github-starred/pangolin
2
0
Fork 0
mirror of https://github.com/fosrl/pangolin.git synced 2026-05-06 00:22:42 -05:00
Code Issues 464 Packages Projects Releases 71 Wiki Activity

[GH-ISSUE #2294] Path-Based-Routing is broken #4071

New Issue
Open
opened 2026-04-20 08:29:39 -05:00 by GiteaMirror · 8 comments
GiteaMirror commented 2026-04-20 08:29:39 -05:00
Owner
Copy Link

Originally created by @kylepyke on GitHub (Jan 21, 2026).
Original GitHub issue: https://github.com/fosrl/pangolin/issues/2294

Originally assigned to: @oschwartz10612 on GitHub.

Describe the Bug

Multiple targets on a single domain act as load balancers regardless of match-path rules or priority.

Environment

  • OS Type & Version: (e.g., Ubuntu 22.04)
    Ubuntu 22.04
  • Pangolin Version:
    1.14.1
  • Gerbil Version:
    Latest
  • Traefik Version:
    Latest
  • Newt Version:
    1.8.1
  • Olm Version: (if applicable)
    N/A

To Reproduce

Set a path based rule, and try to trigger it. For example set the following rules on any resource:

Prefix: "/" -> 192.168.1.7:3000

Prefix: "/api" -> 192.168.1.7:3001

The backend service that is returned will be random, completely ignoring PBR rules.

I have also tried only setting a single prefix rule for "/api", and changing priorities to be equal, above, below, equal non-100, and non-100 above/below.

Regardless, the service returned is random.

Expected Behavior

domain.com would route to the service on 192.168.1.7:3000 and domain.com/api (or /api/share etc.) would route to the service on 192.168.1.7:3001.

Originally created by @kylepyke on GitHub (Jan 21, 2026). Original GitHub issue: https://github.com/fosrl/pangolin/issues/2294 Originally assigned to: @oschwartz10612 on GitHub. ### Describe the Bug Multiple targets on a single domain act as load balancers regardless of match-path rules or priority. ### Environment - OS Type & Version: (e.g., Ubuntu 22.04) Ubuntu 22.04 - Pangolin Version: 1.14.1 - Gerbil Version: Latest - Traefik Version: Latest - Newt Version: 1.8.1 - Olm Version: (if applicable) N/A ### To Reproduce Set a path based rule, and try to trigger it. For example set the following rules on any resource: Prefix: "/" -> 192.168.1.7:3000 Prefix: "/api" -> 192.168.1.7:3001 The backend service that is returned will be random, completely ignoring PBR rules. I have also tried only setting a single prefix rule for "/api", and changing priorities to be equal, above, below, equal non-100, and non-100 above/below. Regardless, the service returned is random. ### Expected Behavior domain.com would route to the service on 192.168.1.7:3000 and domain.com/api (or /api/share etc.) would route to the service on 192.168.1.7:3001.
GiteaMirror added the needs investigating label 2026-04-20 08:29:39 -05:00
GiteaMirror commented 2026-04-20 08:29:42 -05:00
Author
Owner
Copy Link

@nicholasliverett commented on GitHub (Jan 27, 2026):

This is still an issue with 1.15.1. Changing priority does nothing load balancing appears to always be random.

<!-- gh-comment-id:3807127325 --> @nicholasliverett commented on GitHub (Jan 27, 2026): This is still an issue with 1.15.1. Changing priority does nothing load balancing appears to always be random.
GiteaMirror commented 2026-04-20 08:29:44 -05:00
Author
Owner
Copy Link

@l3ztum commented on GitHub (Jan 30, 2026):

Have encountered the same problem with my setup. Was trying Prefix '/share' and Regex '^/share.*' which both do not seem to work. If i deactivate the root target for sub-domain <example.domain.org>, i correctly get a 404 with the sub-domain and i'll be forwarded to the configured second target with <example.domain.org>/share.

<!-- gh-comment-id:3822824586 --> @l3ztum commented on GitHub (Jan 30, 2026): Have encountered the same problem with my setup. Was trying Prefix '/share' and Regex '^/share.*' which both do not seem to work. If i deactivate the root target for sub-domain <example.domain.org>, i correctly get a 404 with the sub-domain and i'll be forwarded to the configured second target with <example.domain.org>/share.
GiteaMirror commented 2026-04-20 08:29:44 -05:00
Author
Owner
Copy Link

@kylepyke commented on GitHub (Feb 1, 2026):

@oschwartz10612 can you reproduce? Do you have any updates on this?

<!-- gh-comment-id:3830409559 --> @kylepyke commented on GitHub (Feb 1, 2026): @oschwartz10612 can you reproduce? Do you have any updates on this?
GiteaMirror commented 2026-04-20 08:29:45 -05:00
Author
Owner
Copy Link

@shreyaspapi commented on GitHub (Feb 23, 2026):

I've been looking into this. The path-based routing key generation has a collision bug I've fixed in #2524, but it wouldn't affect the / vs /api case.

Could you check if the path and pathMatchType values are actually saved in the database for your targets? If they're null, both targets would end up in the same loadbalancer and round-robin. You can check with: SELECT targetId, path, pathMatchType FROM targets WHERE resourceId = ;

<!-- gh-comment-id:3943064140 --> @shreyaspapi commented on GitHub (Feb 23, 2026): I've been looking into this. The path-based routing key generation has a collision bug I've fixed in #2524, but it wouldn't affect the / vs /api case. Could you check if the path and pathMatchType values are actually saved in the database for your targets? If they're null, both targets would end up in the same loadbalancer and round-robin. You can check with: SELECT targetId, path, pathMatchType FROM targets WHERE resourceId = <your resource id>;
GiteaMirror commented 2026-04-20 08:29:47 -05:00
Author
Owner
Copy Link

@shreyaspapi commented on GitHub (Feb 23, 2026):

I found a collision bug in the sanitize() function used to group targets into Traefik routers — paths like /a/b and /a-b produce the same key and end up in one loadbalancer instead of getting separate routers. I opened #2524 to fix that.

However, tracing through the code for the specific / vs /api scenario described here, the keys are already different (1-prefix vs 1-api-prefix), so the sanitize collision alone wouldn't explain this.

You could check with something like:

SELECT targetId, path, pathMatchType FROM targets WHERE resourceId = <your_resource_id>;
<!-- gh-comment-id:3943077908 --> @shreyaspapi commented on GitHub (Feb 23, 2026): I found a collision bug in the `sanitize()` function used to group targets into Traefik routers — paths like `/a/b` and `/a-b` produce the same key and end up in one loadbalancer instead of getting separate routers. I opened #2524 to fix that. However, tracing through the code for the specific `/` vs `/api` scenario described here, the keys are already different (`1-prefix` vs `1-api-prefix`), so the sanitize collision alone wouldn't explain this. You could check with something like: ```sql SELECT targetId, path, pathMatchType FROM targets WHERE resourceId = <your_resource_id>; ```
GiteaMirror commented 2026-04-20 08:29:48 -05:00
Author
Owner
Copy Link

@thutex commented on GitHub (Mar 25, 2026):

i don't seem to have this issue with my matrix instance, where i route the well-known to a webcontainer, the 3 matrix url's to a matrix container, and the default path to the sable container.
so 1 domain, 3 different docker containers (on the same resource) and 4 paths

Image
<!-- gh-comment-id:4127767689 --> @thutex commented on GitHub (Mar 25, 2026): i don't seem to have this issue with my matrix instance, where i route the well-known to a webcontainer, the 3 matrix url's to a matrix container, and the default path to the sable container. so 1 domain, 3 different docker containers (on the same resource) and 4 paths <img width="1411" height="352" alt="Image" src="https://github.com/user-attachments/assets/4a572f49-d743-426d-840d-7b52d85ab83d" />
GiteaMirror commented 2026-04-20 08:29:49 -05:00
Author
Owner
Copy Link

@Kadz93 commented on GitHub (Apr 16, 2026):

I would like to push this issue, using path based routing is unusable e.g. for immich

<!-- gh-comment-id:4262933472 --> @Kadz93 commented on GitHub (Apr 16, 2026): I would like to push this issue, using path based routing is unusable e.g. for immich
GiteaMirror commented 2026-04-20 08:29:49 -05:00
Author
Owner
Copy Link

@LaurenceJJones commented on GitHub (Apr 17, 2026):

I would like to push this issue, using path based routing is unusable e.g. for immich

Okay any steps we can take to reproduce issue for immich, cause just stating is unusable doesnt aid us in rectifying the issue.

<!-- gh-comment-id:4267194398 --> @LaurenceJJones commented on GitHub (Apr 17, 2026): > I would like to push this issue, using path based routing is unusable e.g. for immich Okay any steps we can take to reproduce issue for immich, cause just stating is unusable doesnt aid us in rectifying the issue.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
api
authentication
bug
config
dependencies
docker
documentation
enhancement
good first issue
help wanted
Improvement
Look Into
needs investigating
networking
new feature
non-critical bug
potential bug
pull-request
Mirrored from GitHub Pull Request
 question
reverse proxy
Security
stale
ui
wontfix
No Label needs investigating
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/pangolin#4071
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?