jpluscplusm

This is a copy/paste from an internal wiki on how we should use docker

This guide is to serve as an outline of internal best practices to using Docker. The idea is to give enough information to allow engineers to create containers for new stack components while minimizing the cleanup required to make them production ready.

Concepts

Before we get to the practices, it's important to understand WHY we are doing this. The key concepts we're concerned about with broad Docker usage are provenance, determinism, repeatability and auditability.

Provenance

Provenance refers to knowing WHERE something comes from. Generally with the end use of software, this is easy:

• Maven artifacts are pulled from central

jpluscplusm

server {
  listen 80;
  resolver 8.8.8.8;  # or your internal DNS server
  location / {
    proxy_set_header Host $http_host;
    proxy_http_version 1.1;
    proxy_pass https://$http_host;
  }
}

jpluscplusm

problem:
	FOO=bar sleep inf

no-problem:
	sleep inf

jpluscplusm

Scale Summit 2014

Intro, MBS

• Chatham House Rule, so no attribution of ideas to people or companies

ideas for sessions

• bootstrapping environments (without object stores)
• service discovery
• removing spofs

jpluscplusm

Nginx Double A

A primitive Double A (AAA-minus-Accounting) RBAC system implemented in declarative Nginx config.

Background

So I noticed https://github.com/alexaandru/elastic_guardian, a simple AAA reverse-proxy to sit in front of Elasticsearch. Reading the source and comments tickled my "why is this in code not config?" funnybone.

I asked @alexaandru (https://twitter.com/jpluscplusm/status/438339557906735104) who told me it was mostly the resulting complexity of the nginx config he tried that prompted him to write it.

jpluscplusm

server {
  listen [::]:80;
  listen 80;
  server_name "~^(?<thishost>[^.]+.)?(subdomain.example.com)$";
  access_log off;

  location / {
    resolver 8.8.8.8; # or whatever your server can use
    sub_filter_once off;
    sub_filter 'thepiratebay.se' 'subdomain.example.com';

jpluscplusm

# This is a request *directly* to the AAA/intelligent HTTPd, to demonstrate the additional response headers required to force the reproxy:
X-Reproxy-Uri, X-Reproxy-Host and X-Accel-Redirect.

jcm@austin:~/src/sinatra/nginx-test$ curl -v http://api-origin-server.mywebsite.internal/test
* About to connect() to 1.2.3.4 port 80 (#0)
* Trying 1.2.3.4... connected
* Connected to 1.2.3.4 (1.2.3.4) port 80 (#0)
> GET /test HTTP/1.1
> User-Agent: curl/7.21.0 (x86_64-pc-linux-gnu) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3.4 libidn/1.18
> Host: 1.2.3.4

jpluscplusm

#!/usr/bin/env ruby
require 'sinatra'
require "sinatra/reloader" if development?
require 'chef'
require 'rack/flash'
require 'haml'

POSSIBLE = [('a'..'z'),('A'..'Z'),(0..9),'.','/'].inject([]) {|s,r| s+Array(r)}

set :sessions, true