Search code examples
node.jsdockerubuntudocker-composesentry

Unable to send Sentry events in Node.js Docker container


The Sentry SDK for Node.js is unable to send events to the Sentry server while it's running inside a Docker container. I'm fairly new to running containerized setups on my DigitalOcean Ubuntu 20.04 VPS, so any help is appreciated!

The error:

Sentry Logger [Log]: [Tracing] starting gql transaction - GET_REFRESH_TOKEN
Sentry Logger [Log]: [Tracing] Finishing gql transaction: GET_REFRESH_TOKEN.
Sentry Logger [Error]: Error while sending event: Error: connect ETIMEDOUT 34.120.195.249:443

The IP is the from Sentry as expected and found here: https://docs.sentry.io/product/security/ip-ranges/#event-ingestion.

Relevant settings:

Sentry Initialization

{
  dsn: 'https://<secret>@<secret>.ingest.sentry.io/<secret>',
  environment: 'Testing',
  debug: true,
  integrations: [ Http { name: 'Http', _breadcrumbs: true, _tracing: true } ],
  tracesSampleRate: 1,
  _metadata: {
    sdk: {
      name: 'sentry.javascript.node',
      packages: [Array],
      version: '6.13.3'
    }
  }
}

Docker Compose file

version: '3'
services:
  frontend:
    #...

  api:
    container_name: api-${COMPOSE_PROJECT_NAME}
    restart: always
    build:
      context: ./api
      dockerfile: Dockerfile.prod
    env_file:
      - .env
    environment:
      API_PORT: 3001
      DB_HOST: db
      DB_PORT: 5432
      DATABASE_URL: postgresql://${POSTGRES_USER}:${POSTGRES_PASSWORD}@db:5432/${POSTGRES_DB}?schema=${DB_SCHEMA}
    depends_on:
      - db
    ports:
      - ${API_PORT_INTERNAL}:3001
    volumes:
      - ./api:/app
      - /app/node_modules

  db:
    #...

API Dockerfile

FROM node:14 AS builder

# Create app directory
WORKDIR /app

COPY package*.json ./
COPY prisma ./prisma/

RUN npm install
RUN npx prisma generate

COPY . .

# Latest LTS version
FROM node:14

# Set default values for environment variables
ENV API_PORT=3001

COPY . .
COPY --from=builder /app/node_modules ./node_modules
COPY --from=builder /app/package*.json ./

# Bind port
EXPOSE 3001

# Start server
CMD ["npm", "start"]

If any more details are needed I'll append this list.


Solution

  • Self-answer after some more investigation:

    It turns out all outside network access from within the containers was blocked. The usage of Sentry was simply the first time this was necessary.

    Problem

    While configuring the VPS firewall (UFW), Docker was bypassing the firewall and exposing unwanted ports. To fix this I disabled iptables completely in /etc/docker/daemon.json:

    {
      "iptables": false
    }
    

    This does the job but blocks all outside network access from within containers.

    Solution

    All credits for the solution go to @Feng with his answer here to the following question: What is the best practice of docker + ufw under Ubuntu.

    The solution was to remove the iptables = false option and fix it properly in the UFW configuration. You can do this manually as described in his post or do as I did and use his tool: https://github.com/chaifeng/ufw-docker.

    TL;DR

    1. Remove "iptables": false from /etc/docker/daemon.json
    2. Properly set up UFW + Docker using https://github.com/chaifeng/ufw-docker