41–50 of 55 posts
"Access was initially fronted by nginx with consul-template generating the config. When it did not scale anymore nginx was replaced by Traefik." Wonder why Nginx didn't scale.
Consul-template writes a config and then does an action. In the case of nginx, I would assume the action is to send a SIGHUP. I think haproxy would have also been an option here, it has better support for srv record to do updates from and the like.
Well... I'm running 100~150 per EC2 with Kubernetes... ¯\_(ツ)_/¯
"Access was initially fronted by nginx with consul-template generating the config. When it did not scale anymore nginx was replaced by Traefik." Wonder why Nginx didn't scale.
If I were to guess, reloads triggered from config changes. Consul-template writes a config and then does an action. In the case of nginx, I would assume the action is to send a SIGHUP. I think haproxy would have also been an option here, it has better support for srv record to do updates from and the like.
The only time our tried and tested consul-template + SIGHUP method is every unsuccessful (and we've ended up jusy having to put processes in place to stop this) is if we have the same nginx handling inbound connections to the cluster under high load and we try and respawn all the containers at once. Then things start to go wrong for 5 minutes or so then back to normal.
While "the occasions error response" isn't perfect, I suspect that for most use cases it's good enough, so I'd still be interested in knowing more specifically what happened to that nginx...
So at one point we where doing scale testing for our product where we needed to simulate systems running our software connected back to a central point. The idea was to run as many docker containers as we could on a server with 2x24 core and 512GB of RAM. The RAM needed for each container was very small. No matter what the system would start to break around ~1000 containers (this was 4 years ago). After doing may hou…
512GB RAM/2500 containers is still 500MB per container. In former days™ this was enough for a computer to run a complete desktop environment with a web browser and 20 tabs open (source: I had a PC with physically 500MB RAM). Is this really the limit for such a decent equipped machine? (I guess a server grade 48 cores, 512GB RAM should be less then 5kEUR nowadays)
Earlier quoted context omitted.
In ~2003, I replaced my desktop that had been Intel-based with a Duron 800MHz system, only I didn't have enough budget to get it the RAM it required (new/different slot iirc), so I only had the 128MB it came with (whereas my old machine had 768MB cobbled together from like six dimms). I figured that one hop over 100Mbit Ethernet to remote memory was going to be faster then swapping to spinning rust (remember this was…
So you're the guy who actually managed to "download more RAM". Congrats! On a more serious note, gonna add that trick to my book - still plenty of rust spinnin' round
"Access was initially fronted by nginx with consul-template generating the config. When it did not scale anymore nginx was replaced by Traefik." Wonder why Nginx didn't scale.
If I were to guess, reloads triggered from config changes. Consul-template writes a config and then does an action. In the case of nginx, I would assume the action is to send a SIGHUP. I think haproxy would have also been an option here, it has better support for srv record to do updates from and the like.
Earlier quoted context omitted.
Could you point to some of the sane configuration for docker? We are planning to run some of these in production.
For the logging aspect it's funny because the Docker manual itself contains a good snippet with reasonable settings: https://docs.docker.com/config/containers/logging/configure/ For the port-binding thing, I'd just remember that it binds to 0.0.0.0 when not explicitly specified otherwise, and then use docker network and not port-forwards unless absolutely needed. For example, if you have an application and a couple o…
The big bottleneck we had with docker containers per host was not sustained peak but simultaneous start. This was with 1.6-1.8 but we’d see containers failing to start if more than 10 or so (sometimes as low as 2!) were started at the same time. Hopefully rootless docker completely eliminates the races by removing the kernel resource contention.
Earlier quoted context omitted.
For the logging aspect it's funny because the Docker manual itself contains a good snippet with reasonable settings: https://docs.docker.com/config/containers/logging/configure/ For the port-binding thing, I'd just remember that it binds to 0.0.0.0 when not explicitly specified otherwise, and then use docker network and not port-forwards unless absolutely needed. For example, if you have an application and a couple o…
Setting up a firewall like ufw could prevent accidental port mapping to 0.0.0.0. I really don’t like that this is Docker‘s default.
Earlier quoted context omitted.
Problem with setting secure defaults, is that most of the worlds PHP would stop working properly.
Probably but you can still have the configuration secure as default and people would be aware of the security implications when enabling insecure features.