HI, I’ve set up my first CHR @7.15.3 on a Unbutu 22 (VPS), I would love to test Node Red into the container, actually I’ve instaled the CHR image and I don’t have any other linux access to run NR separately, and anyway, I want make this experience.
By now I can only find instructions to run PI-hole, does it suites for installation of Nodejs and NR? Can i isntall there python too?
What other solution you recomend me? Thank you!
I wrote this up a while back in related post from you 
See http://forum.mikrotik.com/t/a-very-simple-redirect-to-an-http-page-after-join-wifi/165960/1
You can follow the Pi-Hole example, to enable containers - just use a different mount and envs & /container/add would use “remote-image=nodered/node-red”, instead of =pihole/pihole when creating the nodered container.
The NodeRED config is in above link.
thank you dear friend!! Your info are super precious 
Yes I had the feeling somewhere I asked/read about that, than you for finding it again! I hope the thread will be useful to someone else, soon I’ll give a try )
Dear friend Amm0, may you please write here step by step instalation of docker? I’m not that skilled on that and I’m working remotely with the CHR, I’m afraid to create problems.
Actually I know I need to enable container, this is made by placing in file tab the container package, then reboot
Enable container typing /system/device-mode/update container=yes and powering off the router (or rebooting server where CHR is loaded)
Add a VETH interface with IP, place it on new bridge, give a router an IP on that subnet and enable NAT masquerade to give internet access.
About configuring parameters in container, loading the image and configure first steps on linux, may you please help? Is possible to have an SSH of the container to load then NR and set all necessary linux parameters?
Thank you a lot!
Hi, I’ve tried to figure out myself and I report here the steps:
Add container function by download the container plugin and place the package in Winbox>file, then reboot
Enable container typing /system/device-mode/update container=yes and powering off the router (or rebooting server where CHR is loaded, you need a rude reboot, not a shutdown)
Add a VETH interface with IP, place it on new bridge, give a router an IP on that subnet and enable NAT masquerade to give internet access. Add already a dest NAT of the NR port 1880 on a remote port for Node Red, use a high random port that hackers can’t find easy, for example 58492
In container add envs:
/container/envs/add name=nodered_envs key=TZ value= (put here your time zone, for example “Europe/Rome”
and add mounts:
/container/mounts/add name=etc_nodered src=disk1/nodered_data dst=/data
in the container config put the url: https://registry-1.docker.io , and tempdisk: disk1/pull
Now create container filling with:
Remote image: nodered/node-red
interface: the VERTH you created
Envlist: select what you created
Root dir: disk1/nodered
Mounts: select what you created
add DNS
Apply and Start, you will have NR available on VETH IP:1880, but no SSH/telnet, I hoped to have a shell on Docker but I don’t know if it’s possible.
In the other topic Amm0 wrote about https and certificates, I suppose they may be useful for the DNS purpose he focused to solve, is it correct?
About NR interface is just necessary to work with http, it’s fine.
Thanks
Correct, HTTPS was strictly needed in the “poor-man’s” captive portal NodeRED example because the client OS requires HTTPS.
But always using HTTPS is generally considered a best practice.
For experimenting on a local network with non-sensitive data, HTTP is certainly simpler.
If you’re exposing it to outside world, you want to either add HTTPS certs to NodeRED. Or, another approach for HTTPS is using 2nd container like Traefik or Caddy Server, in addition to your new NodeRED, as those have automatic HTTPS cert support, and desired to can proxy/forward the HTTPS traffic to some internal HTTP thing like NodeRED. Essentially, all Mikrotik dst-nat ports go the Traefix/Caddyserver, which enforces the HTTPS, and then that proxies it the NodeRED container (or even webfig/REST api, etc). i.e. so unsecured NodeRED port is NOT in a public dst-nat, rather Traefik/Caddy act as middleman to protect the “internal” HTTP things like NodeRED. (And do stuff like URL filtering, or protecting other unsecured HTTP like /webfig, /REST, etc., all in one place.)
Thank you! For now I need it working 24/7 only on LAN with dashboard as remote, I can dstnat temporarely on a unknow port only for some work, but I can easily create am OVPN tunnel to my home, and keep it far from hackers.
BY the way I’m curious how you modified settings.json having only NR, on settings it doesn’t seem possible. Maybe you used NR nodes to open and edit file?
I’m studying how much disk and RAM this containter uses, but I can see only the performance of the CHR server, which tells me about 500MB of RAM and about 650MB of disk.
Unfortunately on Mikrotik’s file I can’t read how much the doker folders are weight, as well I can’t see how much RAM, shame on me I haven’t ckecked that before installing container. Is here any possibility?
Can I install another container with pure linux to enable SSH and can I from there check the NR partition? Thanks
Regular Docker allows you do a -p 80:1880 to map port..,so the node-red image assumes that how to re-map ports. Now, some/most containers let you set ports from environment vars too, but I don’t see that option for node-red. I’m not expert on node-red however. In fact, I just left the port as 1880 in my example.
On RouterOS, I kinda view FW’s dst-nat as the moral equivalent of Docker’s “-p 80:1880”, so that’s what I recommend. There is a settings.json file, and you can use /container/shell do something like “nano ~/.node-red/settings.js” (or vi …) to edit it for a test. And you can theoretically use another mount with the setting.js in RouterOS using --sessings in the cmd=… BUT… the settings.js all gets complex… when a dst-nat would work (combined with the /ip/firewall/filter you think are right).
For CPU/mem usage… RouterOS does not provide much insight beyond its standard /tool/profile (look for container when cpu=all) and /system/resources for memory/disk. Comparing those when the container is stopped, and then looking again after started is best you can do. You can use /console/shell and then “top” to see what the internal process of the node-red container are doing, too.
For disk… well, the Files view is of no help to know how much the root disk for a container is using. You can mount it via SMB or ROSE (or even ftp I suppose) & in those tools it will show file sizes inside the image. But with RouterOS alone, I’m not sure how you’d check the size for a container.
On CHR, for a dashboard used by dozens at most, I’m pretty sure you’ll be fine. Or likely fixable by adding virtual disk or increasing CPU/mem to CHR. But JavaScript/node is pretty light on resource by itself. Now, I suppose, you could write some actions/“nodes” inside node-red that used a bunch of memory/CPU or have 1000’s of connections… but you’d have to be trying. But making a few REST calls, and returning HTML, is unlikely be very CPU/mem intensive at small scale.
Thak you mate, very interesting, in short for my purposes I’ve learned that:
with terminal I can manage /container/shell and I finally have the desidered consolle available! ))
inside shell I can check RAM etc. with linux command
Stopping/starting container can also tell the amount of RAM used
Now I see Mem: 243764K used with top, On Mikrotik 311M used,
Stopping the container 272M used, so NR container is using about 40MB (with some modules installed and running), that looks good for installing on ac3 that has 256MB of RAM with 171 free, that is what I was aiming, now where I can install.
Of course I’ll put a useless USB stiack of 4GB on the USB port and install container there
Good news. I didn’t think it was very heavy-weight - but worth testing.
FWIW, top inside the container may not be the best test, since, I think, memory includes all user available memory, excluding kernel. While the RouterOS values include both. But I’m not 100%…
Your stop/start test, and math, I trust more than top. But I suspect memory be pretty stable, but it’s CPU that will go up depending on how many request/sec it’s getting and how loaded RouterOS is doing routing. But I wouldn’t worry about a some dashboard workflow too much.
($var->“val”) != “<> ~> => ”
Sorry to hijack your thread - this was a duplicated post originally used to test forum’s phpBB:
[ font = ‘JetBrains Mono’ ]some->text[ / font ] worked (without spaces)
In Chrome, with JetBrain Mono loaded, it does. Safari, no.
So I’m trying to mount it on an ac3 arm router and I got error, it downloads the package but whne start extact I got error. I can’t figure out where is the problem, the USB stick has been gormatted by Mikrotik itself..
Thanks for help
I’ve solved it partially, formatting with terminal the USB on ext4 I was able to continue the extracting, I’ve monitored USB disk and it wrotes about 700MB, then the process went to stopped, and start it doesn’t effect. If I reboot the router I can’t see more the container. I’ve wiped and formatted again but no success, logging reports only getting and dowmloaded. I’m using an old 2GB usb stick but it was never used, it should be fine. I don’t have write errors or any discard. Only 10MB more ram used, I don’t now where the problem is.
The working dir /usr/src/node-red does not appear. In my opinion something goes wrong here.. I have no ide why it interrupts
The process and commands are the same as CHR, you just have to watch before on Files and see how Mikrotik named the USB drive after format, in my case usb1/. SO the commands will be:
/container/envs/add name=nodered_envs key=TZ value=“Europe/Moscow”
/container/mounts/add dst=/data name=data_nodered src=/usb1/data_nodered
the temp disk wil be usb1/temp
the root disk usb1/nodered
depending on the flash drive speed, but it could take long time to extract all
Before installing container I haf 174MB RAM free, after extaction 159, rebooting no cotainer and again 174
Beyond formatting the USB on RouterOS, which sounds like you’ve. And do not reuse the same root-dir name, without make sure is deleted from files …
This does looks like another gotcha with starting “paths with slash”. In RouterOS scripts/config, file paths do NOT generally start with with / — so use
root-dir="usb1/nodered-root"
and in /container/config using tmp-dir=usb1/push.
It is very confusing whether a path should start with a slash. In /container, root-dir= and tmp-dir= (and CLI only, layer-dir=) all should use paths that start with “usb1/mycontainer/root”, “disk1/containers/”, etc. — NOT “/usb1” or “/disk1”.
Now to make this especially confusing, /container/mount, may want the preceding slash (or at least it does not care). And external file access like scp/NFS/etc, RouterOS paths DO start with a / to keep the external tools.
Maybe not your issue … but these file paths will get you with /container sometimes…
Thanks friend for replying, yes I’ve noted that too and I agree with you, I’ve made several attempts, sometimes mikrotik add itself / after removing it.
Anyway, such commands worked on CHR and it seems they have to also on arm+external drive, but they don’t.
What suspects me is that it is not comparing the working path, something goes wrong when executing the script after installing files. I see the about 700MB been written on USB1, so the process fails on the last stage. Maybe there is an incompatibility between this NR image and mikrotik container 7.16 version, or maybe simply NR pretends to install and find itself on the native disk..
Have you the chance to try too? Do you have an arm router?
Maybe I have to open another topic asking help for this. Unfortunately we don’t have good instruments to debug the process and find the reason
Ah… I tried it when this thread started on RB1100AHx4, with is also 32-bit ARM… And I check again, still works using :latest. BUT… RB1100AHx4 processor can use linux/arm/v7 as the architecture.
I believe, and don’t have one to check, but the hAPac3 needs linux/arm/v6 (as I that’s what’s needed on hAPac2)… And looking at DockerHub, all the newer 4.x dropped support for linux/arm/v6 - which must be what’s going on here. nodered, outside /container weirdness (like paths) in RouterOS, has always just popped up without much trouble. Now, no security does make that easy.
Anyway, so the new theory… try the 3.x branch of nodered, which does support linux/arm/v6
Back to the post title “Running Node Red on container, which one?”, let’s go with:
remote-image=“nodered/node-red:3.1.12-minimal”
(you can drop the minimal, or do your own research on the specific packages… but I’d try the minimal just to, hopefully, see something working.)
Here is [unclean] script that installs and removes NodeRed using functions.
:global containerImageTag "nodered/node-red:3.1.12-minimal"
:global makeContainer do={
:local tag $1
:global containerImageTag
:if ([:typeof $tag]!="str") do={ :set tag $containerImageTag }
# calc defaults
:local cid $id
:if ([:typeof $cid]!="num" or $cid > 0 or $cid < 255) do={ :set cid [:rndnum from=101 to=199] }
:local basedisk "usb1"
:local prefix "172.19"
# final paths/names
:local rootdir "$basedisk/containers/$tag/root-$cid"
:local datadir "$basedisk/containers/$tag/data-$cid"
:local subnet "$prefix.$cid"
:local label "$tag $cid"
:local vethName "veth$cid-$tag"
:put " Before proceeding, review the following is what you expect:"
:put " - pull '$tag' from $[/container/config/get registry-url]"
:put " - temporary image will be stored in $[/container/config/get tmpdir]"
:put " - container will be installed to root-dir=$rootdir"
:put " - VETH will use IP $subnet.1/24, and assign a gateway at $subnet.254/24"
:put " - using '$cid-$tag' as envlist, with the id=$cid param in LOCAL_INSTANCE_ID env"
:put " - mount for local data to $datadir"
:if ([/terminal/ask "Enter 'y' if to continue. Any other key exits without any action."] = "y") do={
/interface veth add name=$vethName address="$subnet.1/24" gateway="$subnet.254" comment=$label
/ip address add address="$subnet.254/24" interface=$vethName comment=$label
/container env add name="$cid-$tag" key="LOCAL_INSTANCE_ID" value=$cid comment=$label
/container mounts add name="$cid-$tag" dst="/data" src=$datadir comment=$label
/container add remote-image=$tag interface=$vethName root-dir=$rootdir mounts="$cid-$tag" logging=yes envlist="$cid-$tag" comment=$label
/ip/firewall/nat add chain=dstnat action=dst-nat protocol=tcp port=1880 to-addresses=172.19.132.1 to-ports=1880 comment=$label disabled=yes
}
/container
:delay 5s
print
}
:global removeContainer do={
# params tag= to search in comment to remove - be careful
:local label $tag
:global containerImageTag
:if ([:typeof $label] != "str") do={
:set label $containerImageTag
}
/interface veth remove [find comment~$label]
/ip address remove [find comment~$label]
/container remove [find comment~$label]
/container env remove [find comment~$label]
/container mounts remove [find comment~$label]
/ip/firewall/nat remove [find comment~$label]
}
Cut and paste functions to CLI, than use
$makeContainer
at the command line, and will show you want it’s doing. To remove it, use “$removeContainer” at CLI.
It’s not pretty since this is older but simplest to change outside rest of my scripts.
Hi mate! Thanks again for your support!
First I did what you suggested,I’ve used nodered/node-red:3.1.12-minimal (works without “”), bufore I’ve format the stick, checked on Files that all gone there and usb1 was remount displaying only “lost folders”, checked again all unnecessary “/” and applied. This time it download about 300MB, but the process hangs, no more byte were written (as happened before), keeps extracting but don’t do anything, no logs error.
I suppose also this version is not compatible with this router, possibile?
About your script, thank you, please sorry me I haven’t tried it yet, I don’t think it does more/different that what I’ve already tried, paths are the same, it doubles veth and mount I’ve already configured..
I?m going to write to githup asking for support
Feel free to ignore the script – it shared since I had it and what I used to test.
But kinda I’m out suggestions. You have:
Does loading a plain container like “alpine” work?
i.e. Based on https://nodered.org/docs/getting-started/local , this MIGHT work. If any step fails, well, it doesn’t work. But basically you can use the Alpine base linux image to install NodeJS and then NodeRED package on Node - then change the cmd= in /container to launch NodeRED. Since Alpine is tiny, it you should be able to get to step 4 (installing NodeRED).
/container/shell # where # is from /container/printBut we’re really grasping at straws here.
Dear friend! Yes it works thank you a lot! here my considerations:
Intalling Alpine is very quick, it looks very light
Installing nodejs as well as npm takes few seconds only
Installing NR needs quite a lot, about 5 minutes, that’s a sign it works slow, for sure not the proper platform for it. The beginning 174MB free RAM (after booting router) can go to low to 58 during the installation, as well about 60 while installing palette, processor can go about 35%, looks that only one core of the processor is running here.
NR 4 a
I need to test it to tell more, for now I’ve installed telegrambot and dashboard, you need to wait a while to see them installed, chances are also my USB stick is not good performing with thousands of small files.
Yes changing cmd is booting auto, now I’ll try to make a very short guide for who is interested.
Unfortunately node-red-log is not working, so the only way to see logs are log on winbox, or maybe typing manually the bash, which I don’t remember )
