Skip to content

Fix: Add traefik.docker.network label to prevent routing to wrong network#8975

Open
dlaporte wants to merge 1 commit intocoollabsio:nextfrom
dlaporte:fix/traefik-docker-network-label
Open

Fix: Add traefik.docker.network label to prevent routing to wrong network#8975
dlaporte wants to merge 1 commit intocoollabsio:nextfrom
dlaporte:fix/traefik-docker-network-label

Conversation

@dlaporte
Copy link

Changes

When a Docker Compose app has multiple networks (e.g., an internal: true
network for service isolation), Traefik randomly picks which network IP to
route to because Go map iteration is non-deterministic. If it picks an
unreachable network, requests hang.

fqdnLabelsForCaddy() already handles this by emitting caddy_ingress_network,
but fqdnLabelsForTraefik() never emitted the equivalent traefik.docker.network
label. This PR adds it, following the same pattern: use $uuid for Docker
Compose deployments (where $serviceLabels is set), and $network for
single-container apps.

Three files changed:

  • bootstrap/helpers/docker.php — added ?string $network = null parameter
    and label emission to fqdnLabelsForTraefik()
  • bootstrap/helpers/parsers.php — pass $network to all 4 call sites
  • bootstrap/helpers/shared.php — pass $resource->destination->network to
    all 4 call sites

Issues

Category

  • Bug fix
  • Improvement
  • New feature
  • Adding new one click service
  • Fixing or updating existing one click service

Preview

N/A — label-only change with no UI impact.

AI Assistance

  • AI was NOT used to create this PR
  • AI was used (please describe below)

If AI was used:

  • Tools used: Claude Code
  • How extensively: AI identified the relevant code paths and generated the
    initial diff. All changes were reviewed and verified by a human against
    the existing Caddy implementation to ensure correctness.

Testing

  • Reproduced the issue on a Coolify v4.0.0-beta.468 instance with a Docker
    Compose app using an internal: true sandbox network alongside the
    Coolify-managed network
  • Confirmed Traefik non-deterministically routes to the internal network IP,
    causing request hangs
  • Verified the fix mirrors the existing fqdnLabelsForCaddy() logic exactly
  • The new parameter defaults to null and the label is only emitted when a
    network value is provided, so existing single-network deployments are unaffected

Contributor Agreement

  • I have read and understood the contributor guidelines. If I have failed to follow any guideline, I understand that this PR may be closed without review.
  • I have searched existing issues and pull requests (including closed ones) to ensure this isn't a duplicate.
  • I have tested all the changes thoroughly with a local development instance of Coolify and I am confident that they will work as expected when a maintainer tests them.

…work

When a container is on multiple Docker networks, Traefik non-deterministically
picks which network IP to route to. This adds the traefik.docker.network label
mirroring the existing Caddy caddy_ingress_network pattern.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant