3 ms·
Some of us have notes, that we can mostly copy-paste to setup a server and it works well without magic and n·m·k images. Last time I checked, docker swarm was
by labawi 6y ago
Some of us have notes, that we can mostly copy-paste to setup a server and it works well without magic and n·m·k images.
Last time I checked, docker swarm was accepting connections from anywhere (publish really publishes) and messing with the firewall making a least-privilege setup a PITA; docker was building, possibly even running containers as root; and most importantly - the developers thought docker was magically secure, nothing to handle.
How do you handle your security?
- tln 6y agoAn nginx container handles redirects to HTTPS and SSL termination and talks to the other services using unpublished ports. Only 22 (sshd running on server) and 80 and 443 (published ports) are open to the world. Swarm ports open between the swarm servers. That's between AWS security groups. I don't build on my servers. A service (in a container) makes an outgoing connection to listen to an event bus (Google PubSub) to deploy new containers from CI (Google Cloud Builder). Config changes (ie, adding a service) are committed then I SSH in, git pull and run a script that does necessary docker stack stuff. I don't mount anything writable to the containers.