3 ms·
There's nothing really wrong with what you're doing. Apps were deployed like that for decades before docker came along. To my mind the main benefit of containe
by gnfargbl 5y ago
There's nothing really wrong with what you're doing. Apps were deployed like that for decades before docker came along.
To my mind the main benefit of containerization would be that the
> binary, config files and static assets
would be bundled together inside the container, so there is less risk of you running a half-baked version where (e.g.) the binary gets updated but the other files don't. However since you're using Ansible to deploy, that risk already feels small. You could also consider using the embed feature in go1.16 to bundle all the assets inside the binary.
Arguably there might also some security benefit to running in a container, but I wouldn't want to try and make that argument without knowing a lot more about the specific details of your binary's behaviour.
- zozbot234 5y agoThere's a significant security benefit because container will run with separate namespacing of all system resources, and make it easier to drop unneeded privileges. So the attack surface of any security issue within your app will be correspondingly reduced.
- tkiolp4 5y agoThis is interesting. What if OP is running their golang application under a “golang” user and group? Wouldn’t that be enough to limit the surface area of attack? I’m assuming here that the “golang” user has limited permissions in the OS.