Failed to setup daemon for nextcloud within docker and direkt access to docker socket.

[StefanRichterHuber]

Describe the bug

I am running nextcloud successfully using docker and traefik as reverse-proxy for ssl and routing.
The docker host machine is a QNAP ARM64 NAS.
To install App_Api I added the docker socket as proxy as volume to the nextcloud container. I also added an additional docker network for the apps.

networks:
  web:
    external: true
  nextcloud-apps:
    external: true
 app:
    image: nextcloud:27
    depends_on:
      - database
      - redis-nextcloud
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - nextcloud:/var/www/html
    env_file:
      ... Reference to local env file
    ports:
      - 8085:80
    restart: always
    labels:
    ... Removed traefik config
    networks:
      - web
      - default
      - nextcloud-apps

Then I added a deamon r:
occ app_api:daemon:register --net nextcloud-apps --set-default docker_local_sock "Local docker" docker-install unix-socket /var/run/docker.sock https://nextcloud.[mydomain].de

Results in:
Daemon successfully registered.

Within the admin ui I try to verify the connection, but get an error: Failed to connect to Daemon. Check the logs.

Does not work with host network either.

Steps/Code to Reproduce

See above

Expected Results

Successful connection to AppAPI daemon

Actual Results

[app_api] Fehler: GuzzleHttp\Exception\ConnectException: cURL error 7: Failed to connect to localhost port 80 after 0 ms: Couldn't connect to server (see https://curl.haxx.se/libcurl/c/libcurl-errors.html) for http://localhost/v1.41/_ping at <>

0. /var/www/html/3rdparty/guzzlehttp/guzzle/src/Handler/CurlFactory.php line 158
   GuzzleHttp\Handler\CurlFactory::createRejection("*** sensitive parameters replaced ***")
1. /var/www/html/3rdparty/guzzlehttp/guzzle/src/Handler/CurlFactory.php line 110
   GuzzleHttp\Handler\CurlFactory::finishError(["GuzzleHttp\Handler\CurlHandler"], "*** sensitive parameters replaced ***", ["GuzzleHttp\Handler\CurlFactory"])
2. /var/www/html/3rdparty/guzzlehttp/guzzle/src/Handler/CurlHandler.php line 47
   GuzzleHttp\Handler\CurlFactory::finish(["GuzzleHttp\Handler\CurlHandler"], "*** sensitive parameters replaced ***", ["GuzzleHttp\Handler\CurlFactory"])
3. /var/www/html/3rdparty/guzzlehttp/guzzle/src/Handler/Proxy.php line 28
   GuzzleHttp\Handler\CurlHandler->__invoke("*** sensitive parameters replaced ", " sensitive parameters replaced ***")
4. /var/www/html/3rdparty/guzzlehttp/guzzle/src/Handler/Proxy.php line 48
   GuzzleHttp\Handler\Proxy::GuzzleHttp\Handler{closure}("*** sensitive parameters replaced ***")
5. /var/www/html/3rdparty/guzzlehttp/guzzle/src/PrepareBodyMiddleware.php line 35
   GuzzleHttp\Handler\Proxy::GuzzleHttp\Handler{closure}("*** sensitive parameters replaced ***")
6. /var/www/html/3rdparty/guzzlehttp/guzzle/src/Middleware.php line 31
   GuzzleHttp\PrepareBodyMiddleware->__invoke("*** sensitive parameters replaced ", " sensitive parameters replaced ***")
7. /var/www/html/3rdparty/guzzlehttp/guzzle/src/RedirectMiddleware.php line 71
   GuzzleHttp\Middleware::GuzzleHttp{closure}("*** sensitive parameters replaced ***")
8. /var/www/html/3rdparty/guzzlehttp/guzzle/src/Middleware.php line 63
   GuzzleHttp\RedirectMiddleware->__invoke("*** sensitive parameters replaced ", " sensitive parameters replaced ***")
9. /var/www/html/3rdparty/guzzlehttp/guzzle/src/HandlerStack.php line 75
   GuzzleHttp\Middleware::GuzzleHttp{closure}("*** sensitive parameters replaced ***")
10. /var/www/html/3rdparty/guzzlehttp/guzzle/src/Client.php line 331
    GuzzleHttp\HandlerStack->__invoke("*** sensitive parameters replaced ", " sensitive parameters replaced ***")
11. /var/www/html/3rdparty/guzzlehttp/guzzle/src/Client.php line 168
    GuzzleHttp\Client->transfer("*** sensitive parameters replaced ", " sensitive parameters replaced ***")
12. /var/www/html/3rdparty/guzzlehttp/guzzle/src/Client.php line 187
    GuzzleHttp\Client->requestAsync("*** sensitive parameters replaced ***")
13. /var/www/html/3rdparty/guzzlehttp/guzzle/src/ClientTrait.php line 44
    GuzzleHttp\Client->request("*** sensitive parameters replaced ***", "http://localhost/v1.41/_ping", [true])
14. /var/www/html/custom_apps/app_api/lib/DeployActions/DockerActions.php line 283
    GuzzleHttp\Client->get("http://localhost/v1.41/_ping")
15. /var/www/html/custom_apps/app_api/lib/Controller/DaemonConfigController.php line 104
    OCA\AppAPI\DeployActions\DockerActions->ping("http://localhost")
16. /var/www/html/lib/private/AppFramework/Http/Dispatcher.php line 230
    OCA\AppAPI\Controller\DaemonConfigController->verifyDaemonConnection("docker_local")
17. /var/www/html/lib/private/AppFramework/Http/Dispatcher.php line 137
    OC\AppFramework\Http\Dispatcher->executeController(["OCA\AppAPI\C ... "], "verifyDaemonConnection")
18. /var/www/html/lib/private/AppFramework/App.php line 183
    OC\AppFramework\Http\Dispatcher->dispatch(["OCA\AppAPI\C ... "], "verifyDaemonConnection")
19. /var/www/html/lib/private/Route/Router.php line 315
    OC\AppFramework\App::main("OCA\AppAPI\Co ... r", "verifyDaemonConnection", ["OC\AppFramewo ... "], ["docker_local", ... "])
20. /var/www/html/lib/base.php line 1068
    OC\Route\Router->match("/apps/app_api/d ... k")
21. /var/www/html/index.php line 36
    OC::handleRequest()

POST /apps/app_api/daemons/docker_local/check
from 93.104.100.117 by admin at 2023-12-15T06:25:27+00:00

Setup configuration

nextcloud = 27.1.4 appApi=1.4.2

[andrey18106]

@StefanRichterHuber Hi! Have you recreated nextcloud docker container after adding docker socket volume? And have you verified the access rights to this docker socket by webserver user?

[StefanRichterHuber]

@StefanRichterHuber Hi! Have you recreated nextcloud docker container after adding docker socket volume? And have you verified the access rights to this docker socket by webserver user?

Thanks for your response. Yes I recreated the container after adding the socket volume. But you are right, it was a permission issue. The www-data user is not allowed to use the socket directly. Since I am not aware of any elegant ways to fix that, I will have to try docker-socket-proxy again, although I had SSL issues the last time I tried. This works after sorting out syntax issues with registering the proxy.

[bigcat88]

please inform us about the progress, if something is not clear, we will update documentations or write a new article in documentation for this, as we are interested in a smooth install and easy use process

[StefanRichterHuber]

please inform us about the progress, if something is not clear, we will update documentations or write a new article in documentation for this, as we are interested in a smooth install and easy use process

The problem was simple: Upon registration of the daemon i prefixed the address of the proxy with the protocol e.g. tcp://docker-proxy:2375 or http://docker-proxy:2375. Both results in odd SSL errors during testing the connection. When just using plain docker-proxy:2375 and protocol http it works flawlessly.
Now I have a docker daemon (with the to gif example) and a manual install daemon successfully running for a local dev environment where I currently build my first ExApp. During the dev process I found some ambiguity in the dev documentation for ExApps, are you interested in tickets on that?

Edit: The ExApp UI Register deploy daemon within Nextcloud also indicates to prefix the host with http, which might be misleading.

Edit log of the error:

{"reqId":"hWJCNmcnSElmQqpe9SMS","level":3,"time":"2023-12-18T06:36:58+00:00","remoteAddr":"93.104.121.131","user":"admin","app":"index","method":"POST","url":"/apps/app_api/daemons/docker_local44/check","message":"Exception thrown: InvalidArgumentException","userAgent":"Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/119.0","version":"27.1.5.1","exception":{"Exception":"InvalidArgumentException","Message":"SSL certificate not found: ","Code":0,"Trace":[{"file":"/var/www/html/3rdparty/guzzlehttp/guzzle/src/Handler/CurlFactory.php","line":59,"function":"applyHandlerOptions","class":"GuzzleHttp\\Handler\\CurlFactory","type":"->","args":[["GuzzleHttp\\Handler\\EasyHandle",null,["GuzzleHttp\\Psr7\\Stream"],[],null,"*** sensitive parameters replaced ***","*** sensitive parameters replaced ***",0,null,null],[[["GuzzleHttp/7"],["http"]],"*** sensitive parameters replaced ***","http://http//docker-proxy:2357/v1.41/_ping",false,false,150,3,2,2,true,"/var/www/html/data/files_external/rootcerts.crt","",["Accept-Encoding:"],["Closure"],""]]},{"file":"/var/www/html/3rdparty/guzzlehttp/guzzle/src/Handler/CurlHandler.php","line":43,"function":"create","class":"GuzzleHttp\\Handler\\CurlFactory","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/html/3rdparty/guzzlehttp/guzzle/src/Handler/Proxy.php","line":28,"function":"__invoke","class":"GuzzleHttp\\Handler\\CurlHandler","type":"->","args":["*** sensitive parameters replaced ***","*** sensitive parameters replaced ***"]},{"file":"/var/www/html/3rdparty/guzzlehttp/guzzle/src/Handler/Proxy.php","line":48,"function":"GuzzleHttp\\Handler\\{closure}","class":"GuzzleHttp\\Handler\\Proxy","type":"::","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/html/3rdparty/guzzlehttp/guzzle/src/PrepareBodyMiddleware.php","line":35,"function":"GuzzleHttp\\Handler\\{closure}","class":"GuzzleHttp\\Handler\\Proxy","type":"::","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/html/3rdparty/guzzlehttp/guzzle/src/Middleware.php","line":31,"function":"__invoke","class":"GuzzleHttp\\PrepareBodyMiddleware","type":"->","args":["*** sensitive parameters replaced ***","*** sensitive parameters replaced ***"]},{"file":"/var/www/html/3rdparty/guzzlehttp/guzzle/src/RedirectMiddleware.php","line":71,"function":"GuzzleHttp\\{closure}","class":"GuzzleHttp\\Middleware","type":"::","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/html/3rdparty/guzzlehttp/guzzle/src/Middleware.php","line":63,"function":"__invoke","class":"GuzzleHttp\\RedirectMiddleware","type":"->","args":["*** sensitive parameters replaced ***","*** sensitive parameters replaced ***"]},{"file":"/var/www/html/3rdparty/guzzlehttp/guzzle/src/HandlerStack.php","line":75,"function":"GuzzleHttp\\{closure}","class":"GuzzleHttp\\Middleware","type":"::","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/html/3rdparty/guzzlehttp/guzzle/src/Client.php","line":331,"function":"__invoke","class":"GuzzleHttp\\HandlerStack","type":"->","args":["*** sensitive parameters replaced ***","*** sensitive parameters replaced ***"]},{"file":"/var/www/html/3rdparty/guzzlehttp/guzzle/src/Client.php","line":168,"function":"transfer","class":"GuzzleHttp\\Client","type":"->","args":["*** sensitive parameters replaced ***","*** sensitive parameters replaced ***"]},{"file":"/var/www/html/3rdparty/guzzlehttp/guzzle/src/Client.php","line":187,"function":"requestAsync","class":"GuzzleHttp\\Client","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/html/3rdparty/guzzlehttp/guzzle/src/ClientTrait.php","line":44,"function":"request","class":"GuzzleHttp\\Client","type":"->","args":["*** sensitive parameters replaced ***","http://http://docker-proxy:2357/v1.41/_ping",[true]]},{"file":"/var/www/html/custom_apps/app_api/lib/DeployActions/DockerActions.php","line":283,"function":"get","class":"GuzzleHttp\\Client","type":"->","args":["http://http://docker-proxy:2357/v1.41/_ping"]},{"file":"/var/www/html/custom_apps/app_api/lib/Controller/DaemonConfigController.php","line":104,"function":"ping","class":"OCA\\AppAPI\\DeployActions\\DockerActions","type":"->","args":["http://http://docker-proxy:2357"]},{"file":"/var/www/html/lib/private/AppFramework/Http/Dispatcher.php","line":230,"function":"verifyDaemonConnection","class":"OCA\\AppAPI\\Controller\\DaemonConfigController","type":"->","args":["docker_local44"]},{"file":"/var/www/html/lib/private/AppFramework/Http/Dispatcher.php","line":137,"function":"executeController","class":"OC\\AppFramework\\Http\\Dispatcher","type":"->","args":[["OCA\\AppAPI\\Controller\\DaemonConfigController"],"verifyDaemonConnection"]},{"file":"/var/www/html/lib/private/AppFramework/App.php","line":183,"function":"dispatch","class":"OC\\AppFramework\\Http\\Dispatcher","type":"->","args":[["OCA\\AppAPI\\Controller\\DaemonConfigController"],"verifyDaemonConnection"]},{"file":"/var/www/html/lib/private/Route/Router.php","line":315,"function":"main","class":"OC\\AppFramework\\App","type":"::","args":["OCA\\AppAPI\\Controller\\DaemonConfigController","verifyDaemonConnection",["OC\\AppFramework\\DependencyInjection\\DIContainer"],["docker_local44","app_api.DaemonConfig.verifyDaemonConnection"]]},{"file":"/var/www/html/lib/base.php","line":1068,"function":"match","class":"OC\\Route\\Router","type":"->","args":["/apps/app_api/daemons/docker_local44/check"]},{"file":"/var/www/html/index.php","line":38,"function":"handleRequest","class":"OC","type":"::","args":[]}],"File":"/var/www/html/3rdparty/guzzlehttp/guzzle/src/Handler/CurlFactory.php","Line":460,"CustomMessage":"Exception thrown: InvalidArgumentException"},"id":"657fe893e3f24"}

[bigcat88]

Upon registration of the daemon i prefixed the address of the proxy with the protocol e.g. tcp://docker-proxy:2375 or http://docker-proxy:2375.

We will add a check for prefixes a bit later, to clearly display error that describes that prefix is not needed.
Thank you.

During the dev process I found some ambiguity in the dev documentation for ExApps, are you interested in tickets on that?

Of course yes, we are free for issues, prs and criticism.

[bigcat88]

we added a check to ensure that the daemon host does not start with a protocol, can we close this issue and marked as resolved?

It is better to create separate issues or discussions for all new questions