feat: enhance pod-to-pod communication with network alias and project network support

Author: axadrn

internal/server/docker/docker.go

@@ -194,10 +194,6 @@ func (d *DockerService) RunContainer(ctx context.Context, opts RunContainerOptio
 	//─────────────────────────────────────────────────────────────────────────
 
 	labels := map[string]string{
-		// Enable Traefik for this container
-		// Without this, Traefik ignores the container completely
-		"traefik.enable": "true",
-
 		// Deeploy metadata for container identification
 		"deeploy.pod.id": opts.PodID,
 	}
@@ -209,44 +205,49 @@ func (d *DockerService) RunContainer(ctx context.Context, opts RunContainerOptio
 	if d.isDevelopment {
 		entrypoint = "web"
 	}
+	port := 8080
+	if len(opts.Domains) > 0 {
+		port = opts.Domains[0].Port
+	}
+
+	if opts.EnablePublicAccess {
+		// Enable Traefik only for public pods.
+		labels["traefik.enable"] = "true"
 
-	// Create a router for each domain
-	// Each domain gets its own router but shares the same service (load balancer)
-	for i, domain := range opts.Domains {
-		routerName := fmt.Sprintf("%s-%d", opts.PodID, i)
+		// Create a router for each domain
+		// Each domain gets its own router but shares the same service (load balancer)
+		for i, domain := range opts.Domains {
+			routerName := fmt.Sprintf("%s-%d", opts.PodID, i)
 
-		// Routing rule: Which domain goes to this container?
-		// Host(`example.com`) matches requests with that exact Host header
-		labels["traefik.http.routers."+routerName+".rule"] = fmt.Sprintf("Host(`%s`)", domain.Domain)
+			// Routing rule: Which domain goes to this container?
+			// Host(`example.com`) matches requests with that exact Host header
+			labels["traefik.http.routers."+routerName+".rule"] = fmt.Sprintf("Host(`%s`)", domain.Domain)
 
-		// Service: Where to forward the traffic
-		// @docker suffix is required because Traefik auto-appends it to Docker services
-		labels["traefik.http.routers."+routerName+".service"] = opts.PodID + "@docker"
+			// Service: Where to forward the traffic
+			// @docker suffix is required because Traefik auto-appends it to Docker services
+			labels["traefik.http.routers."+routerName+".service"] = opts.PodID + "@docker"
 
-		// Entrypoint: Which port to listen on (web=80, websecure=443)
-		labels["traefik.http.routers."+routerName+".entrypoints"] = entrypoint
+			// Entrypoint: Which port to listen on (web=80, websecure=443)
+			labels["traefik.http.routers."+routerName+".entrypoints"] = entrypoint
 
-		// SSL/TLS: Only in production (not development)
-		// certresolver=letsencrypt tells Traefik to automatically get a certificate
-		// from Let's Encrypt using the HTTP challenge
-		if !d.isDevelopment {
-			labels["traefik.http.routers."+routerName+".tls.certresolver"] = "letsencrypt"
+			// SSL/TLS: Only in production (not development)
+			// certresolver=letsencrypt tells Traefik to automatically get a certificate
+			// from Let's Encrypt using the HTTP challenge
+			if !d.isDevelopment {
+				labels["traefik.http.routers."+routerName+".tls.certresolver"] = "letsencrypt"
+			}
 		}
-	}
 
-	// Service configuration: One service for all routers
-	// All domains for this pod route to the same container/port
-	port := 8080
-	if len(opts.Domains) > 0 {
-		port = opts.Domains[0].Port
-	}
-	labels["traefik.http.services."+opts.PodID+".loadbalancer.server.port"] = fmt.Sprintf("%d", port)
+		// Service configuration: One service for all routers
+		// All domains for this pod route to the same container/port
+		labels["traefik.http.services."+opts.PodID+".loadbalancer.server.port"] = fmt.Sprintf("%d", port)
 
-	// Health checks: Traefik pings each container every 2 seconds
-	// Only containers that respond get traffic. This ensures zero-downtime
-	// during redeploys - new container only gets traffic once it's ready.
-	labels["traefik.http.services."+opts.PodID+".loadbalancer.healthcheck.path"] = "/"
-	labels["traefik.http.services."+opts.PodID+".loadbalancer.healthcheck.interval"] = "2s"
+		// Health checks: Traefik pings each container every 2 seconds
+		// Only containers that respond get traffic. This ensures zero-downtime
+		// during redeploys - new container only gets traffic once it's ready.
+		labels["traefik.http.services."+opts.PodID+".loadbalancer.healthcheck.path"] = "/"
+		labels["traefik.http.services."+opts.PodID+".loadbalancer.healthcheck.interval"] = "2s"
+	}
 
 	// Container config
 	config := &container.Config{
@@ -264,12 +265,25 @@ func (d *DockerService) RunContainer(ctx context.Context, opts RunContainerOptio
 		RestartPolicy: container.RestartPolicy{Name: "unless-stopped"},
 	}
 
-	// Network config - join the deeploy network so Traefik can reach this container
-	networkConfig := &network.NetworkingConfig{
-		EndpointsConfig: map[string]*network.EndpointSettings{
-			NetworkName: {},
+	if opts.ProjectNetwork == "" {
+		return "", fmt.Errorf("project network is required")
+	}
+	if err := d.EnsureNetwork(ctx, opts.ProjectNetwork); err != nil {
+		return "", fmt.Errorf("failed to ensure project network: %w", err)
+	}
+
+	endpoints := map[string]*network.EndpointSettings{
+		opts.ProjectNetwork: {
+			Aliases: opts.NetworkAliases,
 		},
 	}
+	if opts.EnablePublicAccess {
+		endpoints[NetworkName] = &network.EndpointSettings{}
+	}
+
+	networkConfig := &network.NetworkingConfig{
+		EndpointsConfig: endpoints,
+	}
 
 	// Create container
 	resp, err := d.client.ContainerCreate(ctx, config, hostConfig, networkConfig, nil, opts.ContainerName)
@@ -286,6 +300,25 @@ func (d *DockerService) RunContainer(ctx context.Context, opts RunContainerOptio
 	return resp.ID, nil
 }
 
+// EnsureNetwork creates a Docker network if it does not already exist.
+func (d *DockerService) EnsureNetwork(ctx context.Context, name string) error {
+	_, err := d.client.NetworkInspect(ctx, name, network.InspectOptions{})
+	if err == nil {
+		return nil
+	}
+
+	_, err = d.client.NetworkCreate(ctx, name, network.CreateOptions{})
+	if err != nil {
+		// Another deploy may have created the network in the meantime.
+		if _, inspectErr := d.client.NetworkInspect(ctx, name, network.InspectOptions{}); inspectErr == nil {
+			return nil
+		}
+		return err
+	}
+
+	return nil
+}
+
 // StopContainer stops a running container.
 func (d *DockerService) StopContainer(ctx context.Context, containerID string) error {
 	timeout := 30
@@ -409,11 +442,14 @@ type DomainConfig struct {
 
 // RunContainerOptions holds options for running a container.
 type RunContainerOptions struct {
-	ImageName     string
-	ContainerName string
-	PodID         string
-	Domains       []DomainConfig
-	EnvVars       map[string]string
+	ImageName          string
+	ContainerName      string
+	PodID              string
+	Domains            []DomainConfig
+	EnvVars            map[string]string
+	ProjectNetwork     string
+	EnablePublicAccess bool
+	NetworkAliases     []string
 }
 
 func mapToEnvSlice(m map[string]string) []string {