# Random containers give Bad Gateway

**URL:** https://community.traefik.io/t/random-containers-give-bad-gateway/14520
**Category:** Traefik v2
**Tags:** docker
**Created:** [May 19, 2022, 7:47am UTC](https://community.traefik.io/t/random-containers-give-bad-gateway/14520 "2022-05-19T07:47:54Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![haithcockce](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/haithcockce/32/5358_2.png) [@haithcockce](https://community.traefik.io/u/haithcockce)
#### Post date: [May 19, 2022, 7:47am UTC](https://community.traefik.io/t/random-containers-give-bad-gateway/14520/1 "2022-05-19T07:47:54Z")

</div>

I'm setting up Traefik for a home server setup. Some of these containers are exposed externally and the others are not. I've hit an issue where, randomly it seems, some containers will result in 502 Bad Gateway: Connection Refused and on a more rare occasion 404.

I've had some luck with resolving the issue by bringing down docker, bringing down firewalld, flushing iptables, the bringing up firewalld, and then bringing up docker. The 404 seemed to be resolved after I did the same thing but also removed the docker network the containers were on. However, one container continues to throw a 502:

`msg="'502 Bad Gateway' caused by: dial tcp 172.20.0.2:1980: connect: connection refused" `

My Traefik docker compose:

```yaml
version: '3'

services:
    traefik:
        image: traefik:latest
        container_name: traefik
        restart: unless-stopped
        networks:
            - traefik
        ports:
            - "80:80"
            - "8080:8080"
            - "443:443"

        volumes:
            - /var/run/docker.sock:/var/run/docker.sock
            - /media/containers/traefik/traefik-static.yaml:/traefik.yaml
            - /media/containers/traefik/acme.json:/acme.json
            - /media/containers/traefik/certs:/certs

        labels: 
            - traefik.http.routers.dashboard.tls=true
            - "traefik.http.routers.dashboard.rule=Host(`traefik.$DOMAIN`)"
            - "traefik.http.routers.dashboard.service=api@internal"

networks:
    traefik:
        external: true

```

The docker compose of the affected container;

```yaml
version: '3'
services:
    pihole:
        container_name: pihole
        image: pihole/pihole:latest
        ports:
            - "53:53/tcp"
            - "53:53/udp"
            - "67:67/udp"
            #- "80:80/tcp" # 80 conflicts with traefik
            - "1980:80/tcp"
        environment:
           [...]
        volumes:
           [...]
        cap_add:
            - NET_ADMIN
        networks:
            - traefik
        dns:
           [...]
        labels:
            - traefik.http.routers.pihole.rule=Host(`pihole.$DOMAIN`)
            - traefik.http.routers.pihole.tls=true
            - traefik.http.services.pihole.loadbalancer.server.port=1980
        restart: unless-stopped

networks:
    traefik:
        external: true 

```

Below is a comparison docker compose for a similar internal container which works;

```yaml
version: '3'
services:
    radarr:
        image: linuxserver/radarr
        container_name: radarr
        environment:
            [...]
        restart: unless-stopped
        volumes:
            [...]
        networks:
            - traefik
        ports:
            - 7878:7878
        labels:
            - traefik.http.routers.radarr.rule=Host(`radarr.$DOMAIN`)
            - traefik.http.routers.radarr.tls=true
            - traefik.http.services.radarr.loadbalancer.server.port=7878

```

Given the error is connection refused, I checked the container but it seems to have the IP address and port traefik wants;

```json
❯ docker inspect pihole
[...]
        "NetworkSettings": {
            "Bridge": "",
            "SandboxID": "<UUID>",
            "HairpinMode": false,
            "LinkLocalIPv6Address": "",
            "LinkLocalIPv6PrefixLen": 0,
            "Ports": {
                "53/tcp": [
                    {
                        "HostIp": "0.0.0.0",
                        "HostPort": "53"
                    },
                    {
                        "HostIp": "::",
                        "HostPort": "53"
                    }
                ],
                "53/udp": [
                    {
                        "HostIp": "0.0.0.0",
                        "HostPort": "53"
                    },
                    {
                        "HostIp": "::",
                        "HostPort": "53"
                    }
                ],
                "67/udp": [
                    {
                        "HostIp": "0.0.0.0",
                        "HostPort": "67"
                    },
                    {
                        "HostIp": "::",
                        "HostPort": "67"
                    }
                ],
                "80/tcp": [
                    {
                        "HostIp": "0.0.0.0",
                        "HostPort": "1980"
                    },
                    {
                        "HostIp": "::",
                        "HostPort": "1980"
                    }
                ]
            },
            "SandboxKey": "/var/run/docker/netns/<UUID>",
            "SecondaryIPAddresses": null,
            "SecondaryIPv6Addresses": null,
            "EndpointID": "",
            "Gateway": "",
            "GlobalIPv6Address": "",
            "GlobalIPv6PrefixLen": 0,
            "IPAddress": "",
            "IPPrefixLen": 0,
            "IPv6Gateway": "",
            "MacAddress": "",
            "Networks": {
                "traefik": {
                    "IPAMConfig": null,
                    "Links": null,
                    "Aliases": [
                        "<UUID>",
                        "pihole"
                    ],
                    "NetworkID": "<UUID>",
                    "EndpointID": "<UUID>",
                    "Gateway": "172.20.0.1",
                    "IPAddress": "172.20.0.2",
                    "IPPrefixLen": 16,
                    "IPv6Gateway": "",
                    "GlobalIPv6Address": "",
                    "GlobalIPv6PrefixLen": 0,
                    "MacAddress": "XX:XX:XX:XX:XX",
                    "DriverOpts": null
                }
            }
        }

```

_Note_ The `<UUID>` bits above do not all have the same value.

The traefik docker network is below;

```yaml
❯ docker network inspect traefik
[
    {
        "Name": "traefik",
        "Id": "<UUID>",
        "Created": "2022-05-19T02:55:50.041992949-04:00",
        "Scope": "local",
        "Driver": "bridge",
        "EnableIPv6": false,
        "IPAM": {
            "Driver": "default",
            "Options": {},
            "Config": [
                {
                    "Subnet": "172.20.0.0/16",
                    "Gateway": "172.20.0.1"
                }
            ]
        },
        "Internal": false,
        "Attachable": false,
        "Ingress": false,
        "ConfigFrom": {
            "Network": ""
        },
        "ConfigOnly": false,
        "Containers": {
             [...]
            "<RADARR UUID>": {
                "Name": "radarr",
                "EndpointID": "<<UUID>",
                "MacAddress": "XX.XX.XX.XX.XX",
                "IPv4Address": "172.20.0.5/16",
                "IPv6Address": ""
            },
                 [...]
            "<TRAEFIK UUID>": {
                "Name": "traefik",
                "EndpointID": "<UUID>",
                "MacAddress": "02:42:ac:14:00:09",
                "IPv4Address": "172.20.0.9/16",
                "IPv6Address": ""
            },
                [...]
            "<PIHOLE UUID>": {
                "Name": "pihole",
                "EndpointID": "<UUID>",
                "MacAddress": "YY.YY.YY.YY",
                "IPv4Address": "172.20.0.2/16",
                "IPv6Address": ""
            }
        },
        "Options": {},
        "Labels": {}
    }
]

```

I can confirm I can reach that container from both the host and a remote system;

```bash
❯ curl 127.0.0.1:1980 # from host
    <!doctype html>
    <html lang='en'>
        <head>
            <meta charset='utf-8'>
            <meta name="viewport" content="width=device-width, initial-scale=1">
            <title>● 127.0.0.1</title>
            <link rel='stylesheet' href='/pihole/blockingpage.css'>
            <link rel='shortcut icon' href='/admin/img/favicons/favicon.ico' type='image/x-icon'>
        </head>
        <body id='splashpage'>
            <div id="pihole_card">
              <img src='/admin/img/logo.svg' alt='Pi-hole logo' id="pihole_logo_splash" />
              <p>Pi-<strong>hole</strong>: Your black hole for Internet advertisements</p>
              <a href='/admin'>Did you mean to go to the admin panel?</a>
            </div>
        </body>
    </html>

```

```bash
❯ curl 192.168.1.2:1980 # from a system elsewhere on my network
    <!doctype html>
    <html lang='en'>
        <head>
            <meta charset='utf-8'>
            <meta name="viewport" content="width=device-width, initial-scale=1">
            <title>● 192.168.1.2</title>
            <link rel='stylesheet' href='/pihole/blockingpage.css'>
            <link rel='shortcut icon' href='/admin/img/favicons/favicon.ico' type='image/x-icon'>
        </head>
        <body id='splashpage'>
            <div id="pihole_card">
              <img src='/admin/img/logo.svg' alt='Pi-hole logo' id="pihole_logo_splash" />
              <p>Pi-<strong>hole</strong>: Your black hole for Internet advertisements</p>
              <a href='/admin'>Did you mean to go to the admin panel?</a>
            </div>
        </body>
    </html>

```

A lot of what I've found in searching is this issue can arise if there's firewall issues, if the containers are on different docker networks, the the ports are incorrect, etc. Unless I am blind (and it is quite late as I type this so I may very well be at least hard of seeing), I am not sure I am seeing anything that points to the issue; the containers are all on the same network, the ports are open, etc. I even tried `- traefik.docker.network=traefik` with no luck.

---

<div class="post-metadata">

### Author: ![rlingravil](https://avatars.discourse-cdn.com/v4/letter/r/aeb1de/32.png) [@rlingravil](https://community.traefik.io/u/rlingravil)
#### Post date: [June 2, 2022, 5:04am UTC](https://community.traefik.io/t/random-containers-give-bad-gateway/14520/2 "2022-06-02T05:04:38Z")

</div>

Did you ever figure this out? I'm having the same problem with Traefik and pi-hole.

---

<div class="post-metadata">

### Author: ![goevexx](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/goevexx/32/6297_2.png) [@goevexx](https://community.traefik.io/u/goevexx)
#### Post date: [December 5, 2022, 9:13pm UTC](https://community.traefik.io/t/random-containers-give-bad-gateway/14520/3 "2022-12-05T21:13:39Z")

</div>

I'm also interested in this.

---

<div class="post-metadata">

### Author: ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)
#### Post date: [December 6, 2022, 6:42am UTC](https://community.traefik.io/t/random-containers-give-bad-gateway/14520/4 "2022-12-06T06:42:01Z")

</div>

The example seems to have the Traefik static config missing (`entrypoints`, `provider.docker`), that would help with debug.

For the `radarr` service I would not expose the `port` externally in it's `docker-compose.yml`, Traefik will make it available.

---

<div class="post-metadata">

### Author: ![goevexx](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/goevexx/32/6297_2.png) [@goevexx](https://community.traefik.io/u/goevexx)
#### Post date: [December 7, 2022, 7:21am UTC](https://community.traefik.io/t/random-containers-give-bad-gateway/14520/5 "2022-12-07T07:21:07Z")

</div>

I solved this issue by exposing port 80 on pihole service, taking the port mapping out of ports and also adding port 80 to the load balancer instead of the mapped port.