Monit, docker and httpd port

[Alberto Miorin]

I use supervisor to start monit inside containers, but with docker --net=host I need to manage manually the httpd port with environment variable MONIT_PORT. I would be nice to have a unix socket file alternative to http for the command line tool.

Workaround creating monitrc before starting monit.

#!/usr/bin/env bash

cat <<EOF > /etc/monit/monitrc
set daemon 120
set init
set logfile /var/log/monit.log
set idfile /var/lib/monit/id
set statefile /var/lib/monit/state
set eventqueue
    basedir /var/lib/monit/events
    slots 100
set httpd port ${MONIT_PORT:-2812} and
   use address localhost
   allow localhost
include /etc/monit/conf.d/*
EOF

exec 2>&1

rm -f /var/run/monit.pid
exec /usr/bin/monit -c /etc/monit/monitrc

[Tildeslash]

Could you elaborate more? How would a Unix Socket solve your problem? A Unix Socket is a hard coded path so won't you need to change this also?

[Alberto Miorin]

I have only one monit process per docker container.

1 container, 1 monit process and 1 monit socket. There would not be any conflict, because every monit process sees a different file system.

Sharing networking between containers creates conflicts if 2 monit processes try to bind the same tcp port (docker --net=host)

https://docs.docker.com/introduction/understanding-docker/#how-does-a-container-work

[Tildeslash]

If you bind Monit to localhost only then you should not expose the port, or am I missing something?

set httpd port 2812 and use address 127.0.0.1

Edit: Re-reading your post I guess the problem is, when sharing networking between containers the same localhost will be used by both containers and the port-number matters and also that a unix-socket would solve this. I see your point. If this is a common problem we should solve this. Optionally using unix-socket instead of TCP/localhost for the HTTP interface should not be too hard to implement either.

[Alberto Miorin]

Exactly.

[Tildeslash]

Hello Alberto,

we have implemented the unixsocket support for monit httpd, it will be part of next Monit release (5.12).

Syntax example:

set httpd
    unixsocket /var/run/monit.sock
    allow myuser:mypassword

[Alberto Miorin]

Thx!