21–30 of 85 posts
There's a lot of "tool" selections in that repo. If anyone is looking for ready to go web app examples aimed at both development and production with Docker Compose, I maintain: - https://github.com/nickjj/docker-flask-example - https://github.com/nickjj/docker-rails-example - https://github.com/nickjj/docker-django-example - https://github.com/nickjj/docker-node-example - https://github.com/nickjj/docker-phoenix-exam…
Earlier quoted context omitted.
Using @-hashes doesn't assure you of not getting pwned the same way here. How are you getting the @-hash, if not just looking at what the tag points to? Sure, the image is changing now only at intentional times (as opposed to just any restart), but you're still not getting an assurance that a "trusted" upstream isn't going to RCE you. Security updates & patches come out with such frequency that the number of windows…
> Using @-hashes doesn't assure you of not getting pwned the same way here It does, changes to the image could be pushed to "latest" or a specific tag, but the hash cannot change, once you've established that a specific hash is secure, it'll remain secure (or rather, as secure as you first established it as).
To be honest if you’re that concerned with dependency attacks like that then you should just be hosting your own image registry and building your images yourself, and then only being vulnerable to dependency attacks within the OS distributions and such.
Nice collection, although I don't really like binding volumes to host directories, because then you can't really use docker over SSH. I'm working on my own similar project here that exclusively uses docker named volumes: https://github.com/enigmaCurry/d.rymcg.tech
Most of our App deployments are done with GHCR + SSH + Docker Compose with GitHub Actions on every commit [1]
[1] https://docs.servicestack.net/ssh-github-action-deployment
Security note: specifying no version, or a version tag (and not an @-hash) in the docker image name allows DockerHub or the image publisher to replace the code underneath you on container restarts (ie RCE), as they are not cryptographically assured.
OMG, why?! It is even had a daylight savings!
There's a lot of "tool" selections in that repo. If anyone is looking for ready to go web app examples aimed at both development and production with Docker Compose, I maintain: - https://github.com/nickjj/docker-flask-example - https://github.com/nickjj/docker-rails-example - https://github.com/nickjj/docker-django-example - https://github.com/nickjj/docker-node-example - https://github.com/nickjj/docker-phoenix-exam…
These are excellent, thank you. I maintain similar Django and Flask + compose stacks on behalf of the startup studio I work for so it’s fun to compare notes. For our Django stack, for instance, we have also settled on Postgres, on celery+redis, and on whitenoise. black/flake8/isort also seem universally agreeable. We also throw in pyright and generally make extensive use of type hints. For the front-end, we’re curren…
Earlier quoted context omitted.
Thanks for the reply. I didn't know that was a thing. Though, I'm still confused by your example of having to rsync /home/stuff to the server. If you use a named Docker volume, is the remote Docker container somehow using a volume you have located on your laptop? Wouldn't you still have to transfer the volume from laptop to server?
In my README I explain how to setup the Docker context over SSH. In my system all of the files get written to the volume from only three places: * From the docker image through VOLUME (fresh volumes copy the data from the image on start) * From a template container that writes config files. * From the container itself, writing files as it runs. What I don't do is create a directory someplace and manually edit files a…
> If you tell me to run
>
> docker run -v ${HOME}/stuff:/stuff alpine
>
> It will mount /home/stuff on the server, not my own
> home directory on my laptop.
And then you note:
> What I don't do is create a directory someplace and manually edit files and mount them.
But if /stuff is photos, and another container, say, runs ingestion tools, or some other photo collection processing, you don't let it touch the same data volume?
Looking at your repo, I see your docker-compose volumes map e.g. data to data …
volumes:
- data:/data
For instance, mounting a volume that can be edited by other containers lets me insta-move large files or sets of files between steps of containers, by container a doing a move not copy from its work path to its destination path watched as an incoming path by container b.
Earlier quoted context omitted.
These are excellent, thank you. I maintain similar Django and Flask + compose stacks on behalf of the startup studio I work for so it’s fun to compare notes. For our Django stack, for instance, we have also settled on Postgres, on celery+redis, and on whitenoise. black/flake8/isort also seem universally agreeable. We also throw in pyright and generally make extensive use of type hints. For the front-end, we’re curren…
no offense, but man, the amount of tooling you guys are using sounds to me insane. How is a person able to oversee and understand everything. The older i get the more i feel distantiated and disconnected to these modern practices. I am afraid that if I ever have to find a new workspace i wont be able to succeed because of this.
The key thing to understand is that all these things are shrouded in incomprehensible jargon and alien sounding names that make it incredibly intimidating to get started. But the fact is, it is a wide but shallow pool of jargon sitting on top of the same old computing fundamentals that have been around since the 1970s.
You will find if you know your fundamentals, then the jargon is far less difficult to overcome than it seems. You just need a bit of exposure and if you spend any amount of time playing with the tech it just starts to happen by osmosis. (If there are fundamentals you aren't solid on, treat it as an opportunity to bed that in - even these things are not generally super complex in the end).
Earlier quoted context omitted.
In my README I explain how to setup the Docker context over SSH. In my system all of the files get written to the volume from only three places: * From the docker image through VOLUME (fresh volumes copy the data from the image on start) * From a template container that writes config files. * From the container itself, writing files as it runs. What I don't do is create a directory someplace and manually edit files a…
What if the docker daemon is on a storage server and the host volume of /stuff contains, say, 10 terabytes of photo album content? > If you tell me to run > > docker run -v ${HOME}/stuff:/stuff alpine > > It will mount /home/stuff on the server, not my own > home directory on my laptop. That seems about right? And then you note: > What I don't do is create a directory someplace and manually edit files and mount them.…
In this extreme example I think probably a bind mount might make sense, especially if the files are already there. But the named volume would just be stored in /var/lib/docker/volumes/some-volume-name, so as long as that /var/lib has 10TB I don't see the problem.
I can use my sftp container [1] to be able to sftp directly into a volume, but I've not yet transferred 10TB with it :)
[1] https://github.com/EnigmaCurry/d.rymcg.tech/tree/master/sftp