docker-zulip VS netshoot

Running an arbitrary thing in Docker is far easier than without it. If I want to run the PHP/MySQL-based Matomo, I can just grab the ready-made docker-compose.yml [0] and tell my main nginx to proxy_pass onto it. I don’t need to figure out how to configure MySQL/MariaDB/PHP-FPM and what hacks did my distro introduce to it (at least I’m not using Debian/Ubuntu, so there shouldn’t be that many). Similarly, I can get Zulip in Docker [1] (even if it’s apparently in alpha state) and not mess with the Python packaging trainwreck, and also setting up all of Redis, PostgreSQL, RabbitMQ and memcached.

[0]: https://github.com/matomo-org/docker/tree/master/.examples/n...

[1]: https://github.com/zulip/docker-zulip

> complicated to deploy. Not just a simple docker container or anything.

Huh? https://github.com/zulip/docker-zulip

We started with this, but slightly modified it for our use - added database backup, and changed the configuration, as we needed to configure things that are not possible to configure via env vars (SSO, for example).

Now, let's use netshoot, a Docker image equipped with a set of networking troubleshooting tools that can be used for Docker networking.

nicolaka/netshoot for sure. having a preloaded array of networking troubleshooting tools in an image for kubernetes debugging is a godsend.

First off, it seems like getting tcpdump or Wireshark to capture from the container network and dumping to a file will take some extra steps. (A lot of blog posts seem to recommend this Github project - https://github.com/nicolaka/netshoot)

Some hints how to debug such problems in the future: 1. ufw drops/rejections are logged (use dmesg to view them) 2. wireshark shows all connection attempts, even those that are blocked by firewall 3. ss or netstat shows if the server is actually listening for connections 4. netshoot allows to enter docker container network namespace and do pings, curl or telnet from there