Lessons from Building a Node App in Docker
1–10 of 30 posts
Re: Lessons from Building a Node App in Docker
#2Any reason why you wouldn't use some kind of supervision for your process when running it in production?
Re: Lessons from Building a Node App in Docker
#3Any reason why you wouldn't use some kind of supervision for your process when running it in production?
It depends whether you want restarts handled from within your container or from the outside (e.g. orchestration framework).
With newer docker (1.2 onwards - https://docs.docker.com/engine/admin/host_integration/) you can have a container restart policy which handles a lot of the simple cases where previously one might have used supervisor.
Baking restart policy into the container can be convenient (and was considered standard practice before restart policies), but has the downside that it's a bit less flexible in terms of how your container works in different environments.
Re: Lessons from Building a Node App in Docker
#4Any reason why you wouldn't use some kind of supervision for your process when running it in production?
Docker itself can restart containers when the parent process inside the container exits for any reason. That behavior is not enabled by default but it can trivially be enabled for a container (started via "docker run", or in the compose yml file similarly).
https://docs.docker.com/compose/compose-file/#cpu-shares-cpu...
Re: Lessons from Building a Node App in Docker
#5This is incredibly clear and well-written. Great article!
Re: Lessons from Building a Node App in Docker
#6I think it's brilliant that this gives security more prominence with setting up the unprivileged user. Pretty much every Docker post / article I've seen tends to skip over details like that.
Re: Lessons from Building a Node App in Docker
#7https://imagelayers.io/?images=node:4.3.2 - I wonder how small we could get an image that's still capable of running node and having an extra user (Buildroot is root-only by default)
Re: Lessons from Building a Node App in Docker
#8The article should mention why you would like to run something in docker. What many forget is that when putting stuff in a container, you create future work for yourself to manage not only your own stuff, but also all the dependencies in the container.
If you're just after isolation, that could be accomplished with Linux name-spaces and apparmor.
Re: Lessons from Building a Node App in Docker
#9https://imagelayers.io/?images=node:4.3.2 - I wonder how small we could get an image that's still capable of running node and having an extra user (Buildroot is root-only by default)
If the image size is your primary concern, there are many alpine linux images which excel at this, for example: https://github.com/mhart/alpine-node
Re: Lessons from Building a Node App in Docker
#10I think it's brilliant that this gives security more prominence with setting up the unprivileged user. Pretty much every Docker post / article I've seen tends to skip over details like that.
What exactly do you achieve with this? It's running in a container. What's a hacker to do? Screw up the app in the container, which they could do with the app user anyway?