· about 35 minutes · runs on ubuntu-26.04-devops · unrated
An unrated lab. It runs on your machine with no account and no network, and everything about it — the faults, the checks, the hints and the reference solution — is in the repository. An attempt on it is recorded on your profile and never moves a rating: only rated labs do. Rated and unrated labs.
The shop runs as a Docker Compose project in /srv/shop: web is the public front on port 8088,
and it passes everything under /api/ to the internal api service.
cd /srv/shop && docker compose ps
Since it was "tidied up" last week, /api/ answers with an error. When someone pointed web at the
api service by name, web would not even start, so they changed it back. They also published the
API on its own port while debugging, and after the last reboot nothing was running at all until a
person started the stack by hand.
What is expected, and graded:
http://127.0.0.1:8088/api/status.json returns the API's status document through web.api service is not published on any host port: only web is.There is no internet access: use the images that are already on the machine. You have root through
sudo.
The machine is checked, rebooted, and checked again. A check passes only if it passes both times.
| Check | Objective |
|---|---|
| 01_api_through_the_front | Connect Compose services by name over a shared network |
| 02_api_not_published | Expose only the service that is meant to be public |
| 03_stack_back_after_boot | Bring a Compose stack back after a reboot |
Where the lab's hints send you, level by level, as you ask for them (h, then l opens a journal section in the TUI).
4 questions on the same topic, in the lab's Theory tab. They never affect the lab's grade. Three of them, to answer here:
In a Compose project, service `web` must call service `api`, whose container listens on 80 and is published as `8089:80`. Which URL should `web` use?
http://api:80/
On a shared network Docker's DNS resolves the service name, and containers talk to each other on the ports their processes listen on. localhost is web itself, and 8089 exists only on the host.
https://docs.docker.com/compose/how-tos/networking/
`web` is attached only to network `front` and `api` only to `back`. What happens inside `web` for `getent hosts api`?
The name does not resolve, because the containers share no network
Containers can resolve and reach only containers on networks they are attached to. A service that must reach both sides has to join both networks.
https://docs.docker.com/compose/how-tos/networking/#specify-custom-networks
Why does nginx exit at start-up with `host not found in upstream "api"`?
It resolves proxy_pass host names when loading its configuration, and the name did not resolve
A literal host name in proxy_pass is resolved once at load time; if resolution fails the configuration is invalid and nginx does not start. A running upstream that answers with errors would produce 4xx or 502 responses instead.
https://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_pass