From 1894633a659b894c1d36eb048c63c822ad0bfae4 Mon Sep 17 00:00:00 2001 From: tajniak81 <13187254+tajniak81@users.noreply.github.com> Date: Sun, 1 Nov 2026 17:59:41 +0100 Subject: [PATCH] Docker, Docker-AIO: SeaweedFS S3 gateway on the compose network only The homeserver reaches the gateway over the compose network (or inside the AIO container), so publishing 8333 on the host only made a second SeaweedFS stack fail with "port is already allocated". Drop the binding and SEAWEED_S3_BIND/SEAWEED_S3_PORT. Co-Authored-By: Claude Opus 5.5 --- Docker-AIO/.env.pocketbase.seaweedfs.example | 6 ------ Docker-AIO/.env.pocketbase.seaweedfs.prod.example | 6 ------ Docker-AIO/.env.pocketbase.seaweedfs.split.example | 6 ------ .../.env.pocketbase.seaweedfs.split.prod.example | 6 ------ Docker-AIO/README.md | 5 +++-- .../docker-compose.pocketbase.seaweedfs.prod.yml | 5 ++--- .../docker-compose.pocketbase.seaweedfs.split.prod.yml | 8 ++++---- .../docker-compose.pocketbase.seaweedfs.split.yml | 8 ++++---- Docker-AIO/docker-compose.pocketbase.seaweedfs.yml | 5 ++--- Docker/.env.pocketbase.seaweedfs.example | 6 ------ Docker/.env.pocketbase.seaweedfs.prod.example | 6 ------ Docker/.env.pocketbase.seaweedfs.split.example | 6 ------ Docker/.env.pocketbase.seaweedfs.split.prod.example | 6 ------ Docker/README.md | 10 ++++++---- Docker/docker-compose.pocketbase.seaweedfs.prod.yml | 7 ++----- .../docker-compose.pocketbase.seaweedfs.split.prod.yml | 10 ++++------ Docker/docker-compose.pocketbase.seaweedfs.split.yml | 10 ++++------ Docker/docker-compose.pocketbase.seaweedfs.yml | 7 ++----- 18 files changed, 33 insertions(+), 90 deletions(-) diff --git a/Docker-AIO/.env.pocketbase.seaweedfs.example b/Docker-AIO/.env.pocketbase.seaweedfs.example index 7fe2cff..43caf51 100644 --- a/Docker-AIO/.env.pocketbase.seaweedfs.example +++ b/Docker-AIO/.env.pocketbase.seaweedfs.example @@ -62,12 +62,6 @@ WARP_PB_S3_SECRET= # SeaweedFS ignores the region; the client insists on one. WARP_PB_S3_REGION=us-east-1 -# The S3 gateway's host port, on loopback unless the bind address says -# otherwise. The homeserver does not need it; it is for aws-cli and the -# like. -SEAWEED_S3_BIND=127.0.0.1 -SEAWEED_S3_PORT=8333 - # Building only: the SeaweedFS release to bake in. Leave it commented out # to keep the Dockerfile's pin; an empty value breaks the build. # SEAWEED_VERSION=4.45 diff --git a/Docker-AIO/.env.pocketbase.seaweedfs.prod.example b/Docker-AIO/.env.pocketbase.seaweedfs.prod.example index 0467dbe..d6eab87 100644 --- a/Docker-AIO/.env.pocketbase.seaweedfs.prod.example +++ b/Docker-AIO/.env.pocketbase.seaweedfs.prod.example @@ -67,12 +67,6 @@ WARP_PB_S3_SECRET= # SeaweedFS ignores the region; the client insists on one. WARP_PB_S3_REGION=us-east-1 -# The S3 gateway's host port, on loopback unless the bind address says -# otherwise. The homeserver does not need it; it is for aws-cli and the -# like. -SEAWEED_S3_BIND=127.0.0.1 -SEAWEED_S3_PORT=8333 - # ------------------------------------------------------------ homeserver # Part of every user and room ID: it cannot be changed later. diff --git a/Docker-AIO/.env.pocketbase.seaweedfs.split.example b/Docker-AIO/.env.pocketbase.seaweedfs.split.example index beefafb..55f9792 100644 --- a/Docker-AIO/.env.pocketbase.seaweedfs.split.example +++ b/Docker-AIO/.env.pocketbase.seaweedfs.split.example @@ -66,12 +66,6 @@ WARP_PB_S3_SECRET= # SeaweedFS ignores the region; the client insists on one. WARP_PB_S3_REGION=us-east-1 -# The S3 gateway's host port, on loopback unless the bind address says -# otherwise. The homeserver does not need it; it is for aws-cli and the -# like. -SEAWEED_S3_BIND=127.0.0.1 -SEAWEED_S3_PORT=8333 - # SeaweedFS's admin UI. It can mint credentials for the bucket, so the # password is required. Put it behind a reverse proxy before binding it # to 0.0.0.0. The read-only login is optional. diff --git a/Docker-AIO/.env.pocketbase.seaweedfs.split.prod.example b/Docker-AIO/.env.pocketbase.seaweedfs.split.prod.example index af4273a..349bb52 100644 --- a/Docker-AIO/.env.pocketbase.seaweedfs.split.prod.example +++ b/Docker-AIO/.env.pocketbase.seaweedfs.split.prod.example @@ -71,12 +71,6 @@ WARP_PB_S3_SECRET= # SeaweedFS ignores the region; the client insists on one. WARP_PB_S3_REGION=us-east-1 -# The S3 gateway's host port, on loopback unless the bind address says -# otherwise. The homeserver does not need it; it is for aws-cli and the -# like. -SEAWEED_S3_BIND=127.0.0.1 -SEAWEED_S3_PORT=8333 - # SeaweedFS's admin UI. It can mint credentials for the bucket, so the # password is required. Put it behind a reverse proxy before binding it # to 0.0.0.0. The read-only login is optional. diff --git a/Docker-AIO/README.md b/Docker-AIO/README.md index 0e799ee..75e34fe 100644 --- a/Docker-AIO/README.md +++ b/Docker-AIO/README.md @@ -106,8 +106,9 @@ docker compose -f docker-compose.pocketbase.seaweedfs.yml up -d --build Both refuse to start without the key pair, and the split one without `SEAWEED_ADMIN_PASSWORD`: either would otherwise serve an open gateway or -an open panel that can mint credentials. The S3 gateway and the admin UI -are published on 127.0.0.1 only; the volume server, which serves content +an open panel that can mint credentials. The S3 gateway is not +published: the homeserver reaches it inside the container. The admin UI +is published on 127.0.0.1 only; the volume server, which serves content by id with no authentication, is never published. Inside, it is on 8081, since 8080 is the web client. diff --git a/Docker-AIO/docker-compose.pocketbase.seaweedfs.prod.yml b/Docker-AIO/docker-compose.pocketbase.seaweedfs.prod.yml index 862b81c..e0f0fc6 100644 --- a/Docker-AIO/docker-compose.pocketbase.seaweedfs.prod.yml +++ b/Docker-AIO/docker-compose.pocketbase.seaweedfs.prod.yml @@ -14,8 +14,8 @@ # into the bucket. # # Homeserver http://localhost:8008, admin panel http://localhost:8009, web -# client http://localhost:8080. The S3 gateway (8333) is published on -# loopback, for aws-cli and the like; SEAWEED_S3_BIND=0.0.0.0 exposes it. +# client http://localhost:8080. The S3 gateway (8333) is not published: the +# homeserver reaches it over the compose network. # # This and docker-compose.pocketbase.seaweedfs.split.yml share their project # and volumes: SeaweedFS's data has the same layout either way, so switching @@ -62,7 +62,6 @@ services: - "${WARP_ADMIN_PORT:-8009}:8009" - "${WARP_WEB_PORT:-8080}:8080" - "${WARP_PB_BIND:-127.0.0.1}:${WARP_PB_PORT:-8070}:8070" - - "${SEAWEED_S3_BIND:-127.0.0.1}:${SEAWEED_S3_PORT:-8333}:8333" volumes: warp-data: diff --git a/Docker-AIO/docker-compose.pocketbase.seaweedfs.split.prod.yml b/Docker-AIO/docker-compose.pocketbase.seaweedfs.split.prod.yml index d751f84..84998b2 100644 --- a/Docker-AIO/docker-compose.pocketbase.seaweedfs.split.prod.yml +++ b/Docker-AIO/docker-compose.pocketbase.seaweedfs.split.prod.yml @@ -15,9 +15,10 @@ # not moved into the bucket. # # Homeserver http://localhost:8008, admin panel http://localhost:8009, web -# client http://localhost:8080. The S3 gateway (8333) and the SeaweedFS admin -# UI (23646) are published on loopback; SEAWEED_S3_BIND and -# SEAWEED_ADMIN_BIND=0.0.0.0 expose them, the admin UI only behind a proxy. +# client http://localhost:8080. The SeaweedFS admin UI (23646) is published +# on loopback; SEAWEED_ADMIN_BIND=0.0.0.0 exposes it, only behind a proxy. +# The S3 gateway (8333) is not published: the homeserver reaches it over +# the compose network. # # This and docker-compose.pocketbase.seaweedfs.yml share their project and # volumes: SeaweedFS's data has the same layout either way, so switching @@ -70,7 +71,6 @@ services: - "${WARP_ADMIN_PORT:-8009}:8009" - "${WARP_WEB_PORT:-8080}:8080" - "${WARP_PB_BIND:-127.0.0.1}:${WARP_PB_PORT:-8070}:8070" - - "${SEAWEED_S3_BIND:-127.0.0.1}:${SEAWEED_S3_PORT:-8333}:8333" - "${SEAWEED_ADMIN_BIND:-127.0.0.1}:${SEAWEED_ADMIN_PORT:-23646}:23646" volumes: diff --git a/Docker-AIO/docker-compose.pocketbase.seaweedfs.split.yml b/Docker-AIO/docker-compose.pocketbase.seaweedfs.split.yml index 4ab91f4..08eb1c5 100644 --- a/Docker-AIO/docker-compose.pocketbase.seaweedfs.split.yml +++ b/Docker-AIO/docker-compose.pocketbase.seaweedfs.split.yml @@ -15,9 +15,10 @@ # not moved into the bucket. # # Homeserver http://localhost:8008, admin panel http://localhost:8009, web -# client http://localhost:8080. The S3 gateway (8333) and the SeaweedFS admin -# UI (23646) are published on loopback; SEAWEED_S3_BIND and -# SEAWEED_ADMIN_BIND=0.0.0.0 expose them, the admin UI only behind a proxy. +# client http://localhost:8080. The SeaweedFS admin UI (23646) is published +# on loopback; SEAWEED_ADMIN_BIND=0.0.0.0 exposes it, only behind a proxy. +# The S3 gateway (8333) is not published: the homeserver reaches it over +# the compose network. # # This and docker-compose.pocketbase.seaweedfs.yml share their project and # volumes: SeaweedFS's data has the same layout either way, so switching @@ -69,7 +70,6 @@ services: - "${WARP_ADMIN_PORT:-8009}:8009" - "${WARP_WEB_PORT:-8080}:8080" - "${WARP_PB_BIND:-127.0.0.1}:${WARP_PB_PORT:-8070}:8070" - - "${SEAWEED_S3_BIND:-127.0.0.1}:${SEAWEED_S3_PORT:-8333}:8333" - "${SEAWEED_ADMIN_BIND:-127.0.0.1}:${SEAWEED_ADMIN_PORT:-23646}:23646" volumes: diff --git a/Docker-AIO/docker-compose.pocketbase.seaweedfs.yml b/Docker-AIO/docker-compose.pocketbase.seaweedfs.yml index a6a3fd5..e108c7b 100644 --- a/Docker-AIO/docker-compose.pocketbase.seaweedfs.yml +++ b/Docker-AIO/docker-compose.pocketbase.seaweedfs.yml @@ -13,8 +13,8 @@ # into the bucket. # # Homeserver http://localhost:8008, admin panel http://localhost:8009, web -# client http://localhost:8080. The S3 gateway (8333) is published on -# loopback, for aws-cli and the like; SEAWEED_S3_BIND=0.0.0.0 exposes it. +# client http://localhost:8080. The S3 gateway (8333) is not published: the +# homeserver reaches it over the compose network. # # This and docker-compose.pocketbase.seaweedfs.split.yml share their project # and volumes: SeaweedFS's data has the same layout either way, so switching @@ -60,7 +60,6 @@ services: - "${WARP_ADMIN_PORT:-8009}:8009" - "${WARP_WEB_PORT:-8080}:8080" - "${WARP_PB_BIND:-127.0.0.1}:${WARP_PB_PORT:-8070}:8070" - - "${SEAWEED_S3_BIND:-127.0.0.1}:${SEAWEED_S3_PORT:-8333}:8333" volumes: warp-data: diff --git a/Docker/.env.pocketbase.seaweedfs.example b/Docker/.env.pocketbase.seaweedfs.example index 0ffa595..9a7ad23 100644 --- a/Docker/.env.pocketbase.seaweedfs.example +++ b/Docker/.env.pocketbase.seaweedfs.example @@ -67,12 +67,6 @@ WARP_PB_S3_REGION=us-east-1 # volume outlives the image. SEAWEED_IMAGE=chrislusf/seaweedfs:4.45 -# The S3 gateway's host port, on loopback unless the bind address says -# otherwise. The homeserver does not need it; it is for aws-cli and the -# like. -SEAWEED_S3_BIND=127.0.0.1 -SEAWEED_S3_PORT=8333 - # ------------------------------------------------------------ homeserver # Part of every user and room ID: it cannot be changed later. diff --git a/Docker/.env.pocketbase.seaweedfs.prod.example b/Docker/.env.pocketbase.seaweedfs.prod.example index 48539fc..d085f7e 100644 --- a/Docker/.env.pocketbase.seaweedfs.prod.example +++ b/Docker/.env.pocketbase.seaweedfs.prod.example @@ -73,12 +73,6 @@ WARP_PB_S3_REGION=us-east-1 # volume outlives the image. SEAWEED_IMAGE=chrislusf/seaweedfs:4.45 -# The S3 gateway's host port, on loopback unless the bind address says -# otherwise. The homeserver does not need it; it is for aws-cli and the -# like. -SEAWEED_S3_BIND=127.0.0.1 -SEAWEED_S3_PORT=8333 - # ------------------------------------------------------------ homeserver # Part of every user and room ID: it cannot be changed later. diff --git a/Docker/.env.pocketbase.seaweedfs.split.example b/Docker/.env.pocketbase.seaweedfs.split.example index 76122ab..a654bf0 100644 --- a/Docker/.env.pocketbase.seaweedfs.split.example +++ b/Docker/.env.pocketbase.seaweedfs.split.example @@ -71,12 +71,6 @@ WARP_PB_S3_REGION=us-east-1 # volume outlives the image. SEAWEED_IMAGE=chrislusf/seaweedfs:4.45 -# The S3 gateway's host port, on loopback unless the bind address says -# otherwise. The homeserver does not need it; it is for aws-cli and the -# like. -SEAWEED_S3_BIND=127.0.0.1 -SEAWEED_S3_PORT=8333 - # SeaweedFS's admin UI. It can mint credentials for the bucket, so the # password is required. Put it behind a reverse proxy before binding it # to 0.0.0.0. The read-only login is optional. diff --git a/Docker/.env.pocketbase.seaweedfs.split.prod.example b/Docker/.env.pocketbase.seaweedfs.split.prod.example index 6247733..f22f639 100644 --- a/Docker/.env.pocketbase.seaweedfs.split.prod.example +++ b/Docker/.env.pocketbase.seaweedfs.split.prod.example @@ -77,12 +77,6 @@ WARP_PB_S3_REGION=us-east-1 # volume outlives the image. SEAWEED_IMAGE=chrislusf/seaweedfs:4.45 -# The S3 gateway's host port, on loopback unless the bind address says -# otherwise. The homeserver does not need it; it is for aws-cli and the -# like. -SEAWEED_S3_BIND=127.0.0.1 -SEAWEED_S3_PORT=8333 - # SeaweedFS's admin UI. It can mint credentials for the bucket, so the # password is required. Put it behind a reverse proxy before binding it # to 0.0.0.0. The read-only login is optional. diff --git a/Docker/README.md b/Docker/README.md index aafe887..1925d35 100644 --- a/Docker/README.md +++ b/Docker/README.md @@ -66,10 +66,12 @@ PocketBase container that talks to the bucket. under *Object Store → Users* never displace it; the gateway does not start until that identity is there. Set `SEAWEED_ADMIN_PASSWORD` as well. -The S3 gateway and the admin UI are published on 127.0.0.1 only -(`SEAWEED_S3_BIND`, `SEAWEED_ADMIN_BIND`); master, volume and filer are not -published, since the volume server serves content by id with no -authentication. Both SeaweedFS files share a project and the +The S3 gateway is not published: the homeserver reaches it as +`seaweedfs:8333` (`seaweedfs-s3:8333` in the split file) on the compose +network, so a second stack never fights over the host port. The admin UI +is published on 127.0.0.1 only (`SEAWEED_ADMIN_BIND`); master, volume and +filer are not published, since the volume server serves content by id +with no authentication. Both SeaweedFS files share a project and the `seaweed-data` layout, so switching between them needs no migration. `SEAWEED_IMAGE` pins the SeaweedFS release (4.45). diff --git a/Docker/docker-compose.pocketbase.seaweedfs.prod.yml b/Docker/docker-compose.pocketbase.seaweedfs.prod.yml index 000e3f8..dc6d314 100644 --- a/Docker/docker-compose.pocketbase.seaweedfs.prod.yml +++ b/Docker/docker-compose.pocketbase.seaweedfs.prod.yml @@ -14,8 +14,8 @@ # Media stored before S3 was on is not moved into the bucket. # # Homeserver http://localhost:8008, admin panel http://localhost:8009, web -# client http://localhost:8080. The S3 gateway (8333) is published on -# loopback, for aws-cli and the like; SEAWEED_S3_BIND=0.0.0.0 exposes it. +# client http://localhost:8080. The S3 gateway (8333) is not published: the +# homeserver reaches it over the compose network. # # This file shares its project and volumes with # docker-compose.pocketbase.seaweedfs.split.yml: SeaweedFS's data has the @@ -50,9 +50,6 @@ services: AWS_SECRET_ACCESS_KEY: ${WARP_PB_S3_SECRET:?set WARP_PB_S3_SECRET in .env} volumes: - ${SEAWEED_DATA_VOLUME:-seaweed-data}:/data - ports: - # For aws-cli and the like; the homeserver uses the compose network. - - "${SEAWEED_S3_BIND:-127.0.0.1}:${SEAWEED_S3_PORT:-8333}:8333" healthcheck: # The gateway answering means master, volume and filer are up too. test: ["CMD-SHELL", "wget -qO- http://127.0.0.1:8333/healthz >/dev/null || exit 1"] diff --git a/Docker/docker-compose.pocketbase.seaweedfs.split.prod.yml b/Docker/docker-compose.pocketbase.seaweedfs.split.prod.yml index fb8eab6..2bfdd0f 100644 --- a/Docker/docker-compose.pocketbase.seaweedfs.split.prod.yml +++ b/Docker/docker-compose.pocketbase.seaweedfs.split.prod.yml @@ -16,9 +16,10 @@ # moved into the bucket. # # Homeserver http://localhost:8008, admin panel http://localhost:8009, web -# client http://localhost:8080. The S3 gateway (8333) and the SeaweedFS admin -# UI (23646) are published on loopback; SEAWEED_S3_BIND and -# SEAWEED_ADMIN_BIND=0.0.0.0 expose them, the admin UI only behind a proxy. +# client http://localhost:8080. The SeaweedFS admin UI (23646) is published +# on loopback; SEAWEED_ADMIN_BIND=0.0.0.0 exposes it, only behind a proxy. +# The S3 gateway (8333) is not published: the homeserver reaches it over +# the compose network. # Master, volume and filer are not published: the volume server serves file # content by id with no authentication at all. # @@ -143,9 +144,6 @@ services: condition: service_healthy seaweedfs-init: condition: service_completed_successfully - ports: - # For aws-cli and the like; the homeserver uses the compose network. - - "${SEAWEED_S3_BIND:-127.0.0.1}:${SEAWEED_S3_PORT:-8333}:8333" healthcheck: test: ["CMD-SHELL", "wget -qO- http://127.0.0.1:8333/healthz >/dev/null || exit 1"] interval: 10s diff --git a/Docker/docker-compose.pocketbase.seaweedfs.split.yml b/Docker/docker-compose.pocketbase.seaweedfs.split.yml index 8d5515f..fc760c0 100644 --- a/Docker/docker-compose.pocketbase.seaweedfs.split.yml +++ b/Docker/docker-compose.pocketbase.seaweedfs.split.yml @@ -16,9 +16,10 @@ # moved into the bucket. # # Homeserver http://localhost:8008, admin panel http://localhost:8009, web -# client http://localhost:8080. The S3 gateway (8333) and the SeaweedFS admin -# UI (23646) are published on loopback; SEAWEED_S3_BIND and -# SEAWEED_ADMIN_BIND=0.0.0.0 expose them, the admin UI only behind a proxy. +# client http://localhost:8080. The SeaweedFS admin UI (23646) is published +# on loopback; SEAWEED_ADMIN_BIND=0.0.0.0 exposes it, only behind a proxy. +# The S3 gateway (8333) is not published: the homeserver reaches it over +# the compose network. # Master, volume and filer are not published: the volume server serves file # content by id with no authentication at all. # @@ -136,9 +137,6 @@ services: condition: service_healthy seaweedfs-init: condition: service_completed_successfully - ports: - # For aws-cli and the like; the homeserver uses the compose network. - - "${SEAWEED_S3_BIND:-127.0.0.1}:${SEAWEED_S3_PORT:-8333}:8333" healthcheck: test: ["CMD-SHELL", "wget -qO- http://127.0.0.1:8333/healthz >/dev/null || exit 1"] interval: 10s diff --git a/Docker/docker-compose.pocketbase.seaweedfs.yml b/Docker/docker-compose.pocketbase.seaweedfs.yml index a9dd91a..5200a23 100644 --- a/Docker/docker-compose.pocketbase.seaweedfs.yml +++ b/Docker/docker-compose.pocketbase.seaweedfs.yml @@ -14,8 +14,8 @@ # Media stored before S3 was on is not moved into the bucket. # # Homeserver http://localhost:8008, admin panel http://localhost:8009, web -# client http://localhost:8080. The S3 gateway (8333) is published on -# loopback, for aws-cli and the like; SEAWEED_S3_BIND=0.0.0.0 exposes it. +# client http://localhost:8080. The S3 gateway (8333) is not published: the +# homeserver reaches it over the compose network. # # This file shares its project and volumes with # docker-compose.pocketbase.seaweedfs.split.yml: SeaweedFS's data has the @@ -43,9 +43,6 @@ services: AWS_SECRET_ACCESS_KEY: ${WARP_PB_S3_SECRET:?set WARP_PB_S3_SECRET in .env} volumes: - ${SEAWEED_DATA_VOLUME:-seaweed-data}:/data - ports: - # For aws-cli and the like; the homeserver uses the compose network. - - "${SEAWEED_S3_BIND:-127.0.0.1}:${SEAWEED_S3_PORT:-8333}:8333" healthcheck: # The gateway answering means master, volume and filer are up too. test: ["CMD-SHELL", "wget -qO- http://127.0.0.1:8333/healthz >/dev/null || exit 1"]