Some questions about Docker and rkt

Post by justincormack » Sat, Sep 17, 2016, 10:33 AM UTC

sigjuice wrote: post #71

I never quite understood how Docker lets developers share the same development environment. Most Dockerfiles that I have seen are a series of apt-get install commands. If different people build images using the same Dockerfile at different times, isn't there a chance that they will pick up different package versions? What am I missing?

I build base images and tag them with a hash of the packages installed in them (this is quite easy using Alpine Linux, I use sha1sum /lib/apk/db/installed), and then explicitly use those. If a package is upgraded or a new package installed in the base image then the image tag is updated.

Post by doublerebel » Sat, Sep 17, 2016, 5:19 PM UTC

bogomipz wrote: post #83

010a wrote: post #51

Earlier quoted context omitted.

Best solution is a dedicated secret management tool. K8S has secret capabilities built in, or something like Hashicorp Vault. Alternatively, I've used something as simple as DynamoDB to distribute config information and secrets to services.

How do you securely consume those secrets though - from everything I have seen with vault or consul you end up with the secret as a environmental variable that is then visible in ps listing.

The initial secret can be passed using the cubbyhole technique -- a time- and use- limited token that retrieves the actual token from a 'cubbyhole'.

The long-term secret can be accessed through the native clients for many PLs, which are basically just wrappers around the HTTP(S) API. The long-term secret is never exposed.

I reallllly like Vault it's been a breeze.

Re: Some questions about Docker and rkt

Re: Some questions about Docker and rkt