Live data from Hacker News

Docker + Joyent + OpenVPN = Bliss

blog.docker.io

21–25 of 25 posts

Re: Docker + Joyent + OpenVPN = Bliss

#21
post #19

There has been lots of talk re ; docker lately. I don't fully get it, but am trying to follow along. Basically, s small box you can install 1-x s-Linux software apps on, and deploy it on another machine, or inside a VM on that machine. It's not a real box, or hardware, but a small chunk of software that essential is a pre-made .iso with whatever single, or multi-packackaged goody you desire? I don't get, with spinnin…

There are numerous reasons for why containerization (even containerization on-top of a vm) is a wonderful thing.

The first thing is that containers allow you to securely isolate software and its configuration without impacting that software's usage of resources the same way a vm does.

Isolation of configuration is extremely valuable here, you now have a collection of containers that aren't polluting your host system with its dependencies and configuration, now containers can inter-operate with each other over known protocols and upgrade/downgrade their configurations or software without any impact to the surrounding host system.

Security is a big one too, containerization allows you to completely isolate the permissions of the given application - if something is compromised only that one thing and its container are compromised. Fix the issue, throw away the old container, build a new one, deploy it, voila!

The second reason containers are awesome is the ability to build, test, and "deploy" your software. Your build process (if you've actually worked on it!) with Docker is now to have it part of your automated testing cycle, build cycle, and packaging cycle where when you, say, tag a release - an automated build gets kicked off that builds the whole application in a Docker image with the explicitly listed dependencies (as they may be updated!!!), if that succeeds without error then go on to automated/QA testing, if that passes then packaging as a docker image ready to be installed. You drop it on the server and you're ready to go!

[EDIT] I use a similar set-up to the author but I'm on FreeBSD; in FreeBSD we have ZFS and ezjails which provides most of the same functionality (but slightly more "cool" because of ZFS) as Docker but as a set of shell scripts, you can have certain jails start up with the host system.

I run OpenVPN, TOR, a web server with OwnCloud on it, and a few other experiments on the machine and it's a joy to be able to throw away a jail and build a new one, or create new jails whenever I want to experiment but never worry about it polluting the host system and also not worry about performance impact on my cheap hardware.

Re: Docker + Joyent + OpenVPN = Bliss

#22

I was hoping this would be a mapping between containers and zones.

I don't see how you could map containers to zones without actually porting docker to Solaris.

... That's something that I would love to do once Docker has pluggable backends.

However (please don't throw stones at me if I'm wrong) I thought it wasn't possible to do "zones within zones"; did that change?

Re: Docker + Joyent + OpenVPN = Bliss

#23
Very nice. I do something most similar.

One tiny nitpick: you might want something like: dhcp-option DNS 8.8.8.8 to go with your redirect-gateway def1 .

This is because all of your DNS traffic will be redirected over your VPN as well. If you happened to have been assigned a local only DNS by your home router or cable/dsl provider, DNS will be broken when your VPN connects. Use a globally accessible one like 8.8.8.8 and the dhcp-option to tell openVPN to switch your DNS on connect.

Re: Docker + Joyent + OpenVPN = Bliss

#24
post #21
post #19

There has been lots of talk re ; docker lately. I don't fully get it, but am trying to follow along. Basically, s small box you can install 1-x s-Linux software apps on, and deploy it on another machine, or inside a VM on that machine. It's not a real box, or hardware, but a small chunk of software that essential is a pre-made .iso with whatever single, or multi-packackaged goody you desire? I don't get, with spinnin…

There are numerous reasons for why containerization (even containerization on-top of a vm) is a wonderful thing. The first thing is that containers allow you to securely isolate software and its configuration without impacting that software's usage of resources the same way a vm does. Isolation of configuration is extremely valuable here, you now have a collection of containers that aren't polluting your host system…

Thanks for the info, I appreciate it. Sorry about my terrible spelling and grammar. Not my day I suppose.
Post reply on HN