Docker

portainer配置

Avatar photo By yu_panel

配置反向代理

https://docs.portainer.io/advanced/reverse-proxy/nginx

这里有非常重要的一点，官方给的另一个nginx proxy 服务并不是单纯的 nginx。docker中如果想要通过域名形式代理的话，最好采用http协议选择portainer的9000端口，因为docker的内部网关会对https的域名进行验证的。

因为portainer默认是localhost域名，所以会有下面的报错。

{
  "level": "error",
  "ts": 1733380193.0202732,
  "logger": "http.log.error",
  "msg": "tls: failed to verify certificate: x509: certificate is valid for localhost, not portainer",
  "request": {
    "remote_ip": "172.25.0.1",
    "remote_port": "42308",
    "client_ip": "172.25.0.1",
    "proto": "HTTP/1.1",
    "method": "GET",
    "host": "localhost:1027",
    "uri": "/",
    "headers": {
      "Cache-Control": [
        "max-age=0"
      ],
      "Sec-Fetch-Site": [
        "none"
      ],
      "Sec-Fetch-User": [
        "?1"
      ],
      "Accept-Language": [
        "zh-CN,zh;q=0.9"
      ],
      "Sec-Ch-Ua": [
        "\"Google Chrome\";v=\"131\", \"Chromium\";v=\"131\", \"Not_A Brand\";v=\"24\""
      ],
      "Sec-Fetch-Mode": [
        "navigate"
      ],
      "Sec-Fetch-Dest": [
        "document"
      ],
      "Cookie": [
        "REDACTED"
      ],
      "Connection": [
        "keep-alive"
      ],
      "Sec-Ch-Ua-Mobile": [
        "?0"
      ],
      "Sec-Ch-Ua-Platform": [
        "\"Windows\""
      ],
      "Upgrade-Insecure-Requests": [
        "1"
      ],
      "User-Agent": [
        "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
      ],
      "Accept": [
        "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7"
      ],
      "Accept-Encoding": [
        "gzip, deflate, br, zstd"
      ]
    }
  },
  "duration": 0.00317577,
  "status": 502,
  "err_id": "gpbhem59z",
  "err_trace": "reverseproxy.statusError (reverseproxy.go:1269)"
}

使用在线网站生成的ssl证书，证书的类型有问题。

{
  "level": "error",
  "ts": 1733381980.5287666,
  "logger": "http.log.error",
  "msg": "tls: failed to verify certificate: x509: certificate relies on legacy Common Name field, use SANs instead",
  "request": {
    "remote_ip": "172.25.0.1",
    "remote_port": "59280",
    "client_ip": "172.25.0.1",
    "proto": "HTTP/1.1",
    "method": "GET",
    "host": "localhost:1024",
    "uri": "/",
    "headers": {
      "Sec-Ch-Ua-Platform": [
        "\"Windows\""
      ],
      "Sec-Fetch-User": [
        "?1"
      ],
      "Accept-Encoding": [
        "gzip, deflate, br, zstd"
      ],
      "Accept-Language": [
        "zh-CN,zh;q=0.9"
      ],
      "Sec-Ch-Ua": [
        "\"Google Chrome\";v=\"131\", \"Chromium\";v=\"131\", \"Not_A Brand\";v=\"24\""
      ],
      "Sec-Fetch-Site": [
        "none"
      ],
      "Sec-Fetch-Dest": [
        "document"
      ],
      "Upgrade-Insecure-Requests": [
        "1"
      ],
      "User-Agent": [
        "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
      ],
      "Accept": [
        "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7"
      ],
      "Sec-Fetch-Mode": [
        "navigate"
      ],
      "Cookie": [
        "REDACTED"
      ],
      "Connection": [
        "keep-alive"
      ],
      "Sec-Ch-Ua-Mobile": [
        "?0"
      ]
    }
  },
  "duration": 0.003323056,
  "status": 502,
  "err_id": "gge451nit",
  "err_trace": "reverseproxy.statusError (reverseproxy.go:1269)"
}

最后使用openssl req -newkey rsa:4096 -nodes -sha256 -keyout domain.key -x509 -days 36500 -out domain.crt -addext "subjectAltName = DNS:portainer"命令生成证书还是有问题，是因为自签的证书不被信任，参考这篇博客：https://blog.csdn.net/tom_fans/article/details/107620248

{
  "level": "error",
  "ts": 1733382717.6806178,
  "logger": "http.log.error",
  "msg": "tls: failed to verify certificate: x509: certificate signed by unknown authority",
  "request": {
    "remote_ip": "172.25.0.1",
    "remote_port": "49990",
    "client_ip": "172.25.0.1",
    "proto": "HTTP/1.1",
    "method": "GET",
    "host": "localhost:1024",
    "uri": "/",
    "headers": {
      "Accept-Encoding": [
        "gzip, deflate, br, zstd"
      ],
      "Cookie": [
        "REDACTED"
      ],
      "Sec-Ch-Ua-Platform": [
        "\"Windows\""
      ],
      "Upgrade-Insecure-Requests": [
        "1"
      ],
      "User-Agent": [
        "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
      ],
      "Sec-Ch-Ua-Mobile": [
        "?0"
      ],
      "Accept": [
        "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7"
      ],
      "Sec-Fetch-Mode": [
        "navigate"
      ],
      "Sec-Fetch-Dest": [
        "document"
      ],
      "Connection": [
        "keep-alive"
      ],
      "Sec-Fetch-Site": [
        "none"
      ],
      "Sec-Ch-Ua": [
        "\"Google Chrome\";v=\"131\", \"Chromium\";v=\"131\", \"Not_A Brand\";v=\"24\""
      ],
      "Sec-Fetch-User": [
        "?1"
      ],
      "Accept-Language": [
        "zh-CN,zh;q=0.9"
      ]
    }
  },
  "duration": 0.009459574,
  "status": 502,
  "err_id": "zykmcedwf",
  "err_trace": "reverseproxy.statusError (reverseproxy.go:1269)"
}

更优雅的反向代理

base_url：https://docs.portainer.io/advanced/cli#configuration-flags-available-at-the-command-line

配置远程连接docker

远程环境配置官方文档：https://docs.portainer.io/admin/environments/add/api#remote-endpoint

官方文档中是使用docker run 方式启动的，并且没提供composer方式。我更喜欢使用composer文件启动。

services:
  portainer:
    image: portainer/portainer-ce2.21.4
    container_name: portainer
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ./portainer_data:/data
    ports:
      - 8000:8000
      - 9443:9443
    restart: unless-stopped

使用https访问9443端口

配置远程docker连接

一共有四种方式，agent最为简单——只需要安装一个portainer/agent并连接上就行，我更倾向于使用API的方式，多装一个服务给本就不怎么样的服务器增加了负荷。但是这种就需要配置，较为麻烦。

配置API连接

docker文档：https://docs.docker.com/engine/daemon/remote-access

个人博客：https://www.cnblogs.com/niceyoo/p/13270224.html

# 没有效果 
systemctl edit docker.service

# 修改之后docker无法正常启动
vim /etc/docker/daemon.json

# 检测docker远程连接是否开启
sudo netstat -lntp | grep dockerd

配置agent连接

api连接坑太多，还是用最简单方法来。而且如果机器重装docker就需要重新配置了重复劳动是不能接受的。只支持一对一的连接，有点鸡肋了。我原本以为agent容器应该是比较小的，结果一看竟然也有200多MB，还不如直接装一个portainer（也就300多MB），还能在多个电脑上登录。

常见问题

无法获取镜像详情

https://www.cnblogs.com/xwgli/p/18110766

无法新增stack

有一种可能是因为你的stack拉取的镜像太大或者是网络问题会一直卡在部署镜像的过程当中而portainer是异步的，此时你能够点击其他按钮，然后在切回来发现stack没有部署成功，然后再次部署其他的stack会发现还是失败的，因为上一个还在部署，只是没有UI界面展示。这种情况重启portainer容器就可以了。

Avatar photo

By yu_panel

Related Post

Docker

watch tower 使用

Avatar photoyu_panel
2 thoughts on “portainer配置”

发表回复

您的邮箱地址不会被公开。 必填项已用 * 标注

You Missed

开源贡献

wewe-rss配置服务器基础路径

开源贡献

Vue 的部署路径

Windows 开源贡献

提交程序包到winget社区仓库

Shell

powershell

Table of Contents

→ 目录