538 bug report as access to container console does not work over a reverse proxy. The second one is related to authentication, as the internal authentication mechanism does not work with the basic auth requirement added by HAProxy or Nginx.