Docker Compose Ha Consul Vault Ui

A docker-compose example of HA Consul + Vault + Vault UI
Alternatives To Docker Compose Ha Consul Vault Ui
Project NameStarsDownloadsRepos Using ThisPackages Using ThisMost Recent CommitTotal ReleasesLatest ReleaseOpen IssuesLicenseLanguage
Consul26,2091,0221,8729 hours ago782September 20, 20221,245mpl-2.0Go
Consul is a distributed, highly available, and data center aware solution to connect and configure applications across dynamic, distributed infrastructure.
Nomad13,3631032919 hours ago753September 14, 20221,414mpl-2.0Go
Nomad is an easy-to-use, flexible, and performant workload orchestrator that can deploy a mix of microservice, batch, containerized, and non-containerized applications. Nomad is easy to operate and scale and has native Consul and Vault integrations.
Fabio7,14422 months ago50September 13, 2022237mitGo
Consul Load-Balancing made simple
Consul Template4,61315589 hours ago118August 18, 2022143mpl-2.0Go
Template rendering, notifier, and supervisor for @HashiCorp Consul and Vault data.
Gomplate2,103325 days ago81September 13, 202235mitGo
A flexible commandline tool for template rendering. Supports lots of local and remote datasources.
3 days ago41July 19, 202229mpl-2.0Go
Launch a subprocess with environment variables using data from @HashiCorp Consul and Vault.
Vault Guides936
9 days ago4April 06, 202157mpl-2.0Shell
Example usage of HashiCorp Vault secrets management
Terraform Aws Vault653
2 months ago63August 18, 202171apache-2.0HCL
A Terraform Module for how to run Vault on AWS using Terraform and Packer
Consul K8s592
10 hours ago95June 17, 2022153mpl-2.0Go
First-class support for Consul Service Mesh on Kubernetes
Hashi Up498
4 months ago32September 06, 20223mitGo
bootstrap HashiCorp Consul, Nomad, or Vault over SSH < 1 minute
Alternatives To Docker Compose Ha Consul Vault Ui
Select To Compare

Alternative Project Comparisons

HA Consul + Vault + Vault UI

Docker Logo Consul Logo Vault Logo VaultBoy Logo

This project is an example of using Consul, Vault, and Vault UI in a high availability (HA) configuration. Conveniently packaged as Docker services for provisioning via Docker Compose.


  • dnsmasq makes Consul DNS available to all containers. A secondary dnsmasq server is provided which grants HA to the DNS available to all containers. This allows consul-template to update DNS with zero DNS downtime. consul-template will create a lock to ensure it is not possible for both primary and secondary DNS servers to be down during DNS configuration updates as part of service discovery.
  • consul-template updates dnsmasq configuration and restarts dnsmasq when the configuration has changed (e.g. consul cluster size is increased on the fly). This makes consul DNS lookups HA.
  • Vault is registered via service discovery which is exposed via Consul DNS.
  • Persists data across restarts as long as the cluster is gracefully shut down. See [Starting and stopping section][#starting-and-stopping].
  • Local docker infrastructure is able to anonymously authenticate with Vault via approle method and its CIDR address.
  • Linux and Mac OS with docker supported.


Supplemental reading material:

Getting started

Start the cluster

Remove --scale vault=3 if you want to start one instance of Vault. docker-compose up -d would bring only Consul up in HA configuration.

./scripts/ --bootstrap
docker-compose up --scale vault=3 -d

Configure your web browser

Configure your browser to use the SOCKS5 proxy listening on localhost:1080. With your browser configured to use the proxy visit http://consul.service.consul:8500/ and wait for the cluster to be ready. After the vault service has all nodes available, it is time to initialize vault.

Initialize Vault

If you wish to secure secret.txt with GPG, then set the recipient_list environment variable. For example, the following.

export recipient_list="<gpg fingerprint to your secret gpg key>"

If you do not use GPG or do not want to, then skip setting recipient_list. Initialize vault witht he following command.


The credentials for vault are located in the file secret.txt which is created when Vault is initialized. Alternately, secret.txt.gpg if using GPG encryption.

Visit the web UI

Configure your browser

Configure your web browser to use the SOCKS5 proxy listening on localhost:1080.

In Firefox, do the following:

  1. Edit connections settings
  2. Set Manual proxy configuration
  3. Set SOCKS host to localhost, set Port to 1080, and check SOCKS v5 boolean.

Alternately install FoxyProxy extension which is an extension for quickly switching proxies on or off.

For other browsers, web search how to configure proxy settings or see what extensions are available for managing proxy settings.

Visit services via Consul DNS

Visit http://portal.service.consul/. It provides links to other web UIs and if you configure additional portal services, then they will also show up automatically.

Alternately, you can visit consul and vault directly at:

To log into Vault UI you must generate for yourself an admin token.


The root user token for Vault is stored in secret.txt at the root of this repository after you initialize Vault.

Other portal services

For playing around with service discovery I have created other docker-compose files which will automatically register with this consul cluster. Here's a list of what I have created so far.


With HA enabled, container instances of consul and vault can be terminated with minor disruptions.

Consul can be scaled up on the fly. consul-template will automatically update dnsmasq to include new services. dnsmasq will experience zero downtime.

docker-compose up --scale vault=3 --scale consul-worker=6 -d

To play with failover for killing consul instances, it is recommended to review fault tolerance for consul HA deployments.

Starting and stopping

Because high availability clusters have to gossip across nodes you can't execute a simple docker-compose down without corrupting the clusters. Instead, you have to gracefully shut down all clusters that depend on consul and then gracefully shutdown consul itself. For this, I have provided a script.

Stop consul and vault cluster safely.


Start the consul and vault clusters.

docker-compose up -d



Currently, output from the dnsmasq and dnsmasq-secondary servers are minimal. Verbosity of output can be increased for troubleshooting. Edit docker-compose.yml and add --log-queries to the dnsmasq command.

DNS client troubleshooting using Docker.

docker-compose run dns-troubleshoot

Using the dig command inside of the container.

# rely on the internal container DNS
dig consul.service.consul

# specify the dnsmasq hostname as the DNS server
dig @dnsmasq vault.service.consul

# reference vault DNS by tags
dig active.vault.service.consul
dig standby.vault.service.consul


View vault logs.

docker-compose logs vault

User docker exec to log into container names. It allows you to poke around the runtime of the container.

SOCKS5 proxy

Run a SOCKS5 proxy for use with your browser.

docker run --network docker-compose-ha-consul-vault-ui_internal --dns --init -p --rm serjs/go-socks5-proxy

Configure your browser to use SOCKS proxy at

Recovering data

It's possible a cluster was shutdown uncleanly and put into an irrecoverable state with no leader. If you have ever cleanly shut down consul, then it's possible you have a backup in the backups/ directory.

If you're in this leaderless state, then wipe out your old cluster data with the following command (this will permanently delete all old data).

docker-compose down -v

Start a new cluster.

docker-compose up -d

The latest backup can be restored via the following script.


If you have a specific backup you wish to restore, then you can call it as an argument.

./scripts/ backups/backup.snap


show portal before services are available

show portal after services are available

consul screenshot of all discovered services

consul screenshot of service metadata


MIT License

Popular Vault Projects
Popular Consul Projects
Popular Security Categories
Related Searches

Get A Weekly Email With Trending Projects For These Categories
No Spam. Unsubscribe easily at any time.
Docker Compose