Docker compose in MacOS

[jinserk]

Hi all,

Recently I started a new project using Fief, with FastAPI backed API server. Now I'm using the Docker Desktop in MacOS, and now struggling from the docker compose network. I've tried network_mode: host for all containers but the ports are not exposed -- I guess that this was caused by the nature of VM in MacOS Docker Desktop.

Do you have any ideas for the Fief dev env on Mac Docker? Please share your experience!

Ref: docker/roadmap#238 (comment)

[jinserk]

I just created a docker container of the backend API with Fief together to run both servers in a single container. After the struggles earlier, especially with the Python version (latest Fief is only working with 3.11), it works like a charm!

[frankie567]

Hmm, I see the problem.

The thing is, since your server container is within the same Docker Compose project, it'll only be able to reach the Fief server through the internal hostname (i.e. the service name). Otherwise, you'll indeed need to tinker with network_mode: host.

Fortunately, there are ways to make it work without it. You can very well set your Fief client to talk on the internal hostname, like this:

fief = FiefAsync(  
    "http://fief-server:8000",
    "YOUR_CLIENT_ID",
    "YOUR_CLIENT_SECRET",
)

However, if you stop there, Fief won't recognize your workspace, since it's configured to match the host localhost:8000. There's actually an undocumented option in the Python client to override the Host header. It looks like this:

fief = FiefAsync(  
    "http://fief-server:8000",
    "YOUR_CLIENT_ID",
    "YOUR_CLIENT_SECRET",
    host="localhost:8000",
)

Now, the request will target fief-server:8000, but Fief server will lookup the workspace against localhost:8000.

---

As a side note, this is not specific to Mac OS, but rather to how Docker containers work :)

[jinserk]

@frankie567 Thanks for the comment! By the way, I believe I already tried the host option by seeing it from other thread, but no luck. I repeatedly got the erroneous message CANT_DETERMINE_VALID_WORKSPACE at that time.
I'll try to do this so and let you know if I can reproduce it.

[jinserk]

I have a question:

 52 fief = FiefAsync(                                                                                                                                                                                               
 53     base_url="http://fief:8001",                                                                                                                                                                            
 54     client_id=XXX.fief_client_id,                                                                                                                                                                          
 55     client_secret=XXX.fief_client_secret,                                                                                                                                                                  
 56     host=settings.fief_host,                                                                                                                                                                                    
 57 )                                                                                                                                                                                                               
 58                                                                                                                                                                                                                 
 59 scheme = OAuth2AuthorizationCodeBearer(                                                                                                                                                                         
 60     "http://fief:8001/authorize",                                                                                                                                                                      
 61     "http://fief:8001/api/token",                                                                                                                                                                      
 62     scopes={"openid": "openid", "offline_access": "offline_access"},                                                                                                                                            
 63     auto_error=False,                                                                                                                                                                                           
 64 ) 

where the authorizationUrl in OAuth2AuthorizationCodeBearer is correct? (I've changed the port from 8000 to 8001) I'm asking this, because when I tried to this, the authorize button in docs looks as:

that the fief container name cannot be routed from the host browsers.

From this issue, I added 127.0.0.1 fief to my /etc/hosts, so that the routing itself was successful, but I've got the repeated {"detail":"CANT_DETERMINE_VALID_WORKSPACE"} error msg. If I did something wrong, please let me correct it. Thanks!

[frankie567]

Yeah, it's a bit circumvoluted but you should define OAuth2AuthorizationCodeBearer with the localhost URL:

scheme = OAuth2AuthorizationCodeBearer(                                                                                                                                                                         
    "http://localhost:8001/authorize",                                                                                                                                                                      
    "http://localhost:8001/api/token",                                                                                                                                                                      
    scopes={"openid": "openid", "offline_access": "offline_access"},                                                                                                                                            
    auto_error=False,                                                                                                                                                                                           
)

Those URL are actually used by Swagger, the JS interface taking care of the OAuth2 process. Since this happens in your browser, you need to reach it from the outside of Docker. The host will naturally match the one expected by Fief.