Docker : Envoy - Getting started

bogotobogo.com site search:

What is Envoy?

Envoy is an L7 proxy and it can be used for edge proxy, software load balancer, service message passing layer. It's an emerging alternative to nginx or haproxy or AWS ELB.

For more information, check Envoy- Comparison to similar systems.

Envoy Docker image

Envoy does not currently provide separate pre-built binaries, but does provide Docker images. This is the fastest way to get started using Envoy.

Get the Envoy image:

$ docker pull envoyproxy/envoy

Run Envoy in a detached mode:

$ docker run --rm -d -p 10000:10000 envoyproxy/envoy

$ docker ps
CONTAINER ID        IMAGE               COMMAND                  CREATED             STATUS              PORTS                      NAMES
79091b53792a        envoyproxy/envoy    "/usr/bin/dumb-init …"   5 seconds ago       Up 3 seconds        0.0.0.0:10000->10000/tcp   gifted_hermann

We used the "--rm" flag to automatically clean up the container and remove the file system when the container exits.

Access the container app via port 10000:

$ curl localhost:10000

Actually, the Docker image used will contain the latest version of Envoy and a basic Envoy configuration. This basic configuration tells Envoy to route incoming requests to *.google.com:

A very minimal Envoy configuration used is available in configs/google_com_proxy.v2.yaml.

Using the Envoy Docker Image

In this section, we'll build the Envoy image rather than using the pulled image.

Let's create a simple Dockerfile to execute Envoy:

FROM envoyproxy/envoy:latest
COPY envoy.yml /etc/envoy/envoy.yml

Note that the Dockerfile assumes that Envoy configuration file, envoy.yml, is in our local directory:

admin:
  access_log_path: /tmp/admin_access.log
  address:
    socket_address: { address: 0.0.0.0, port_value: 9901 }
static_resources:
  listeners:
  - name: listener_0
    address:
      socket_address: { address: 0.0.0.0, port_value: 10000 }
    filter_chains:
    - filters:
      - name: envoy.http_connection_manager
        config:
          stat_prefix: ingress_http
          route_config:
            name: local_route
            virtual_hosts:
            - name: local_service
              domains: ["*"]
              routes:
              - match: { prefix: "/" }
                route: { host_rewrite: www.google.com, cluster: service_google }
          http_filters:
          - name: envoy.router
  clusters:
  - name: service_google
    connect_timeout: 0.25s
    type: LOGICAL_DNS
    # Comment out the following line to test on v6 networks
    dns_lookup_family: V4_ONLY
    lb_policy: ROUND_ROBIN
    hosts: [{ socket_address: { address: google.com, port_value: 443 }}]
    tls_context: { sni: www.google.com }

The admin message is required to configure the administration server. The address key specifies the listening address which in this case is simply 0.0.0.0:9901.

The static_resources contains everything that is configured statically when Envoy starts, as opposed to the means of configuring resources dynamically when Envoy is running.

The rest of the configuration specifies the listeners and clusters.

Now we can build the Docker image that runs our configuration specified in the yaml file:

$ docker build -t envoy:v1 .
Sending build context to Docker daemon  4.096kB
Step 1/2 : FROM envoyproxy/envoy:latest
 ---> f809688737c5
Step 2/2 : COPY envoy.yml /etc/envoy/envoy.yml
 ---> dc052b57ff39
Successfully built dc052b57ff39
Successfully tagged envoy:v1

Create the container from the image and start it with:

$ docker run -d --name envoy -p 9901:9901 -p 10000:10000 envoy:v1

$ docker ps
CONTAINER ID  IMAGE     COMMAND                  CREATED         STATUS        PORTS                                              NAMES
3ffb67ab60ee  envoy:v1  "/usr/bin/dumb-init …"   6 seconds ago   Up 4 seconds  0.0.0.0:9901->9901/tcp, 0.0.0.0:10000->10000/tcp   envoy

Check if it is working: