"Safe" Traefik

docker-compose.yml

version: '3.4'

networks:
  front:
  docker-sock:

services:
  lb:
    image: traefik:1.7.11
    command:
      - "--docker.swarmmode"
      - "--docker.watch"
      - "--docker.domain=localhost"
      - "--docker.endpoint=tcp://docker-forwarder:2375"
      - "--api"
      - "--entrypoints=Name:http Address::8000"
    read_only: true
    networks:
      - "front"
      - "docker-sock"
    ports:
      - "80:8000"
      - "8080:8080"
    user: 1001:1001
    deploy:
      labels:
        - "traefik.enable=false"
      placement:
        constraints:
          - node.role == worker

  whoami:
    image: containous/whoami
    networks:
      - "front"
    deploy:
      placement:
        constraints:
          - node.role == worker
      mode: replicated
      replicas: 2
      labels:
        - "traefik.enable=true"
        - "traefik.frontend.rule=Host:localhost;Path:/whoami"
        - "traefik.port=80"

  swarm-viz:
    image: dockersamples/visualizer
    ports:
      - "9080:8080"
    deploy:
      labels:
        - "traefik.enable=false"
      placement:
        constraints:
          - node.role == manager
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock

  docker-forwarder:
    image: alpine/socat:1.0.3
    read_only: true
    networks:
      - "docker-sock"
    labels:
      - "traefik.enable=false"
    command: tcp-listen:2375,reuseaddr,fork unix:/docker.sock
    deploy:
      placement:
        constraints:
          - node.role == manager
    volumes:
      - /var/run/docker.sock:/docker.sock