Traefik not picking up changes via socket

[chris42]

Hi there,
I am trying a traefik setup on podman and for some reason traefik is not picking up on new containers. The configuration works if used in docker, however not with podman. Everything seems to be configured properly, however no result. Would really appreciate some help on debugging this.

What I have so far. any help would be appreciated

(podman info)

host:
  arch: amd64
  buildahVersion: 1.33.5
  cgroupControllers:
  - cpu
  - memory
  - pids
  cgroupManager: systemd
  cgroupVersion: v2
  conmon:
    package: conmon_2.1.6+ds1-1_amd64
    path: /usr/bin/conmon
    version: 'conmon version 2.1.6, commit: unknown'
  cpuUtilization:
    idlePercent: 98.82
    systemPercent: 0.27
    userPercent: 0.91
  cpus: 12
  databaseBackend: sqlite
  distribution:
    codename: bookworm
    distribution: debian
    version: "12"
  eventLogger: journald
  freeLocks: 2048
  hostname: diskstation
  idMappings:
    gidmap:
    - container_id: 0
      host_id: 121
      size: 1
    - container_id: 1
      host_id: 100000
      size: 65536
    uidmap:
    - container_id: 0
      host_id: 108
      size: 1
    - container_id: 1
      host_id: 100000
      size: 65536
  kernel: 6.1.0-18-amd64
  linkmode: dynamic
  logDriver: journald
  memFree: 24601681920
  memTotal: 32904675328
  networkBackend: netavark
  networkBackendInfo:
    backend: netavark
    dns:
      package: aardvark-dns_1.4.0-3_amd64
      path: /usr/lib/podman/aardvark-dns
      version: aardvark-dns 1.4.0
    package: netavark_1.4.0-3_amd64
    path: /usr/lib/podman/netavark
    version: netavark 1.4.0
  ociRuntime:
    name: runc
    package: containerd.io_1.6.28-2_amd64
    path: /usr/bin/runc
    version: |-
      runc version 1.1.12
      commit: v1.1.12-0-g51d5e94
      spec: 1.0.2-dev
      go: go1.21.8
      libseccomp: 2.5.4
  os: linux
  pasta:
    executable: /usr/bin/pasta
    package: passt_0.0~git20230309.7c7625d-1_amd64
    version: |
      pasta unknown version
      Copyright Red Hat
      GNU Affero GPL version 3 or later <https://www.gnu.org/licenses/agpl-3.0.html>
      This is free software: you are free to change and redistribute it.
      There is NO WARRANTY, to the extent permitted by law.
  remoteSocket:
    exists: true
    path: /run/user/108/podman/podman.sock
  security:
    apparmorEnabled: false
    capabilities: CAP_CHOWN,CAP_DAC_OVERRIDE,CAP_FOWNER,CAP_FSETID,CAP_KILL,CAP_NET_BIND_SERVICE,CAP_SETFCAP,CAP_SETGID,CAP_SETPCAP,CAP_SETUID,CAP_SYS_CHROOT
    rootless: true
    seccompEnabled: true
    seccompProfilePath: /usr/share/containers/seccomp.json
    selinuxEnabled: false
  serviceIsRemote: false
  slirp4netns:
    executable: /usr/bin/slirp4netns
    package: slirp4netns_1.2.0-1_amd64
    version: |-
      slirp4netns version 1.2.0
      commit: 656041d45cfca7a4176f6b7eed9e4fe6c11e8383
      libslirp: 4.7.0
      SLIRP_CONFIG_VERSION_MAX: 4
      libseccomp: 2.5.4
  swapFree: 1023406080
  swapTotal: 1023406080
  uptime: 12h 14m 47.00s (Approximately 0.50 days)
  variant: ""
plugins:
  authorization: null
  log:
  - k8s-file
  - none
  - passthrough
  - journald
  network:
  - bridge
  - macvlan
  - ipvlan
  volume:
  - local
registries:
  search:
  - docker.io
store:
  configFile: /home/podman/.config/containers/storage.conf
  containerStore:
    number: 0
    paused: 0
    running: 0
    stopped: 0
  graphDriverName: overlay
  graphOptions: {}
  graphRoot: /home/podman/.local/share/containers/storage
  graphRootAllocated: 981256519680
  graphRootUsed: 376707194880
  graphStatus:
    Backing Filesystem: extfs
    Native Overlay Diff: "true"
    Supports d_type: "true"
    Supports shifting: "false"
    Supports volatile: "true"
    Using metacopy: "false"
  imageCopyTmpDir: /var/tmp
  imageStore:
    number: 4
  runRoot: /tmp/containers-user-108/containers
  transientStore: false
  volumePath: /home/podman/.local/share/containers/storage/volumes
version:
  APIVersion: 4.9.3
  Built: 0
  BuiltTime: Thu Jan  1 01:00:00 1970
  GitCommit: ""
  GoVersion: go1.21.6
  Os: linux
  OsArch: linux/amd64
  Version: 4.9.3

(docker compose file for testing traefik - exchanged domain)

services:

    traefik:
        image: traefik:latest
        container_name: traefik
        hostname: traefik.example.org
        restart: no
        ports:
          - "80:80"
          - "443:443"
        volumes:
        - type: bind
          source: /srv/etc/traefik
          target: /etc/traefik
        - type: bind
          source: /etc/ssl/private
          target: /etc/ssl/private
          read_only: true
        - type: bind
          source: /run/user/108/podman/podman.sock
          target: /var/run/docker.sock
          read_only: true
        labels:
          - traefik.enable=true

          - traefik.http.middlewares.admin.basicauth.users=${HTTP_BASIC_USER}:${HTTP_BASIC_PWD}

          - traefik.http.routers.traefik.entrypoints=web
          - traefik.http.routers.traefik.rule=Host(`traefik.example.org`)
          - traefik.http.routers.traefik.service=api@internal
          - traefik.http.routers.traefik.middlewares=admin
        networks:
          - nas-network

networks:
  nas-network:
    external: true

(command for test container to spin up)

podman run -d \
        --name whoami \
        --hostname whoami.example.org \
        --rm \
        --network=nas-network \
        -l traefik.enable="true" \
        -l traefik.http.routers.whoami.rule=Host'(`whoami.example.org`)' \
        -l traefik.http.routers.whoami.entrypoints=web \
        -l traefik.http.services.whoami.loadbalancer.server.port=80 \
        traefik/whoami

(test of socket within traefik container using: curl --unix-socket /run/docker.sock -X GET http://d/version[d]``)
{"Platform":{"Name":"linux/amd64/debian-12"},"Components":[{"Name":"Podman Engine","Version":"4.9.3","Details":{"APIVersion":"4.9.3","Arch":"amd64","BuildTime":"1970-01-01T01:00:00+01:00","Experimental":"false","GitCommit":"","GoVersion":"go1.21.6","KernelVersion":"6.1.0-18-amd64","MinAPIVersion":"4.0.0","Os":"linux"}},{"Name":"Conmon","Version":"conmon version 2.1.6, commit: unknown","Details":{"Package":"conmon_2.1.6+ds1-1_amd64"}},{"Name":"OCI Runtime (runc)","Version":"runc version 1.1.12\ncommit: v1.1.12-0-g51d5e94\nspec: 1.0.2-dev\ngo: go1.21.8\nlibseccomp: 2.5.4","Details":{"Package":"containerd.io_1.6.28-2_amd64"}}],"Version":"4.9.3","ApiVersion":"1.41","MinAPIVersion":"1.24","GitCommit":"","GoVersion":"go1.21.6","Os":"linux","Arch":"amd64","KernelVersion":"6.1.0-18-amd64","BuildTime":"1970-01-01T01:00:00+01:00"}

(traefik.yml)

## traefik.yml

# Global configuration
global:
  checkNewVersion: false
  sendAnonymousUsage: false

# Define entrypoints
entryPoints:
  web:
    address: :80
#    http:
#      redirections:
#        entryPoint:
#          to: websecure
#          scheme: https

  websecure:
    address: :443

providers:
# Docker configuration backend
  docker:
    exposedByDefault: false 

# TLS Config for certs
  file:
    filename: "/etc/traefik/tls.yml"

# API and dashboard configuration
api:
  insecure: true
  dashboard: true
  disabledashboardad: true

[rhatdan]

traefik is looking for the docker.sock which Podman does not listen on automatically unless you install the podman-docker package.

You can also set the DOCKER_HOST environment variable to point at the podman.sock. Finally make sure the podman.sock service is enabled.