How can i forward a port of a second container ?

[Smallinger]

Hey, first of all thanks, i use this projekt daily for more then 1 Project :D

I have a question, now i build a template with PHP8, PhpMyAdmin and MariaDB.

How can i export the port 3306 from the mysql_container to my local network or over the port-forward function. ?

here is my template:

terraform {
  required_providers {
    coder = {
      source  = "coder/coder"
      version = "~> 0.7.0"
    }
    docker = {
      source  = "kreuzwerker/docker"
      version = "~> 3.0.1"
    }
  }
}

locals {
  username = data.coder_workspace.me.owner
}

data "coder_provisioner" "me" {
}

provider "docker" {
}

data "coder_workspace" "me" {
}

data "coder_git_auth" "forgejo" {
  # Matches the ID of the git auth provider in Coder.
  id = "forgejo"
}

data "coder_parameter" "mariadb_hostname" {
  name        = "1 MySQL"
  display_name= "MySQL Hostname"
  icon        = "/icon/database.svg"
  description = "The hostname for the MySQL database."
  mutable     = false
  type        = "string"
  default     = "mysql"
}

data "coder_parameter" "mariadb_password" {
  name        = "2 MySQL"
  display_name= "MySQL Password"
  icon        = "/icon/database.svg"
  description = "The password for the MySQL root user."
  mutable     = false
  type        = "string"
  default     = "mypassword"
}

resource "docker_network" "private_network" {
  name = "${lower(data.coder_workspace.me.owner)}-${lower(data.coder_workspace.me.name)}-network"
}

resource "coder_agent" "main" {
  arch                   = data.coder_provisioner.me.arch
  os                     = "linux"
  startup_script_timeout = 180
  startup_script         = <<-EOT
    set -e

    # install and start code-server
    curl -fsSL https://code-server.dev/install.sh | sh -s -- --method=standalone --prefix=/tmp/code-server --version 4.11.0
    /tmp/code-server/bin/code-server --auth none --port 13337 >/tmp/code-server.log 2>&1 &

    echo "Starting Apache with PHP"
    sudo apachectl restart

    echo "Create Softlink"
    [ ! -L "/home/${local.username}/www" ] && ln -s /var/www/html /home/${local.username}/www && echo "Symbolic Link erstellt." || echo "Symbolic Link existiert bereits."

    echo "Install phpmyadmin"
    [ -d "/var/www/html/phpmyadmin" ] || { wget https://files.phpmyadmin.net/phpMyAdmin/5.2.1/phpMyAdmin-5.2.1-all-languages.tar.gz && tar xvf phpMyAdmin-5.2.1-all-languages.tar.gz && mv phpMyAdmin-5.2.1-all-languages/ /var/www/html/phpmyadmin && rm phpMyAdmin-5.2.1-all-languages.tar.gz && cp /var/www/html/phpmyadmin/config.sample.inc.php /var/www/html/phpmyadmin/config.inc.php && sed -i "s/\$cfg\['Servers'\]\[\$i\]\['host'\] = 'localhost';/\$cfg\['Servers'\]\[\$i\]\['host'\] = '${data.coder_parameter.mariadb_hostname.value}';/" /var/www/html/phpmyadmin/config.inc.php && sed -i "s/\$cfg\['Servers'\]\[\$i\]\['auth_type'\] = 'cookie';/\$cfg\['Servers'\]\[\$i\]\['auth_type'\] = 'config';/" /var/www/html/phpmyadmin/config.inc.php && echo "\$cfg['Servers'][\$i]['user'] = 'root';" >> /var/www/html/phpmyadmin/config.inc.php && echo "\$cfg['Servers'][\$i]['password'] = '${data.coder_parameter.mariadb_password.value}';" >> /var/www/html/phpmyadmin/config.inc.php; }
  EOT

  # These environment variables allow you to make Git commits right away after creating a
  # workspace. Note that they take precedence over configuration defined in ~/.gitconfig!
  # You can remove this block if you'd prefer to configure Git manually or using
  # dotfiles. (see docs/dotfiles.md)
  env = {
    GIT_AUTHOR_NAME     = "${data.coder_workspace.me.owner}"
    GIT_COMMITTER_NAME  = "${data.coder_workspace.me.owner}"
    GIT_AUTHOR_EMAIL    = "${data.coder_workspace.me.owner_email}"
    GIT_COMMITTER_EMAIL = "${data.coder_workspace.me.owner_email}"
  }
}

resource "coder_app" "code-server" {
  agent_id     = coder_agent.main.id
  slug         = "code-server"
  display_name = "code-server"
  url          = "http://localhost:13337/?folder=/home/${local.username}"
  icon         = "/icon/code.svg"
  subdomain    = true
  share        = "authenticated"

  healthcheck {
    url       = "http://localhost:13337/healthz"
    interval  = 5
    threshold = 6
  }
}

resource "docker_volume" "home_volume" {
  name = "coder-${data.coder_workspace.me.id}-home"
  # Protect the volume from being deleted due to changes in attributes.
  lifecycle {
    ignore_changes = all
  }
  # Add labels in Docker to keep track of orphan resources.
  labels {
    label = "coder.owner"
    value = data.coder_workspace.me.owner
  }
  labels {
    label = "coder.owner_id"
    value = data.coder_workspace.me.owner_id
  }
  labels {
    label = "coder.workspace_id"
    value = data.coder_workspace.me.id
  }
  # This field becomes outdated if the workspace is renamed but can
  # be useful for debugging or cleaning out dangling volumes.
  labels {
    label = "coder.workspace_name_at_creation"
    value = data.coder_workspace.me.name
  }
}

resource "docker_volume" "database_volume" {
  name = "coder-${data.coder_workspace.me.id}-database"
  # Protect the volume from being deleted due to changes in attributes.
  lifecycle {
    ignore_changes = all
  }
  # Add labels in Docker to keep track of orphan resources.
  labels {
    label = "coder.owner"
    value = data.coder_workspace.me.owner
  }
  labels {
    label = "coder.owner_id"
    value = data.coder_workspace.me.owner_id
  }
  labels {
    label = "coder.workspace_id"
    value = data.coder_workspace.me.id
  }
  # This field becomes outdated if the workspace is renamed but can
  # be useful for debugging or cleaning out dangling volumes.
  labels {
    label = "coder.workspace_name_at_creation"
    value = data.coder_workspace.me.name
  }
}

resource "docker_image" "main" {
  name = "coder-${data.coder_workspace.me.id}"
  build {
    context = "./build"
    build_args = {
      USER = local.username
    }
  }
  triggers = {
    dir_sha1 = sha1(join("", [for f in fileset(path.module, "build/*") : filesha1(f)]))
  }
}

resource "docker_container" "workspace" {
  count = data.coder_workspace.me.start_count
  image = docker_image.main.name
  # Uses lower() to avoid Docker restriction on container names.
  name = "coder-${data.coder_workspace.me.owner}-${lower(data.coder_workspace.me.name)}"
  # Hostname makes the shell more user friendly: coder@my-workspace:~$
  hostname = data.coder_workspace.me.name
  # Use the docker gateway if the access URL is 127.0.0.1
  entrypoint = ["sh", "-c", replace(coder_agent.main.init_script, "/localhost|127\\.0\\.0\\.1/", "host.docker.internal")]
  env        = ["CODER_AGENT_TOKEN=${coder_agent.main.token}"]
  host {
    host = "host.docker.internal"
    ip   = "host-gateway"
  }
  volumes {
    container_path = "/var/lib/mysql"
    volume_name    = docker_volume.database_volume.name
    read_only      = false
  }
  volumes {
    container_path = "/home/${local.username}"
    volume_name    = docker_volume.home_volume.name
    read_only      = false
  }
  # Add labels in Docker to keep track of orphan resources.
  labels {
    label = "coder.owner"
    value = data.coder_workspace.me.owner
  }
  labels {
    label = "coder.owner_id"
    value = data.coder_workspace.me.owner_id
  }
  labels {
    label = "coder.workspace_id"
    value = data.coder_workspace.me.id
  }
  labels {
    label = "coder.workspace_name"
    value = data.coder_workspace.me.name
  }
  networks_advanced {
    name = docker_network.private_network.name
  }
}

resource "docker_container" "mariadb" {
  image  = "mariadb:latest"
  name   = "mariadb-${lower(data.coder_workspace.me.owner)}-${lower(data.coder_workspace.me.name)}"
  hostname = data.coder_parameter.mariadb_hostname.value
  
  env    = [
    "MARIADB_ROOT_PASSWORD=${data.coder_parameter.mariadb_password.value}",
  ]
  host {
    host = "host.docker.internal"
    ip   = "host-gateway"
  }
  volumes {
    container_path = "/var/lib/mysql"
    volume_name    = docker_volume.database_volume.name
    read_only      = false
  }
  labels {
    label = "coder.owner"
    value = data.coder_workspace.me.owner
  }
  labels {
    label = "coder.owner_id"
    value = data.coder_workspace.me.owner_id
  }
  labels {
    label = "coder.workspace_id"
    value = data.coder_workspace.me.id
  }
  labels {
    label = "coder.workspace_name"
    value = data.coder_workspace.me.name
  }
  networks_advanced {
    name = docker_network.private_network.name
  }
}

[matifali]

You can create a 2nd coder_agent resource and attach that to your MariaDB container. Something like

...
resource "coder_agent" "mariadb" {
  arch                   = data.coder_provisioner.me.arch
  os                     = "linux"
  startup_script_timeout = 180
  startup_script         = <<-EOT
    set -e
    # Start your MariaDB here
    /usr/local/bin/docker-entrypoint.sh mariadbd > /dev/null 2>&1 &
  EOT
}

resource "docker_container" "mariadb" {
  image  = "mariadb:latest"
  name   = "mariadb-${lower(data.coder_workspace.me.owner)}-${lower(data.coder_workspace.me.name)}"
  hostname = data.coder_parameter.mariadb_hostname.value
  entrypoint = ["sh", "-c", coder_agent.mariadb.init_script ]
  env    = [
    "MARIADB_ROOT_PASSWORD=${data.coder_parameter.mariadb_password.value}",
    "CODER_AGENT_TOKEN=${coder_agent.mariadb.token}"
  ]
# rest of the block
}
...

I hope it helps. @Smallinger

Important

Note how we are executing the original ENTRYPOINT and CMD form mariadb:latest in startup_script.

[Smallinger]

hmm now i got error:

Workspace is unhealthy
Your workspace is running but 1 agent is unhealthy.

With the MariaDB container.

[matifali]

You have to play with the entrypoint to make init_script first to run. I haven't tested this but can test it tomorrow and can provide further insight.
Again the main idea is to make agent init script run as an entrypoint.

[Smallinger]

I believe that I'm slowly running out of ideas; no matter how hard I try, the container is always unhealthy. Either I'm doing something incredibly wrong, or I haven't found the right way yet.

[matifali]

any updates?

[Smallinger]

No, unfortunately not. I've been experimenting a bit more, but I keep ending up at the same point where it says "Workspace is unhealthy." I also tried it with BusyBox and other containers, but I'm getting the exact same error.

[jbalzar]

I was able to run a healthy second container by executing the docker entrypoint.

Try this on the agent:

startup_script         = <<-EOT
    set -e

    # execute docker entrypoint
    bash /usr/local/bin/docker-entrypoint.sh mariadbd > /tmp/docker-entrypoint.sh.log 2>&1 &
  EOT

[pasuder]

I did create extended template with sidecar docker:dind-rootless container as per documentation: https://coder.com/docs/v2/latest/templates/docker-in-workspaces#privileged-sidecar-container and also hit the issue with port forwarding from 2nd/sidecar container. I did manage to have 2nd coder_agent and wrapped entrypoint with coder_agent's init_script, but from time to time, I got issue with accessing editor via VSCoder's Coder extension. It seems that depends on the order of docker_container's, if sidecar container is on 1st place in Coder workspace view, VS Code tries to connect to sidecar, not workspace.

Question: is it possible to have two coder_agent's resources in template?

[pasuder]

Related to #10665