I have 2 technical questions

[xgusto]

I used portainer and this yaml (modified by me) to deploy wireguard webadmin. The first stack deployment fails. If I click deploy a second time, it's OK and everything works correctly (I don't understand it).
I apologize, because I am not an expert in docker, but I have a question.
I know it's not recommended, but docker runs in LXC (I don't have to use VM because of docker). I have LXC built on Debian 12 and regularly backup them.
LXC + docker compose + portainer alone has 600 MB after the backup.
If I deploy Wireguard_webadmin, then after backup the LXC is 1.35 GB.
As I have already stated, I am not an expert, but it is possible to build Wireguard_webadmin, e.g. on alpine linux?

docker images --format "{{.Repository}}: {{.Size}}"
eduardosilva/wireguard_webadmin: 1.82GB
eduardosilva/wireguard_webadmin_dns: 81.6MB
eduardosilva/wireguard_webadmin_cron: 231MB
portainer/portainer-ce: 294MB

Why does wireguard_webadmin take up so much space?

docker ps -s --format "{{.Names}}: {{.Size}}"
wireguard-webadmin-cron: 230kB (virtual 231MB)
wireguard-webadmin-dns: 3B (virtual 81.6MB)
wireguard-webadmin: 373kB (virtual 1.82GB)
portainer: 0B (virtual 294MB)

Thank you for your work

[eduardogsilva]

Hello @xgusto

Thank you for your question and feedback. I'll address your concerns in detail below.

Recommendation on Virtualization

First, regarding your setup with LXC and Docker, I understand the complexity you're dealing with. While Docker can run inside LXC, it's not the most optimal setup, especially for production environments. I strongly recommend considering KVM instead. Here’s why:

• Performance and Resource Management: In my experience, KVM provides better isolation and resource management compared to LXC, which can help avoid potential issues with nested virtualization.
• Stability: KVM tends to be more stable and is widely used in production environments, reducing the time spent troubleshooting issues.

However, if you're constrained to using LXC, it’s important to note that nesting Docker inside LXC can introduce complexities, especially around networking and resource allocation.

Troubleshooting the Deployment Issue

For the issue with the deployment failing on the first attempt, I would need more information, particularly the logs. This will help diagnose whether the issue is related to your LXC setup or the modifications in your YAML file. Please share the logs for further analysis.

Why Debian Instead of Alpine?

1. Troubleshooting and Tools: Debian provides a more comprehensive set of tools for troubleshooting network, firewall, and VPN issues. This is crucial for maintaining and debugging the container.

2. Ease of Use: Debian is widely used and has extensive documentation and community support, which can be beneficial for resolving potential issues quickly.

3. Necessary Packages: The image includes several packages for troubleshooting, which increase the size but are essential for diagnostics:

   RUN apt-get update && apt-get install -y \
       wireguard \
       iptables \
       iproute2 \
       net-tools \
       inetutils-ping \
       inetutils-traceroute \
       nano \
       vim-nox \
       openssl \
       && rm -rf /var/lib/apt/lists/*

   If size is a critical concern, you can consider tweaking the Dockerfile for a more minimal setup, but this could make troubleshooting more difficult:

   # Minimal setup
   RUN apt-get update && apt-get install -y \
       wireguard \
       iptables \
       openssl \
       && rm -rf /var/lib/apt/lists/*

Conclusion

While Alpine Linux could potentially reduce the image size, the trade-off in terms of ease of troubleshooting and package availability might not be worth it, especially for a tool that requires robust network handling.

Feel free to reach out if you have any further questions or need assistance with the logs.

Cheers!

[xgusto]

Yes, I know that running docker inside LXC is not an optimal solution, even LXC administrator Stefan Graber talks about it, but it works :)

I haven't had any problems with docker inside LXC yet.

If something can be built on LXC, don't put it on KVM. LXC is quite safe in privileged mode.

As I already wrote, I'm not an expert, and if you built the wireguard_webadmin stack above Debian, you probably know why.

Now let's deploy wireguard_webadmin from dockerhub
I tried it from the CLI.

mkdir wireguard_webadmin
cd wireguard_webadmin
nano docker-compose-no-nginx.yml

version: '3'
services:
  wireguard-webadmin:
    container_name: wireguard-webadmin
    restart: unless-stopped
    image: eduardosilva/wireguard_webadmin:latest
    environment:
      - SERVER_ADDRESS=wgui.example.com
      - DEBUG_MODE=True
      - COMPOSE_VERSION=02b
    volumes:
      - wireguard:/etc/wireguard
      - static_volume:/app_static_files/
      - dnsmasq_conf:/etc/dnsmasq
    ports:
      # Do not directly expose the Django port to the internet, use some kind of reverse proxy with SSL.
      - "192.168.3.10:5000:8000"
      # Warning: Docker will have a hard time handling large amount of ports. Expose only the ports that you need.
      # Ports for multiple WireGuard instances. (Probably, you just need one)
      - "51840-51859:51840-51859/udp"
      # Ports for port forwarding rules. Add your own ports here if you need them.
      - "8080-8089:8080-8089/tcp"
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
    sysctls:
      - net.ipv4.conf.all.src_valid_mark=1
      - net.ipv4.ip_forward=1
    command: /bin/bash /app/init.sh
 
  wireguard-webadmin-cron:
    container_name: wireguard-webadmin-cron
    restart: unless-stopped
    image: eduardosilva/wireguard_webadmin_cron:latest
    depends_on:
      - wireguard-webadmin
 
  wireguard-webadmin-dns:
    container_name: wireguard-webadmin-dns
    restart: unless-stopped
    image: eduardosilva/wireguard_webadmin_dns:latest
    volumes:
      - dnsmasq_conf:/etc/dnsmasq/
 
volumes:
  static_volume:
  wireguard:
  dnsmasq_conf:

docker compose -f docker-compose-no-nginx.yml up

Here is the wireguardg_webadmin creation log.

[+] Running 26/26
 ✔ wireguard-webadmin-cron 5 layers [⣿⣿⣿⣿⣿]      0B/0B      Pulled                                                                              12.5s 
   ✔ fdcaa7e87498 Pull complete                                                                                                                  1.0s 
   ✔ 072232f23d58 Pull complete                                                                                                                  2.3s 
   ✔ a3ec9d289fb3 Pull complete                                                                                                                  0.5s 
   ✔ fcdb8b81c065 Pull complete                                                                                                                  1.1s 
   ✔ 3202d6a31690 Pull complete                                                                                                                  1.6s 
 ✔ wireguard-webadmin-dns 3 layers [⣿⣿⣿]      0B/0B      Pulled                                                                                 12.7s 
   ✔ 9fdab6f35b6d Pull complete                                                                                                                 10.3s 
   ✔ 9d81c25e4b39 Pull complete                                                                                                                 10.7s 
   ✔ ffb08eea09de Pull complete                                                                                                                 10.8s 
 ✔ wireguard-webadmin 15 layers [⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿]      0B/0B      Pulled                                                                       101.7s 
   ✔ 1468e7ff95fc Pull complete                                                                                                                  2.8s 
   ✔ 2cf9c2b42f41 Pull complete                                                                                                                  2.8s 
   ✔ c4c40c3e3cdf Pull complete                                                                                                                  3.8s 
   ✔ c05cc1123d7e Pull complete                                                                                                                  8.2s 
   ✔ b6f29ccdcc55 Pull complete                                                                                                                  4.0s 
   ✔ 7746f0895c65 Pull complete                                                                                                                  5.2s 
   ✔ 096b0369c441 Pull complete                                                                                                                  4.5s 
   ✔ 1c7299ff6379 Pull complete                                                                                                                  5.2s 
   ✔ 719241cfec11 Pull complete                                                                                                                  5.7s 
   ✔ d52c8dfb07e3 Pull complete                                                                                                                 10.3s 
   ✔ 60be74685aba Pull complete                                                                                                                  6.6s 
   ✔ c2f24eabdaa4 Pull complete                                                                                                                  8.6s 
   ✔ 92c33c6a3ac7 Pull complete                                                                                                                 10.2s 
   ✔ 9e2d74e5ed75 Pull complete                                                                                                                  9.2s 
   ✔ 7bc5c34837e2 Pull complete                                                                                                                  9.7s 
[+] Running 7/1
 ✔ Network wireguard_webadmin_default         Created                                                                                            0.0s 
 ✔ Volume "wireguard_webadmin_wireguard"      Created                                                                                            0.0s 
 ✔ Volume "wireguard_webadmin_static_volume"  Created                                                                                            0.0s 
 ✔ Volume "wireguard_webadmin_dnsmasq_conf"   Created                                                                                            0.0s 
 ✔ Container wireguard-webadmin               Created                                                                                            0.0s 
 ✔ Container wireguard-webadmin-dns           Created                                                                                            0.0s 
 ✔ Container wireguard-webadmin-cron          Created                                                                                            0.0s 
Attaching to wireguard-webadmin, wireguard-webadmin-cron, wireguard-webadmin-dns
wireguard-webadmin-dns   | Setting up watches.
wireguard-webadmin-dns   | Watches established.
wireguard-webadmin-dns   | Config file not found, creating a new one...
wireguard-webadmin       | Operations to perform:
wireguard-webadmin       |   Apply all migrations: admin, auth, contenttypes, dns, firewall, sessions, user_manager, wireguard
wireguard-webadmin       | Running migrations:
wireguard-webadmin       |   Applying contenttypes.0001_initial... OK
wireguard-webadmin       |   Applying auth.0001_initial... OK
wireguard-webadmin       |   Applying admin.0001_initial... OK
wireguard-webadmin       |   Applying admin.0002_logentry_remove_auto_add... OK
wireguard-webadmin       |   Applying admin.0003_logentry_add_action_flag_choices... OK
wireguard-webadmin       |   Applying contenttypes.0002_remove_content_type_name... OK
wireguard-webadmin       |   Applying auth.0002_alter_permission_name_max_length... OK
wireguard-webadmin       |   Applying auth.0003_alter_user_email_max_length... OK
wireguard-webadmin       |   Applying auth.0004_alter_user_username_opts... OK
wireguard-webadmin       |   Applying auth.0005_alter_user_last_login_null... OK
wireguard-webadmin       |   Applying auth.0006_require_contenttypes_0002... OK
wireguard-webadmin       |   Applying auth.0007_alter_validators_add_error_messages... OK
wireguard-webadmin       |   Applying auth.0008_alter_user_username_max_length... OK
wireguard-webadmin       |   Applying auth.0009_alter_user_last_name_max_length... OK
wireguard-webadmin       |   Applying auth.0010_alter_group_name_max_length... OK
wireguard-webadmin       |   Applying auth.0011_update_proxy_permissions... OK
wireguard-webadmin       |   Applying auth.0012_alter_user_first_name_max_length... OK
wireguard-webadmin       |   Applying dns.0001_initial... OK
wireguard-webadmin       |   Applying wireguard.0001_initial... OK
wireguard-webadmin       |   Applying wireguard.0002_peer_private_key... OK
wireguard-webadmin       |   Applying wireguard.0003_peerallowedip_missing_from_wireguard... OK
wireguard-webadmin       |   Applying wireguard.0004_wireguardinstance_public_key... OK
wireguard-webadmin       |   Applying wireguard.0005_wireguardinstance_pending_changes... OK
wireguard-webadmin       |   Applying wireguard.0006_peerstatus... OK
wireguard-webadmin       |   Applying wireguard.0007_remove_wireguardinstance_persistent_keepalive... OK
wireguard-webadmin       |   Applying wireguard.0008_wireguardinstance_dns_primary_and_more... OK
wireguard-webadmin       |   Applying wireguard.0009_webadminsettings... OK
wireguard-webadmin       |   Applying wireguard.0010_remove_webadminsettings_webadmin_settings... OK
wireguard-webadmin       |   Applying wireguard.0011_webadminsettings_name... OK
wireguard-webadmin       |   Applying wireguard.0012_remove_webadminsettings_current_version_and_more... OK
wireguard-webadmin       |   Applying wireguard.0013_webadminsettings_current_version_and_more... OK
wireguard-webadmin       |   Applying wireguard.0014_alter_wireguardinstance_dns_primary_and_more... OK
wireguard-webadmin       |   Applying wireguard.0015_alter_wireguardinstance_dns_primary_and_more... OK
wireguard-webadmin       |   Applying wireguard.0016_remove_wireguardinstance_dns_primary_and_more... OK
wireguard-webadmin       |   Applying wireguard.0017_wireguardinstance_dns_primary_and_more... OK
wireguard-webadmin       |   Applying wireguard.0018_wireguardinstance_legacy_firewall... OK
wireguard-webadmin       |   Applying firewall.0001_initial... OK
wireguard-webadmin       |   Applying firewall.0002_redirectrule_masquerade_source_and_more... OK
wireguard-webadmin       |   Applying firewall.0003_firewallsettings_forwardrule... OK
wireguard-webadmin       |   Applying firewall.0004_rename_forwardrule_firewallrule... OK
wireguard-webadmin       |   Applying firewall.0005_firewallsettings_created_firewallsettings_updated... OK
wireguard-webadmin       |   Applying firewall.0006_alter_firewallsettings_created... OK
wireguard-webadmin       |   Applying firewall.0007_firewallsettings_pending_changes... OK
wireguard-webadmin       |   Applying firewall.0008_remove_firewallsettings_global_firewallsettings_name... OK
wireguard-webadmin       |   Applying firewall.0009_remove_firewallrule_wireguard_instance... OK
wireguard-webadmin       |   Applying firewall.0010_alter_firewallrule_firewall_chain... OK
wireguard-webadmin       |   Applying firewall.0011_firewallsettings_last_firewall_reset... OK
wireguard-webadmin       |   Applying sessions.0001_initial... OK
wireguard-webadmin       |   Applying user_manager.0001_initial... OK
wireguard-webadmin       |   Applying user_manager.0002_remove_useracl_id_useracl_created_useracl_updated_and_more... OK
wireguard-webadmin       |   Applying user_manager.0003_authenticationtoken... OK
wireguard-webadmin       |   Applying wireguard.0019_alter_wireguardinstance_legacy_firewall... OK
wireguard-webadmin       |   Applying wireguard.0020_peerallowedip_config_file... OK
wireguard-webadmin       |   Applying wireguard.0021_remove_peerallowedip_missing_from_wireguard... OK
wireguard-webadmin       |   Applying wireguard.0022_alter_wireguardinstance_dns_primary... OK
wireguard-webadmin       | 
wireguard-webadmin       | 2537 static files copied to '/app_static_files'.
wireguard-webadmin       | Watching for file changes with StatReloader
wireguard-webadmin       | [05/Jun/2024 07:06:02] "GET /api/cron_check_updates/ HTTP/1.1" 200 73

If I enter the IP address (or domain name) in the URL, the log continues.

wireguard-webadmin       | [05/Jun/2024 07:07:01] "GET /api/cron_check_updates/ HTTP/1.1" 200 27
wireguard-webadmin       | [05/Jun/2024 07:07:16] "GET / HTTP/1.0" 302 0
wireguard-webadmin       | [05/Jun/2024 07:07:16] "GET /accounts/login/?next=/ HTTP/1.0" 302 0
wireguard-webadmin       | [05/Jun/2024 07:07:16] "GET /accounts/create_first_user/ HTTP/1.0" 200 3199

When I use wgiu.example.com in the browser, everything works correctly.
It is possible that it ended up similarly in portainers.
After all, portainer probably does the same work as CLI.

When I use Ctrl+C in the CLI, the containers stop

^CGracefully stopping... (press Ctrl+C again to force)
[+] Stopping 3/3
 ✔ Container wireguard-webadmin-cron  Stopped                                                                                                   10.3s 
 ✔ Container wireguard-webadmin-dns   Stopped                                                                                                   11.7s 
 ✔ Container wireguard-webadmin       Stopped                                                                                                    1.4s 
canceled

My yml is identical to yours, only the IP address and ports have been changed.
When I tried to install the stack again through portainer, it ended with a voice.

Deployment error
Unable to deploy stack

If I click deploy the stack again, the deployment ends successfully and everything works correctly.

[eduardogsilva]

@xgusto, I make a lot of mistakes 😅. I just believe that debian is a lot easier to troubleshoot network issues if needed than alpine.
I do understand that it costs bit more space in storage for this, but I believe that it's a fair trade off.
I will release a new image soon with some extra tools removed, it may reduce some storage size.
In the next weeks, I will be testing a build with alpine and check if it have any impact on the code.

Regarding your error, you need to try to get more logs from portainer when you try to deploy. (just logs related to the fail).

Cheers!

[xgusto]

Thank you for the answer. I will wait for a doocker with alpine.