github/dokku
0
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

fix: reject app-level vector-networks and vector-image, drop bridge from joined nets

Browse Source 
The Docker daemon refuses any endpoint settings on the default bridge network and `docker compose` unconditionally attaches the service name as an alias on every joined network, so combining bridge with user-defined networks via compose's `networks:` block is impossible. When `vector-networks` is set, the compose template now joins only the configured networks; outbound to external sinks still works through user-defined network NAT. Additionally, `vector-image` and `vector-networks` are both global-only but `common.CommandPropertySet` silently accepts them at app level by merging global-only keys into the valid-property set, so both now reject explicitly in `validateSetValue`.
This commit is contained in:
Jose Diaz-Gonzalez
2026-05-12 23:45:10 -04:00
parent d00a7d741a
commit a4e6d06fd1
4 changed files with 33 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
docs/deployment/logs.md
View File

@@ -182,7 +182,7 @@ dokku logs:set --global vector-image
By default, the Vector container runs with `network_mode: bridge` and can only reach app containers that are also on the default bridge network. Apps deployed onto a per-app network or a custom network - typically via `dokku network:set <app> initial-network <name>` - are not reachable from Vector over Docker's internal DNS, so sinks that need to talk to those apps directly (for example, an in-host log search service such as [Logpond](https://github.com/dokku/logpond)) would have to route traffic out through the external proxy.
The global `vector-networks` property accepts a comma-separated list of Docker networks that Vector should additionally join.
The global `vector-networks` property accepts a comma-separated list of Docker networks for Vector to join.
```shell
dokku logs:set --global vector-networks dokku-logs
@@ -194,6 +194,8 @@ Multiple networks may be specified by separating them with a comma.
dokku logs:set --global vector-networks dokku-logs,observability
```
Setting this property **replaces** the default bridge attachment: the Vector container will be on the configured user-defined networks only, not the default Docker `bridge` network. Outbound traffic continues to work through the user-defined networks' NAT, so external sinks such as Datadog or hosted HTTP endpoints remain reachable.
Each network must already exist; setting a non-existent network or the reserved `bridge` value will fail. The list can be cleared by setting an empty value, which restores the default `network_mode: bridge` configuration.
```shell