Ebook Syafi - Edit Bab

Tajuk Bab

Urutan

Jenis

Kandungan HTML

<h1 id="bab-7-docker-lanjutan-dan-orkestrasi">Bab 7: Docker Lanjutan dan Orkestrasi</h1>
<figure><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 820 450" width="820" height="450">
 <defs>
 <linearGradient id="df-bg" x1="0%" y1="0%" x2="100%" y2="100%">
 <stop offset="0%" style="stop-color:#f8fafc"/>
 <stop offset="100%" style="stop-color:#eff6ff"/>
 </linearGradient>
 <filter id="df-shadow">
 <feDropShadow dx="0" dy="7" stdDeviation="9" flood-color="#0f172a" flood-opacity="0.12"/>
 </filter>
 </defs>

<rect width="820" height="450" rx="18" fill="url(#df-bg)"/>
 <text x="410" y="36" font-family="Arial, Helvetica, sans-serif" font-size="20" font-weight="bold" fill="#1e293b" text-anchor="middle">Aliran Rangkaian Docker Lanjutan</text>
 <text x="410" y="58" font-family="Arial, Helvetica, sans-serif" font-size="11" fill="#64748b" text-anchor="middle">Contoh visual untuk Traefik, rangkaian berbilang, pengesahan, dan lapisan database dalaman</text>

<g filter="url(#df-shadow)">
 <path d="M55 162c0-22 18-40 40-40 7-21 28-35 52-35 29 0 53 20 59 47 17 3 30 18 30 36 0 20-16 36-36 36H90c-19 0-35-15-35-34z" fill="#cbd5e1"/>
 <text x="145" y="148" font-family="Arial, Helvetica, sans-serif" font-size="16" font-weight="bold" fill="#1e293b" text-anchor="middle">Internet</text>
 <text x="145" y="168" font-family="Arial, Helvetica, sans-serif" font-size="11" fill="#475569" text-anchor="middle">HTTP, HTTPS, ACME</text>
 </g>

<g filter="url(#df-shadow)">
 <rect x="250" y="110" width="140" height="100" rx="18" fill="#0f766e"/>
 <text x="320" y="144" font-family="Arial, Helvetica, sans-serif" font-size="18" font-weight="bold" fill="#ffffff" text-anchor="middle">Traefik</text>
 <text x="320" y="166" font-family="Arial, Helvetica, sans-serif" font-size="11" fill="#ccfbf1" text-anchor="middle">TLS, routing, labels Docker</text>
 <text x="320" y="184" font-family="Arial, Helvetica, sans-serif" font-size="11" fill="#ccfbf1" text-anchor="middle">Dashboard dan ACME resolver</text>
 </g>

<g filter="url(#df-shadow)">
 <rect x="230" y="280" width="160" height="88" rx="18" fill="#7c3aed"/>
 <text x="310" y="311" font-family="Arial, Helvetica, sans-serif" font-size="16" font-weight="bold" fill="#ffffff" text-anchor="middle">Authelia</text>
 <text x="310" y="332" font-family="Arial, Helvetica, sans-serif" font-size="11" fill="#ede9fe" text-anchor="middle">SSO dan 2FA untuk servis</text>
 <text x="310" y="350" font-family="Arial, Helvetica, sans-serif" font-size="11" fill="#ede9fe" text-anchor="middle">Middleware keselamatan</text>
 </g>

<g filter="url(#df-shadow)">
 <rect x="450" y="78" width="320" height="165" rx="18" fill="#dbeafe" stroke="#60a5fa" stroke-width="2"/>
 <text x="610" y="105" font-family="Arial, Helvetica, sans-serif" font-size="14" font-weight="bold" fill="#1d4ed8" text-anchor="middle">Rangkaian Proxy / Frontend</text>

<rect x="470" y="122" width="90" height="82" rx="14" fill="#2563eb"/>
 <text x="515" y="151" font-family="Arial, Helvetica, sans-serif" font-size="14" font-weight="bold" fill="#ffffff" text-anchor="middle">Nextcloud</text>
 <text x="515" y="172" font-family="Arial, Helvetica, sans-serif" font-size="10" fill="#dbeafe" text-anchor="middle">cloud.lab.local</text>

<rect x="565" y="122" width="90" height="82" rx="14" fill="#4f46e5"/>
 <text x="610" y="151" font-family="Arial, Helvetica, sans-serif" font-size="14" font-weight="bold" fill="#ffffff" text-anchor="middle">Gitea</text>
 <text x="610" y="172" font-family="Arial, Helvetica, sans-serif" font-size="10" fill="#e0e7ff" text-anchor="middle">git.lab.local</text>

<rect x="660" y="122" width="90" height="82" rx="14" fill="#0f766e"/>
 <text x="705" y="151" font-family="Arial, Helvetica, sans-serif" font-size="14" font-weight="bold" fill="#ffffff" text-anchor="middle">Vaultwarden</text>
 <text x="705" y="172" font-family="Arial, Helvetica, sans-serif" font-size="10" fill="#ccfbf1" text-anchor="middle">vault.lab.local</text>
 </g>

<g filter="url(#df-shadow)">
 <rect x="450" y="286" width="320" height="120" rx="18" fill="#ede9fe" stroke="#8b5cf6" stroke-width="2"/>
 <text x="610" y="312" font-family="Arial, Helvetica, sans-serif" font-size="14" font-weight="bold" fill="#6d28d9" text-anchor="middle">Rangkaian Backend / Internal</text>

<rect x="485" y="332" width="110" height="46" rx="12" fill="#7c3aed"/>
 <text x="540" y="360" font-family="Arial, Helvetica, sans-serif" font-size="13" font-weight="bold" fill="#ffffff" text-anchor="middle">MariaDB</text>

<rect x="625" y="332" width="110" height="46" rx="12" fill="#334155"/>
 <text x="680" y="360" font-family="Arial, Helvetica, sans-serif" font-size="13" font-weight="bold" fill="#ffffff" text-anchor="middle">Redis</text>
 </g>

<text x="515" y="274" font-family="Arial, Helvetica, sans-serif" font-size="11" fill="#64748b" text-anchor="middle">Akses aplikasi melalui hostname dan labels</text>
 <text x="635" y="274" font-family="Arial, Helvetica, sans-serif" font-size="11" fill="#64748b" text-anchor="middle">Servis hanya melihat database yang diperlukan</text>
</svg>
<figcaption>Aliran Rangkaian Docker Lanjutan</figcaption></figure>
Anda dah selesa dengan Docker Compose asas? Bagus! Sekarang kita naikkan level sedikit. Bab ni akan tunjukkan macam mana nak buat setup Docker anda lebih profesional — reverse proxy, health check, backup, dan pengurusan berbilang host.
Tapi ingat, semua ni optional. Guna bila ada keperluan sebenar, bukan sebab nampak cool.
Apa yang anda akan belajar:
<ul>
<li>Bila patut guna Traefik, Macvlan, Swarm, dan Health Check</li>
<li>Cara mengembangkan setup Docker tanpa jadi serabut</li>
<li>Cara merancang backup dan migrasi service dengan lebih yakin</li>
</ul>
<h2 id="cara-ikut-bab-ini">Cara Ikut Bab Ini</h2>
<ol type="1">
<li>Pastikan anda benar-benar selesa dengan Docker Compose asas dahulu.</li>
<li>Tambah komponen lanjutan satu demi satu, bukan serentak.</li>
<li>Uji backup dan restore, bukan sekadar simpan fail config.</li>
</ol>
<blockquote>
Nota Beginner: Anda tidak perlu Traefik, Macvlan, atau Swarm pada hari pertama. Guna bila ada masalah sebenar yang ia boleh selesaikan. Contohnya, Traefik berguna bila anda dah ada banyak service dan penat taip port number setiap kali.
</blockquote>
<h3 id="laluan-paling-mudah-untuk-beginner">Laluan Paling Mudah untuk Beginner</h3>
<ul>
<li>Jika Docker Compose asas pun belum selesa, belum perlu masuk bab ini terlalu dalam.</li>
<li>Mulakan dengan reverse proxy atau backup, bukan terus ke Swarm.</li>
<li>Pastikan anda tahu restore satu service sebelum anda cuba scale banyak service.</li>
</ul>
<h2 id="langkah-1-docker-networks-lanjutan">Langkah 1: Docker Networks Lanjutan</h2>
<h3 id="memahami-jenis-rangkaian-docker">Memahami Jenis Rangkaian Docker</h3>
Docker menyokong beberapa pemacu rangkaian. Setiap satu ada tujuan tersendiri.
Bridge (Default):
Ini rangkaian yang paling biasa. Container dalam rangkaian bridge boleh bercakap antara satu sama lain menggunakan nama container sebagai hostname.
<div class="sourceCode" id="cb1"><pre class="sourceCode bash"><code class="sourceCode bash"><a href="#cb1-1" aria-hidden="true" tabindex="-1"></a># Rangkaian bridge lalai
<a href="#cb1-2" aria-hidden="true" tabindex="-1"></a>docker network create --driver bridge my-network
<a href="#cb1-3" aria-hidden="true" tabindex="-1"></a>
<a href="#cb1-4" aria-hidden="true" tabindex="-1"></a># Container dalam rangkaian bridge boleh berkomunikasi
<a href="#cb1-5" aria-hidden="true" tabindex="-1"></a># menggunakan nama container sebagai hostname</code></pre></div>
Host:
Container guna rangkaian host terus — macam app biasa yang jalan terus pada server.
<div class="sourceCode" id="cb2"><pre class="sourceCode bash"><code class="sourceCode bash"><a href="#cb2-1" aria-hidden="true" tabindex="-1"></a># Container berkongsi rangkaian host terus
<a href="#cb2-2" aria-hidden="true" tabindex="-1"></a># Tiada pengasingan rangkaian, tetapi prestasi terbaik
<a href="#cb2-3" aria-hidden="true" tabindex="-1"></a>docker run --network host nginx</code></pre></div>
Macvlan:
Setiap container dapat alamat MAC dan IP sendiri. Pada rangkaian, ia nampak macam peranti fizikal yang berasingan.
<div class="sourceCode" id="cb3"><pre class="sourceCode bash"><code class="sourceCode bash"><a href="#cb3-1" aria-hidden="true" tabindex="-1"></a># Setiap container mendapat alamat MAC dan IP sendiri
<a href="#cb3-2" aria-hidden="true" tabindex="-1"></a># Kelihatan seperti peranti fizikal pada rangkaian
<a href="#cb3-3" aria-hidden="true" tabindex="-1"></a>docker network create -d macvlan \
<a href="#cb3-4" aria-hidden="true" tabindex="-1"></a> --subnet=10.0.0.0/24 \
<a href="#cb3-5" aria-hidden="true" tabindex="-1"></a> --gateway=10.0.0.1 \
<a href="#cb3-6" aria-hidden="true" tabindex="-1"></a> -o parent=eth0 \
<a href="#cb3-7" aria-hidden="true" tabindex="-1"></a> my-macvlan</code></pre></div>
Macvlan sangat berguna untuk perkhidmatan yang memerlukan kehadiran pada rangkaian fizikal, seperti Pi-hole atau Home Assistant.
<blockquote>
Nota Beginner: Untuk kebanyakan kes, rangkaian bridge sudah cukup. Guna Macvlan hanya bila service anda perlu IP tersendiri pada rangkaian rumah — contohnya Pi-hole yang perlu jadi DNS server untuk semua peranti.
</blockquote>
IPvlan:
<div class="sourceCode" id="cb4"><pre class="sourceCode bash"><code class="sourceCode bash"><a href="#cb4-1" aria-hidden="true" tabindex="-1"></a># Serupa dengan Macvlan tetapi berkongsi alamat MAC host
<a href="#cb4-2" aria-hidden="true" tabindex="-1"></a># Berguna apabila switch mengehadkan MAC per port
<a href="#cb4-3" aria-hidden="true" tabindex="-1"></a>docker network create -d ipvlan \
<a href="#cb4-4" aria-hidden="true" tabindex="-1"></a> --subnet=10.0.0.0/24 \
<a href="#cb4-5" aria-hidden="true" tabindex="-1"></a> --gateway=10.0.0.1 \
<a href="#cb4-6" aria-hidden="true" tabindex="-1"></a> -o parent=eth0 \
<a href="#cb4-7" aria-hidden="true" tabindex="-1"></a> my-ipvlan</code></pre></div>
<h3 id="rangkaian-berbilang-dalam-docker-compose">Rangkaian Berbilang dalam Docker Compose</h3>
Ini contoh yang sangat praktikal — asingkan traffic antara frontend, backend, dan database.
<div class="sourceCode" id="cb5"><pre class="sourceCode yaml"><code class="sourceCode yaml"><a href="#cb5-1" aria-hidden="true" tabindex="-1"></a>services:
<a href="#cb5-2" aria-hidden="true" tabindex="-1"></a> traefik:
<a href="#cb5-3" aria-hidden="true" tabindex="-1"></a> image: traefik:latest
<a href="#cb5-4" aria-hidden="true" tabindex="-1"></a> networks:
<a href="#cb5-5" aria-hidden="true" tabindex="-1"></a> - frontend
<a href="#cb5-6" aria-hidden="true" tabindex="-1"></a> - backend
<a href="#cb5-7" aria-hidden="true" tabindex="-1"></a>
<a href="#cb5-8" aria-hidden="true" tabindex="-1"></a> nextcloud:
<a href="#cb5-9" aria-hidden="true" tabindex="-1"></a> image: nextcloud:latest
<a href="#cb5-10" aria-hidden="true" tabindex="-1"></a> networks:
<a href="#cb5-11" aria-hidden="true" tabindex="-1"></a> - backend
<a href="#cb5-12" aria-hidden="true" tabindex="-1"></a> - database
<a href="#cb5-13" aria-hidden="true" tabindex="-1"></a>
<a href="#cb5-14" aria-hidden="true" tabindex="-1"></a> db:
<a href="#cb5-15" aria-hidden="true" tabindex="-1"></a> image: mariadb:latest
<a href="#cb5-16" aria-hidden="true" tabindex="-1"></a> networks:
<a href="#cb5-17" aria-hidden="true" tabindex="-1"></a> - database # Hanya boleh diakses oleh nextcloud
<a href="#cb5-18" aria-hidden="true" tabindex="-1"></a>
<a href="#cb5-19" aria-hidden="true" tabindex="-1"></a>networks:
<a href="#cb5-20" aria-hidden="true" tabindex="-1"></a> frontend:
<a href="#cb5-21" aria-hidden="true" tabindex="-1"></a> driver: bridge
<a href="#cb5-22" aria-hidden="true" tabindex="-1"></a> backend:
<a href="#cb5-23" aria-hidden="true" tabindex="-1"></a> driver: bridge
<a href="#cb5-24" aria-hidden="true" tabindex="-1"></a> database:
<a href="#cb5-25" aria-hidden="true" tabindex="-1"></a> driver: bridge
<a href="#cb5-26" aria-hidden="true" tabindex="-1"></a> internal: true # Tiada akses ke internet</code></pre></div>
Dengan konfigurasi ini: - Traefik boleh berkomunikasi dengan Nextcloud (melalui <code>backend</code>) - Nextcloud boleh berkomunikasi dengan MariaDB (melalui <code>database</code>) - MariaDB TIDAK boleh diakses terus dari luar (rangkaian <code>internal</code>)
Tip dari saya — walaupun dalam homelab, asingkan database dari internet. Ini amalan keselamatan yang baik dan senang nak buat.
<h2 id="langkah-2-reverse-proxy-dengan-traefik">Langkah 2: Reverse Proxy dengan Traefik</h2>
<h3 id="mengapa-traefik">Mengapa Traefik?</h3>
Bayangkan anda ada 10 service Docker. Tanpa reverse proxy, anda kena ingat port setiap satu — <code>server:8080</code> untuk Nextcloud, <code>server:3000</code> untuk Gitea, <code>server:8096</code> untuk Jellyfin… penat kan?
Dengan Traefik, anda boleh guna nama domain: <code>cloud.lab.local</code>, <code>git.lab.local</code>, <code>media.lab.local</code>. Lebih kemas dan mudah diingat.
Traefik ialah reverse proxy moden yang menawarkan: - Pengesanan automatik container Docker (tiada konfigurasi manual) - Sijil SSL automatik (Let’s Encrypt) - Dashboard masa nyata - Middleware (pengesahan, rate limiting, dll.)
<h3 id="konfigurasi-traefik-lengkap">Konfigurasi Traefik Lengkap</h3>
<div class="sourceCode" id="cb6"><pre class="sourceCode yaml"><code class="sourceCode yaml"><a href="#cb6-1" aria-hidden="true" tabindex="-1"></a># docker-compose.yml
<a href="#cb6-2" aria-hidden="true" tabindex="-1"></a>services:
<a href="#cb6-3" aria-hidden="true" tabindex="-1"></a> traefik:
<a href="#cb6-4" aria-hidden="true" tabindex="-1"></a> image: traefik:latest
<a href="#cb6-5" aria-hidden="true" tabindex="-1"></a> container_name: traefik
<a href="#cb6-6" aria-hidden="true" tabindex="-1"></a> ports:
<a href="#cb6-7" aria-hidden="true" tabindex="-1"></a> - "80:80"
<a href="#cb6-8" aria-hidden="true" tabindex="-1"></a> - "443:443"
<a href="#cb6-9" aria-hidden="true" tabindex="-1"></a> - "8080:8080" # Dashboard
<a href="#cb6-10" aria-hidden="true" tabindex="-1"></a> volumes:
<a href="#cb6-11" aria-hidden="true" tabindex="-1"></a> - /var/run/docker.sock:/var/run/docker.sock:ro
<a href="#cb6-12" aria-hidden="true" tabindex="-1"></a> - ./traefik/traefik.yml:/etc/traefik/traefik.yml
<a href="#cb6-13" aria-hidden="true" tabindex="-1"></a> - ./traefik/acme.json:/acme.json
<a href="#cb6-14" aria-hidden="true" tabindex="-1"></a> networks:
<a href="#cb6-15" aria-hidden="true" tabindex="-1"></a> - proxy
<a href="#cb6-16" aria-hidden="true" tabindex="-1"></a> restart: unless-stopped
<a href="#cb6-17" aria-hidden="true" tabindex="-1"></a> labels:
<a href="#cb6-18" aria-hidden="true" tabindex="-1"></a> - "traefik.enable=true"
<a href="#cb6-19" aria-hidden="true" tabindex="-1"></a> - "traefik.http.routers.dashboard.rule=Host(`traefik.lab.local`)"
<a href="#cb6-20" aria-hidden="true" tabindex="-1"></a> - "traefik.http.routers.dashboard.service=api@internal"
<a href="#cb6-21" aria-hidden="true" tabindex="-1"></a>
<a href="#cb6-22" aria-hidden="true" tabindex="-1"></a>networks:
<a href="#cb6-23" aria-hidden="true" tabindex="-1"></a> proxy:
<a href="#cb6-24" aria-hidden="true" tabindex="-1"></a> external: true</code></pre></div>
<div class="sourceCode" id="cb7"><pre class="sourceCode yaml"><code class="sourceCode yaml"><a href="#cb7-1" aria-hidden="true" tabindex="-1"></a># traefik/traefik.yml
<a href="#cb7-2" aria-hidden="true" tabindex="-1"></a>api:
<a href="#cb7-3" aria-hidden="true" tabindex="-1"></a> dashboard: true
<a href="#cb7-4" aria-hidden="true" tabindex="-1"></a> insecure: true
<a href="#cb7-5" aria-hidden="true" tabindex="-1"></a>
<a href="#cb7-6" aria-hidden="true" tabindex="-1"></a>entryPoints:
<a href="#cb7-7" aria-hidden="true" tabindex="-1"></a> web:
<a href="#cb7-8" aria-hidden="true" tabindex="-1"></a> address: ":80"
<a href="#cb7-9" aria-hidden="true" tabindex="-1"></a> http:
<a href="#cb7-10" aria-hidden="true" tabindex="-1"></a> redirections:
<a href="#cb7-11" aria-hidden="true" tabindex="-1"></a> entryPoint:
<a href="#cb7-12" aria-hidden="true" tabindex="-1"></a> to: websecure
<a href="#cb7-13" aria-hidden="true" tabindex="-1"></a> scheme: https
<a href="#cb7-14" aria-hidden="true" tabindex="-1"></a> websecure:
<a href="#cb7-15" aria-hidden="true" tabindex="-1"></a> address: ":443"
<a href="#cb7-16" aria-hidden="true" tabindex="-1"></a>
<a href="#cb7-17" aria-hidden="true" tabindex="-1"></a>providers:
<a href="#cb7-18" aria-hidden="true" tabindex="-1"></a> docker:
<a href="#cb7-19" aria-hidden="true" tabindex="-1"></a> endpoint: "unix:///var/run/docker.sock"
<a href="#cb7-20" aria-hidden="true" tabindex="-1"></a> exposedByDefault: false
<a href="#cb7-21" aria-hidden="true" tabindex="-1"></a> network: proxy
<a href="#cb7-22" aria-hidden="true" tabindex="-1"></a>
<a href="#cb7-23" aria-hidden="true" tabindex="-1"></a>certificatesResolvers:
<a href="#cb7-24" aria-hidden="true" tabindex="-1"></a> letsencrypt:
<a href="#cb7-25" aria-hidden="true" tabindex="-1"></a> acme:
<a href="#cb7-26" aria-hidden="true" tabindex="-1"></a> email: admin@domain.com
<a href="#cb7-27" aria-hidden="true" tabindex="-1"></a> storage: /acme.json
<a href="#cb7-28" aria-hidden="true" tabindex="-1"></a> httpChallenge:
<a href="#cb7-29" aria-hidden="true" tabindex="-1"></a> entryPoint: web</code></pre></div>
<blockquote>
Nota Beginner: Jangan risau kalau config Traefik nampak panjang. Anda hanya perlu setup sekali, dan selepas tu menambah service baru sangat mudah — cuma tambah beberapa baris label sahaja.
</blockquote>
Menambah perkhidmatan ke Traefik:
Nampak tak betapa mudahnya? Cuma tambah <code>labels</code> pada service dan Traefik akan auto-detect.
<div class="sourceCode" id="cb8"><pre class="sourceCode yaml"><code class="sourceCode yaml"><a href="#cb8-1" aria-hidden="true" tabindex="-1"></a>services:
<a href="#cb8-2" aria-hidden="true" tabindex="-1"></a> nextcloud:
<a href="#cb8-3" aria-hidden="true" tabindex="-1"></a> image: nextcloud:latest
<a href="#cb8-4" aria-hidden="true" tabindex="-1"></a> container_name: nextcloud
<a href="#cb8-5" aria-hidden="true" tabindex="-1"></a> networks:
<a href="#cb8-6" aria-hidden="true" tabindex="-1"></a> - proxy
<a href="#cb8-7" aria-hidden="true" tabindex="-1"></a> labels:
<a href="#cb8-8" aria-hidden="true" tabindex="-1"></a> - "traefik.enable=true"
<a href="#cb8-9" aria-hidden="true" tabindex="-1"></a> - "traefik.http.routers.nextcloud.rule=Host(`cloud.lab.local`)"
<a href="#cb8-10" aria-hidden="true" tabindex="-1"></a> - "traefik.http.routers.nextcloud.tls=true"
<a href="#cb8-11" aria-hidden="true" tabindex="-1"></a> - "traefik.http.routers.nextcloud.tls.certresolver=letsencrypt"
<a href="#cb8-12" aria-hidden="true" tabindex="-1"></a> - "traefik.http.services.nextcloud.loadbalancer.server.port=80"
<a href="#cb8-13" aria-hidden="true" tabindex="-1"></a> restart: unless-stopped</code></pre></div>
<h3 id="middleware-traefik">Middleware Traefik</h3>
Basic Auth:
<div class="sourceCode" id="cb9"><pre class="sourceCode yaml"><code class="sourceCode yaml"><a href="#cb9-1" aria-hidden="true" tabindex="-1"></a>labels:
<a href="#cb9-2" aria-hidden="true" tabindex="-1"></a> - "traefik.http.middlewares.auth.basicauth.users=admin:$$apr1$$hash"
<a href="#cb9-3" aria-hidden="true" tabindex="-1"></a> - "traefik.http.routers.app.middlewares=auth"</code></pre></div>
Rate Limiting:
<div class="sourceCode" id="cb10"><pre class="sourceCode yaml"><code class="sourceCode yaml"><a href="#cb10-1" aria-hidden="true" tabindex="-1"></a>labels:
<a href="#cb10-2" aria-hidden="true" tabindex="-1"></a> - "traefik.http.middlewares.ratelimit.ratelimit.average=100"
<a href="#cb10-3" aria-hidden="true" tabindex="-1"></a> - "traefik.http.middlewares.ratelimit.ratelimit.burst=50"</code></pre></div>
Authelia — SSO untuk Homelab:
Authelia menyediakan Single Sign-On (SSO) dan pengesahan dua faktor untuk semua service anda. Satu login untuk semua — macam Google account tapi untuk homelab anda sendiri.
<div class="sourceCode" id="cb11"><pre class="sourceCode yaml"><code class="sourceCode yaml"><a href="#cb11-1" aria-hidden="true" tabindex="-1"></a>services:
<a href="#cb11-2" aria-hidden="true" tabindex="-1"></a> authelia:
<a href="#cb11-3" aria-hidden="true" tabindex="-1"></a> image: authelia/authelia:latest
<a href="#cb11-4" aria-hidden="true" tabindex="-1"></a> container_name: authelia
<a href="#cb11-5" aria-hidden="true" tabindex="-1"></a> volumes:
<a href="#cb11-6" aria-hidden="true" tabindex="-1"></a> - ./authelia/config:/config
<a href="#cb11-7" aria-hidden="true" tabindex="-1"></a> networks:
<a href="#cb11-8" aria-hidden="true" tabindex="-1"></a> - proxy
<a href="#cb11-9" aria-hidden="true" tabindex="-1"></a> labels:
<a href="#cb11-10" aria-hidden="true" tabindex="-1"></a> - "traefik.enable=true"
<a href="#cb11-11" aria-hidden="true" tabindex="-1"></a> - "traefik.http.routers.authelia.rule=Host(`auth.lab.local`)"
<a href="#cb11-12" aria-hidden="true" tabindex="-1"></a> - "traefik.http.routers.authelia.tls=true"
<a href="#cb11-13" aria-hidden="true" tabindex="-1"></a> restart: unless-stopped</code></pre></div>
<div class="sourceCode" id="cb12"><pre class="sourceCode yaml"><code class="sourceCode yaml"><a href="#cb12-1" aria-hidden="true" tabindex="-1"></a># authelia/config/configuration.yml
<a href="#cb12-2" aria-hidden="true" tabindex="-1"></a>server:
<a href="#cb12-3" aria-hidden="true" tabindex="-1"></a> address: 'tcp://0.0.0.0:9091/'
<a href="#cb12-4" aria-hidden="true" tabindex="-1"></a>
<a href="#cb12-5" aria-hidden="true" tabindex="-1"></a>log:
<a href="#cb12-6" aria-hidden="true" tabindex="-1"></a> level: info
<a href="#cb12-7" aria-hidden="true" tabindex="-1"></a>
<a href="#cb12-8" aria-hidden="true" tabindex="-1"></a>authentication_backend:
<a href="#cb12-9" aria-hidden="true" tabindex="-1"></a> file:
<a href="#cb12-10" aria-hidden="true" tabindex="-1"></a> path: /config/users_database.yml
<a href="#cb12-11" aria-hidden="true" tabindex="-1"></a>
<a href="#cb12-12" aria-hidden="true" tabindex="-1"></a>access_control:
<a href="#cb12-13" aria-hidden="true" tabindex="-1"></a> default_policy: deny
<a href="#cb12-14" aria-hidden="true" tabindex="-1"></a> rules:
<a href="#cb12-15" aria-hidden="true" tabindex="-1"></a> - domain: "*.lab.local"
<a href="#cb12-16" aria-hidden="true" tabindex="-1"></a> policy: two_factor
<a href="#cb12-17" aria-hidden="true" tabindex="-1"></a>
<a href="#cb12-18" aria-hidden="true" tabindex="-1"></a>session:
<a href="#cb12-19" aria-hidden="true" tabindex="-1"></a> name: authelia_session
<a href="#cb12-20" aria-hidden="true" tabindex="-1"></a> domain: lab.local
<a href="#cb12-21" aria-hidden="true" tabindex="-1"></a> expiration: 1h
<a href="#cb12-22" aria-hidden="true" tabindex="-1"></a> inactivity: 5m
<a href="#cb12-23" aria-hidden="true" tabindex="-1"></a>
<a href="#cb12-24" aria-hidden="true" tabindex="-1"></a>storage:
<a href="#cb12-25" aria-hidden="true" tabindex="-1"></a> local:
<a href="#cb12-26" aria-hidden="true" tabindex="-1"></a> path: /config/db.sqlite3
<a href="#cb12-27" aria-hidden="true" tabindex="-1"></a>
<a href="#cb12-28" aria-hidden="true" tabindex="-1"></a>notifier:
<a href="#cb12-29" aria-hidden="true" tabindex="-1"></a> filesystem:
<a href="#cb12-30" aria-hidden="true" tabindex="-1"></a> filename: /config/notification.txt</code></pre></div>
<h2 id="langkah-3-docker-health-checks">Langkah 3: Docker Health Checks</h2>
Health check memastikan container bukan sahaja berjalan, tetapi juga benar-benar berfungsi dengan betul. Ada perbezaan besar antara “container is running” dan “service is actually working”.
Dari pengalaman saya, health check sangat berguna untuk container yang kadang-kadang hang tapi masih nampak “up” dalam <code>docker ps</code>.
<div class="sourceCode" id="cb13"><pre class="sourceCode yaml"><code class="sourceCode yaml"><a href="#cb13-1" aria-hidden="true" tabindex="-1"></a>services:
<a href="#cb13-2" aria-hidden="true" tabindex="-1"></a> nextcloud:
<a href="#cb13-3" aria-hidden="true" tabindex="-1"></a> image: nextcloud:latest
<a href="#cb13-4" aria-hidden="true" tabindex="-1"></a> healthcheck:
<a href="#cb13-5" aria-hidden="true" tabindex="-1"></a> test: ["CMD", "curl", "-f", "http://localhost/status.php"]
<a href="#cb13-6" aria-hidden="true" tabindex="-1"></a> interval: 30s
<a href="#cb13-7" aria-hidden="true" tabindex="-1"></a> timeout: 10s
<a href="#cb13-8" aria-hidden="true" tabindex="-1"></a> retries: 3
<a href="#cb13-9" aria-hidden="true" tabindex="-1"></a> start_period: 60s
<a href="#cb13-10" aria-hidden="true" tabindex="-1"></a>
<a href="#cb13-11" aria-hidden="true" tabindex="-1"></a> mariadb:
<a href="#cb13-12" aria-hidden="true" tabindex="-1"></a> image: mariadb:latest
<a href="#cb13-13" aria-hidden="true" tabindex="-1"></a> healthcheck:
<a href="#cb13-14" aria-hidden="true" tabindex="-1"></a> test: ["CMD", "healthcheck.sh", "--connect", "--innodb_initialized"]
<a href="#cb13-15" aria-hidden="true" tabindex="-1"></a> interval: 30s
<a href="#cb13-16" aria-hidden="true" tabindex="-1"></a> timeout: 10s
<a href="#cb13-17" aria-hidden="true" tabindex="-1"></a> retries: 3</code></pre></div>
Kebergantungan berdasarkan kesihatan:
Ini sangat berguna — pastikan database dah siap sebelum app cuba connect.
<div class="sourceCode" id="cb14"><pre class="sourceCode yaml"><code class="sourceCode yaml"><a href="#cb14-1" aria-hidden="true" tabindex="-1"></a>services:
<a href="#cb14-2" aria-hidden="true" tabindex="-1"></a> nextcloud:
<a href="#cb14-3" aria-hidden="true" tabindex="-1"></a> depends_on:
<a href="#cb14-4" aria-hidden="true" tabindex="-1"></a> mariadb:
<a href="#cb14-5" aria-hidden="true" tabindex="-1"></a> condition: service_healthy
<a href="#cb14-6" aria-hidden="true" tabindex="-1"></a> redis:
<a href="#cb14-7" aria-hidden="true" tabindex="-1"></a> condition: service_started</code></pre></div>
<blockquote>
Nota Beginner: <code>start_period</code> memberi masa untuk container “warm up” sebelum health check mula berjalan. Contohnya, database mungkin ambil 30-60 saat untuk sedia. Tanpa start_period, health check akan report “unhealthy” padahal container tu sedang start.
</blockquote>
<h2 id="langkah-4-pengurusan-berbilang-host">Langkah 4: Pengurusan Berbilang Host</h2>
<h3 id="docker-swarm">Docker Swarm</h3>
Docker Swarm membolehkan anda menjalankan container merentasi berbilang server. Kalau satu server down, container boleh dipindahkan ke server lain secara automatik.
Saya cadangkan Swarm hanya kalau anda dah ada 2-3 server dan benar-benar perlu HA (High Availability). Untuk satu server, Docker Compose sahaja dah cukup.
<div class="sourceCode" id="cb15"><pre class="sourceCode bash"><code class="sourceCode bash"><a href="#cb15-1" aria-hidden="true" tabindex="-1"></a># Inisialisasi Swarm pada node pengurus
<a href="#cb15-2" aria-hidden="true" tabindex="-1"></a>docker swarm init --advertise-addr 10.0.20.20
<a href="#cb15-3" aria-hidden="true" tabindex="-1"></a>
<a href="#cb15-4" aria-hidden="true" tabindex="-1"></a># Tambah node pekerja
<a href="#cb15-5" aria-hidden="true" tabindex="-1"></a>docker swarm join --token TOKEN 10.0.20.20:2377
<a href="#cb15-6" aria-hidden="true" tabindex="-1"></a>
<a href="#cb15-7" aria-hidden="true" tabindex="-1"></a># Deploy stack
<a href="#cb15-8" aria-hidden="true" tabindex="-1"></a>docker stack deploy -c docker-compose.yml homelab
<a href="#cb15-9" aria-hidden="true" tabindex="-1"></a>
<a href="#cb15-10" aria-hidden="true" tabindex="-1"></a># Senarai perkhidmatan
<a href="#cb15-11" aria-hidden="true" tabindex="-1"></a>docker service ls</code></pre></div>
<h3 id="portainer-untuk-pengurusan-visual">Portainer untuk Pengurusan Visual</h3>
Portainer menyediakan antara muka web untuk mengurus Docker. Kalau anda lebih selesa dengan GUI, ini wajib ada.
<div class="sourceCode" id="cb16"><pre class="sourceCode yaml"><code class="sourceCode yaml"><a href="#cb16-1" aria-hidden="true" tabindex="-1"></a>services:
<a href="#cb16-2" aria-hidden="true" tabindex="-1"></a> portainer:
<a href="#cb16-3" aria-hidden="true" tabindex="-1"></a> image: portainer/portainer-ce:latest
<a href="#cb16-4" aria-hidden="true" tabindex="-1"></a> container_name: portainer
<a href="#cb16-5" aria-hidden="true" tabindex="-1"></a> ports:
<a href="#cb16-6" aria-hidden="true" tabindex="-1"></a> - "9443:9443"
<a href="#cb16-7" aria-hidden="true" tabindex="-1"></a> volumes:
<a href="#cb16-8" aria-hidden="true" tabindex="-1"></a> - /var/run/docker.sock:/var/run/docker.sock
<a href="#cb16-9" aria-hidden="true" tabindex="-1"></a> - portainer_data:/data
<a href="#cb16-10" aria-hidden="true" tabindex="-1"></a> restart: unless-stopped
<a href="#cb16-11" aria-hidden="true" tabindex="-1"></a>
<a href="#cb16-12" aria-hidden="true" tabindex="-1"></a>volumes:
<a href="#cb16-13" aria-hidden="true" tabindex="-1"></a> portainer_data:</code></pre></div>
Ciri Portainer: - Pengurusan container visual - Melihat log dan statistik - Terminal web ke dalam container - Pengurusan imej dan rangkaian - Sokongan Docker Swarm dan Kubernetes - Template aplikasi (deploy 1 klik)
<blockquote>
Nota Beginner: Portainer sangat membantu untuk visualize apa yang berlaku dalam Docker anda. Tapi belajar CLI juga ya — nanti dalam kerja sebenar, tak semua environment ada GUI.
</blockquote>
<h2 id="langkah-5-membina-imej-docker-sendiri">Langkah 5: Membina Imej Docker Sendiri</h2>
Kadang-kadang, imej yang ada di Docker Hub tak cukup untuk keperluan anda. Jadi anda perlu bina sendiri.
<h3 id="dockerfile-asas">Dockerfile Asas</h3>
<div class="sourceCode" id="cb17"><pre class="sourceCode dockerfile"><code class="sourceCode dockerfile"><a href="#cb17-1" aria-hidden="true" tabindex="-1"></a># Contoh: Aplikasi Python
<a href="#cb17-2" aria-hidden="true" tabindex="-1"></a>FROM python:3.12-slim
<a href="#cb17-3" aria-hidden="true" tabindex="-1"></a>
<a href="#cb17-4" aria-hidden="true" tabindex="-1"></a>WORKDIR /app
<a href="#cb17-5" aria-hidden="true" tabindex="-1"></a>
<a href="#cb17-6" aria-hidden="true" tabindex="-1"></a>COPY requirements.txt .
<a href="#cb17-7" aria-hidden="true" tabindex="-1"></a>RUN pip install --no-cache-dir -r requirements.txt
<a href="#cb17-8" aria-hidden="true" tabindex="-1"></a>
<a href="#cb17-9" aria-hidden="true" tabindex="-1"></a>COPY . .
<a href="#cb17-10" aria-hidden="true" tabindex="-1"></a>
<a href="#cb17-11" aria-hidden="true" tabindex="-1"></a>EXPOSE 8000
<a href="#cb17-12" aria-hidden="true" tabindex="-1"></a>
<a href="#cb17-13" aria-hidden="true" tabindex="-1"></a>HEALTHCHECK --interval=30s --timeout=10s --retries=3 \
<a href="#cb17-14" aria-hidden="true" tabindex="-1"></a> CMD curl -f http://localhost:8000/health || exit 1
<a href="#cb17-15" aria-hidden="true" tabindex="-1"></a>
<a href="#cb17-16" aria-hidden="true" tabindex="-1"></a>USER 1000:1000
<a href="#cb17-17" aria-hidden="true" tabindex="-1"></a>
<a href="#cb17-18" aria-hidden="true" tabindex="-1"></a>CMD ["python", "app.py"]</code></pre></div>
<h3 id="amalan-terbaik-dockerfile">Amalan Terbaik Dockerfile</h3>
<div class="sourceCode" id="cb18"><pre class="sourceCode dockerfile"><code class="sourceCode dockerfile"><a href="#cb18-1" aria-hidden="true" tabindex="-1"></a># 1. Gunakan imej asas yang kecil
<a href="#cb18-2" aria-hidden="true" tabindex="-1"></a>FROM alpine:3.19 # ~5MB
<a href="#cb18-3" aria-hidden="true" tabindex="-1"></a># bukan
<a href="#cb18-4" aria-hidden="true" tabindex="-1"></a>FROM ubuntu:24.04 # ~77MB
<a href="#cb18-5" aria-hidden="true" tabindex="-1"></a>
<a href="#cb18-6" aria-hidden="true" tabindex="-1"></a># 2. Gabungkan arahan RUN untuk kurangkan layer
<a href="#cb18-7" aria-hidden="true" tabindex="-1"></a>RUN apt-get update && \
<a href="#cb18-8" aria-hidden="true" tabindex="-1"></a> apt-get install -y curl wget && \
<a href="#cb18-9" aria-hidden="true" tabindex="-1"></a> rm -rf /var/lib/apt/lists/*
<a href="#cb18-10" aria-hidden="true" tabindex="-1"></a>
<a href="#cb18-11" aria-hidden="true" tabindex="-1"></a># 3. Gunakan .dockerignore
<a href="#cb18-12" aria-hidden="true" tabindex="-1"></a># .dockerignore
<a href="#cb18-13" aria-hidden="true" tabindex="-1"></a>.git
<a href="#cb18-14" aria-hidden="true" tabindex="-1"></a>node_modules
<a href="#cb18-15" aria-hidden="true" tabindex="-1"></a>*.md
<a href="#cb18-16" aria-hidden="true" tabindex="-1"></a>docker-compose*.yml
<a href="#cb18-17" aria-hidden="true" tabindex="-1"></a>
<a href="#cb18-18" aria-hidden="true" tabindex="-1"></a># 4. Gunakan multi-stage build
<a href="#cb18-19" aria-hidden="true" tabindex="-1"></a>FROM node:20 AS builder
<a href="#cb18-20" aria-hidden="true" tabindex="-1"></a>WORKDIR /app
<a href="#cb18-21" aria-hidden="true" tabindex="-1"></a>COPY . .
<a href="#cb18-22" aria-hidden="true" tabindex="-1"></a>RUN npm ci && npm run build
<a href="#cb18-23" aria-hidden="true" tabindex="-1"></a>
<a href="#cb18-24" aria-hidden="true" tabindex="-1"></a>FROM nginx:alpine
<a href="#cb18-25" aria-hidden="true" tabindex="-1"></a>COPY --from=builder /app/dist /usr/share/nginx/html
<a href="#cb18-26" aria-hidden="true" tabindex="-1"></a>
<a href="#cb18-27" aria-hidden="true" tabindex="-1"></a># 5. Jangan jalankan sebagai root
<a href="#cb18-28" aria-hidden="true" tabindex="-1"></a>RUN adduser -D appuser
<a href="#cb18-29" aria-hidden="true" tabindex="-1"></a>USER appuser</code></pre></div>
Tip dari saya — multi-stage build tu sangat berguna. Anda boleh build app dalam satu stage, dan copy hasil build sahaja ke stage akhir. Imej jadi sangat kecil.
<h2 id="langkah-6-sandaran-docker">Langkah 6: Sandaran Docker</h2>
<h3 id="menyandaran-data-container">Menyandaran Data Container</h3>
Backup adalah perkara yang ramai orang abaikan sehingga terlambat. Saya dah pernah kena, dan percayalah — rasa dia tak best. Jadi setup backup dari awal.
<div class="sourceCode" id="cb19"><pre class="sourceCode bash"><code class="sourceCode bash"><a href="#cb19-1" aria-hidden="true" tabindex="-1"></a>#!/bin/bash
<a href="#cb19-2" aria-hidden="true" tabindex="-1"></a># backup-docker.sh
<a href="#cb19-3" aria-hidden="true" tabindex="-1"></a>BACKUP_DIR="/mnt/backup/docker"
<a href="#cb19-4" aria-hidden="true" tabindex="-1"></a>DATE=$(date +%Y%m%d_%H%M%S)
<a href="#cb19-5" aria-hidden="true" tabindex="-1"></a>COMPOSE_DIR="/opt/docker"
<a href="#cb19-6" aria-hidden="true" tabindex="-1"></a>
<a href="#cb19-7" aria-hidden="true" tabindex="-1"></a># Hentikan perkhidmatan (pilihan - untuk konsistensi)
<a href="#cb19-8" aria-hidden="true" tabindex="-1"></a># cd $COMPOSE_DIR && docker compose stop
<a href="#cb19-9" aria-hidden="true" tabindex="-1"></a>
<a href="#cb19-10" aria-hidden="true" tabindex="-1"></a># Sandaran volume dan konfigurasi
<a href="#cb19-11" aria-hidden="true" tabindex="-1"></a>tar czf "$BACKUP_DIR/docker-backup-$DATE.tar.gz" \
<a href="#cb19-12" aria-hidden="true" tabindex="-1"></a> -C "$COMPOSE_DIR" \
<a href="#cb19-13" aria-hidden="true" tabindex="-1"></a> --exclude='*/cache/*' \
<a href="#cb19-14" aria-hidden="true" tabindex="-1"></a> --exclude='*/logs/*' \
<a href="#cb19-15" aria-hidden="true" tabindex="-1"></a> .
<a href="#cb19-16" aria-hidden="true" tabindex="-1"></a>
<a href="#cb19-17" aria-hidden="true" tabindex="-1"></a># Sandaran senarai imej
<a href="#cb19-18" aria-hidden="true" tabindex="-1"></a>docker images --format "{{.Repository}}:{{.Tag}}" > \
<a href="#cb19-19" aria-hidden="true" tabindex="-1"></a> "$BACKUP_DIR/docker-images-$DATE.txt"
<a href="#cb19-20" aria-hidden="true" tabindex="-1"></a>
<a href="#cb19-21" aria-hidden="true" tabindex="-1"></a># Mulakan semula perkhidmatan
<a href="#cb19-22" aria-hidden="true" tabindex="-1"></a># cd $COMPOSE_DIR && docker compose up -d
<a href="#cb19-23" aria-hidden="true" tabindex="-1"></a>
<a href="#cb19-24" aria-hidden="true" tabindex="-1"></a># Buang sandaran lama (simpan 7 hari)
<a href="#cb19-25" aria-hidden="true" tabindex="-1"></a>find "$BACKUP_DIR" -name "docker-backup-*.tar.gz" -mtime +7 -delete
<a href="#cb19-26" aria-hidden="true" tabindex="-1"></a>
<a href="#cb19-27" aria-hidden="true" tabindex="-1"></a>echo "Sandaran Docker selesai: $DATE"</code></pre></div>
<blockquote>
Nota Beginner: Script di atas boleh dijadualkan menggunakan <code>cron</code> supaya backup berjalan secara automatik setiap malam. Satu baris cron job, dan anda boleh tidur lena tanpa risau kehilangan data.
</blockquote>
<h3 id="migrasi-docker-ke-server-baru">Migrasi Docker ke Server Baru</h3>
Salah satu kelebihan Docker ialah migrasi yang mudah. Kalau anda beli server baru, pindahkan service dalam beberapa minit sahaja.
<div class="sourceCode" id="cb20"><pre class="sourceCode bash"><code class="sourceCode bash"><a href="#cb20-1" aria-hidden="true" tabindex="-1"></a># Pada server lama:
<a href="#cb20-2" aria-hidden="true" tabindex="-1"></a># 1. Eksport konfigurasi
<a href="#cb20-3" aria-hidden="true" tabindex="-1"></a>cd /opt/docker
<a href="#cb20-4" aria-hidden="true" tabindex="-1"></a>tar czf docker-configs.tar.gz .
<a href="#cb20-5" aria-hidden="true" tabindex="-1"></a>
<a href="#cb20-6" aria-hidden="true" tabindex="-1"></a># 2. Salin ke server baru
<a href="#cb20-7" aria-hidden="true" tabindex="-1"></a>scp docker-configs.tar.gz admin@pelayan-baru:/opt/docker/
<a href="#cb20-8" aria-hidden="true" tabindex="-1"></a>
<a href="#cb20-9" aria-hidden="true" tabindex="-1"></a># Pada server baru:
<a href="#cb20-10" aria-hidden="true" tabindex="-1"></a># 3. Ekstrak
<a href="#cb20-11" aria-hidden="true" tabindex="-1"></a>cd /opt/docker
<a href="#cb20-12" aria-hidden="true" tabindex="-1"></a>tar xzf docker-configs.tar.gz
<a href="#cb20-13" aria-hidden="true" tabindex="-1"></a>
<a href="#cb20-14" aria-hidden="true" tabindex="-1"></a># 4. Mulakan perkhidmatan
<a href="#cb20-15" aria-hidden="true" tabindex="-1"></a>docker compose pull
<a href="#cb20-16" aria-hidden="true" tabindex="-1"></a>docker compose up -d</code></pre></div>
Nampak tak betapa mudahnya? Itulah keindahan Docker — semuanya portable.
<h3 id="checklist-siap-bab-ini">Checklist Siap Bab Ini</h3>
<ul class="task-list">
<li><label><input type="checkbox" />Saya tahu komponen lanjutan mana yang benar-benar saya perlukan.</label></li>
<li><label><input type="checkbox" />Saya sudah ada pelan backup untuk service Docker penting.</label></li>
<li><label><input type="checkbox" />Saya tahu bagaimana hendak menambah komponen baru tanpa merosakkan stack sedia ada.</label></li>
</ul>
<h2 id="ringkasan">Ringkasan</h2>
Dalam bab lanjutan ini, kita telah belajar tentang:
<ul>
<li>Jenis rangkaian Docker (bridge, host, macvlan, ipvlan)</li>
<li>Reverse proxy dengan Traefik untuk akses yang lebih kemas</li>
<li>Pengesahan SSO dengan Authelia</li>
<li>Health checks untuk meningkatkan kebolehpercayaan</li>
<li>Pengurusan berbilang host (Docker Swarm)</li>
<li>Portainer untuk pengurusan visual</li>
<li>Membina imej Docker sendiri</li>
<li>Sandaran dan migrasi Docker</li>
</ul>
Pengetahuan lanjutan ini membolehkan anda membina infrastruktur container yang lebih kukuh dan profesional. Tapi seperti biasa — anda tak perlu guna semua sekali gus. Pilih yang anda perlukan, kuasai ia, dan tambah yang lain bila tiba masanya.
Tahniah kerana sampai ke penghujung bahagian Docker! Anda sekarang ada asas yang kukuh untuk deploy dan urus service dalam homelab. Seterusnya, kita akan belajar tentang pengurusan storan dan NAS — satu langkah pada satu masa!

Batal