Docker + Joyent + OpenVPN = Bliss

I never tried Docker (looking around now), but the approach is extremely dirty for a few reasons.

1. Process supervision should be handled in Docker (or something that is designed to do supervision), not in the `while true` loop. Idea on hanging on *.log files is terrible. Maybe there is a reason to stop the container when application stops?

2. There must be a better way to handle docker logs of multiple programs. If not, run both instances in different containers.

3. The thing serves configuration files to arbitrary clients that ask for them. It doesn't even log multiple downloads of the same key (though serves the private keys over SSL, which makes it hilarious on the purpose of SSL here).

Point 3 is openvpn specific and can be acceptable for example (though I am still lost why bother with SSL). However, points 1 and 2 show how to seriously misuse Docker. Either Docker or the setup is flawed (I suspect the latter).

Please do not take this article as an example how to do things in Docker. There must be better way, in more or less every step.

Funny to see this specifically w/ Joyent, the SmartOS zone gurus.

IPSec is one of the few instances where I have encountered consistent ( irregular ) kernel panics and when a panic ensues from a containerized app.. it is of course the 'host' kernel that is panicking. So all your containers are hosed.

I only run VPNs through virtualized kernel instances now; if they fail, the hypervisor restarts them. Nothing else affected.

Docker uses AUFS as a union filesystem to combine images (read-only collections of files) and do copy-on-write.