The Edge Stack

The edge stack is the shared foundation every project plugs into. It boots independently of any project and runs as its own compose project named multi-docker-edge on the external docker network of the same name. Every project container joins that network so a single Traefik can route to all of them.

The four services

Service	Image	Host ports	Role
traefik	traefik:v3.5	127.0.0.1:80, 127.0.0.1:443	TLS-terminated reverse proxy. Discovers containers via the docker provider (through docker-proxy). Dashboard at https://traefik.<base-domain>.
mailcatcher	dockage/mailcatcher:0.9.0	none	SMTP catch-all at mailcatcher:1025. Web UI at https://mail.<base-domain>.
dns	4km3/dnsmasq:2.90-r3	127.0.0.1:53/udp+tcp	Answers *.<base-domain> with 127.0.0.1, paired with the macOS resolver.
docker-proxy	nginx:1.30-alpine	none	Strips the /v1.24/ version prefix from Docker-API requests so Traefik 3 can talk to OrbStack.

All four use restart: unless-stopped, and every host port binds to loopback only — nothing on the edge stack is exposed to your LAN.

How a request flows

1. Your browser resolves aurora.coding9.test to 127.0.0.1 (via dnsmasq + the macOS resolver).
2. It connects to Traefik on 127.0.0.1:443, which terminates TLS with the mkcert wildcard certificate.
3. Traefik matches the Host(...) rule from the labels that the generated override attached to your container.
4. It forwards the request over the multi-docker-edge network to the container’s internal port.

Traefik discovery rules

Traefik runs default-deny (exposedByDefault: false), so a container is only routed when its override sets:

• traefik.enable=true — opt-in per container.
• traefik.docker.network=multi-docker-edge — tells Traefik which network to use when a container is on several.
• A router rule from the {{hosts_rule}} substitution.

You never write these labels by hand — the profile render engine generates them.

Mail catching

Projects should point their SMTP at mailcatcher:1025 (the container hostname on the edge network). The shopware-dockware profile wires this automatically via MAILER_DSN and friends; other stacks set it themselves. All captured mail shows up at https://mail.<base-domain>. See Catching Outgoing Mail.

Multiple base domains

engine/render-edge.sh regenerates ~/.config/multi-docker/edge.override.yml before every edge command, adding one --address=/<bd>/127.0.0.1 argument to dnsmasq per configured base domain — so every domain in BASE_DOMAINS resolves. See Multiple Base Domains.

Stopping the edge stops everything

edge down stops all your projects

mdocker edge down deliberately stops every running project first, then takes the edge containers down. The edge stack is the foundation — without Traefik, DNS and certs, projects are unreachable through their domains and would dangle on the about-to-be-removed network.

To bounce only the edge and leave projects running, use mdocker edge restart, which skips the project-stopping step.

Recreating after a runtime update

If edge up recreates the edge network on a subnet mismatch, attached project containers get detached — and a plain restart won’t fix it (no re-render, no re-attach). Use mdocker cycle for the robust sequence: stop running projects → edge down + up → up <name> --auto-remap-ports so everything re-attaches to the fresh network.

Reference

For the full verb set, see the edge CLI reference.