3 ms·

I'm a bit perplexed by a lot of the comments here. In webdev, most of the complexity I find is either in the app itself or the aspects of deployment _beyond_ D

I'm a bit perplexed by a lot of the comments here. In webdev, most of the complexity I find is either in the app itself or the aspects of deployment _beyond_ Docker. I usually set my Dockerfile up at the start of a project and use the image it produces across dev, testing, and prod. It takes me only a couple of minutes to set up and only a couple of minutes to (infrequently) modify. Even when I got "ambitious" with my Docker setup, the time investment was still same day. Cloud providers also have a lot of easy-to-use products which work with containers right out of the box. The same image would work on Heroku, Google Cloud Run, and AWS Fargate. I don't need to make any changes to my app outside of providing different environment variables, just provide the image and we're good.

sdevonoes 5y ago
How do your reproduce your production environment with "just" Docker? I don't get it. As an example of a very simple production environment of mine: a VPC (private network) with 1 webserver, 1 nginx proxy, 1 db server and 1 jumpserver. The only place I use Docker is in the webserver (I run a Django shop, so I pack everything needed in a Docker image); but the other servers do not run Docker containers, I use Ansible to provision these servers and also to maintain them (e.g., OS security updates, etc.) I use systemd as well. With Docker I can only mimic the webserver. I cannot reproduce the interaction of systemd and nginx for example; I cannot reproduce the way Ansible provision my machines in production. Docker alone is not enough. What I do to reproduce my production environment locally is: Vagrant. I spin up 4 VM machines, a private network and voila: I have the same prod. environment on my laptop! Now I can use Ansible and configure systemd as I would do in production.
- juanse 5y ago
  Wow! Super interested in this (as it is similar to what I had in mind) Could you share further detail please? The jumpserver is haproxy or something similar? I thought previously that you had to put nginx + server application in every node. How do you configure and manage the whole thing? Thanks in advance!
  - sdevonoes 5y ago
    - The jumpserver is just an Ubuntu machine with the ssh daemon running. It's open to the internet. I try to follow the "best security practices" to harden this machine (but I still have a lot to learn): don't allow root access, only allow access via ssh keys, etc. I don't have ssh access to any of the machines inside the VPC, I use the jumpserver for this: I ssh into the jumpserver and then ssh into any other server (of course, I do this automatically. Search "ssh jumphost") - nginx is installed only in one server. This server is also public to the internet: it's the main entrance to my web application (so whenever you type mydomainname.com, it's nginx the one that handles the request and redirects it to my web application) The other servers (the webserver with my application code) and the database server are only accessible from within the VPC (internal network) and are not open to the internet (there are some iptables rules set up) - At the moment I have everything in DigitalOcean. I use Terraform to create the servers (droplets) and then provision them via Ansible. So far so good. > I thought previously that you had to put nginx + server application in every node. I only have one application server because my load is low. In order to scale, sure you can have N application servers and M nginx servers. I don't know why would I put nginx and the application code in 1 server (I think K8s does this?)
    - juanse 5y ago
      Thank you very much for the answer. I've got now a concept to try and develop.

sdevonoes 5y ago

How do your reproduce your production environment with "just" Docker? I don't get it. As an example of a very simple production environment of mine: a VPC (private network) with 1 webserver, 1 nginx proxy, 1 db server and 1 jumpserver. The only place I use Docker is in the webserver (I run a Django shop, so I pack everything needed in a Docker image); but the other servers do not run Docker containers, I use Ansible to provision these servers and also to maintain them (e.g., OS security updates, etc.) I use systemd as well. With Docker I can only mimic the webserver. I cannot reproduce the interaction of systemd and nginx for example; I cannot reproduce the way Ansible provision my machines in production. Docker alone is not enough. What I do to reproduce my production environment locally is: Vagrant. I spin up 4 VM machines, a private network and voila: I have the same prod. environment on my laptop! Now I can use Ansible and configure systemd as I would do in production.

juanse 5y ago
Wow! Super interested in this (as it is similar to what I had in mind) Could you share further detail please? The jumpserver is haproxy or something similar? I thought previously that you had to put nginx + server application in every node. How do you configure and manage the whole thing? Thanks in advance!
- sdevonoes 5y ago
  - The jumpserver is just an Ubuntu machine with the ssh daemon running. It's open to the internet. I try to follow the "best security practices" to harden this machine (but I still have a lot to learn): don't allow root access, only allow access via ssh keys, etc. I don't have ssh access to any of the machines inside the VPC, I use the jumpserver for this: I ssh into the jumpserver and then ssh into any other server (of course, I do this automatically. Search "ssh jumphost") - nginx is installed only in one server. This server is also public to the internet: it's the main entrance to my web application (so whenever you type mydomainname.com, it's nginx the one that handles the request and redirects it to my web application) The other servers (the webserver with my application code) and the database server are only accessible from within the VPC (internal network) and are not open to the internet (there are some iptables rules set up) - At the moment I have everything in DigitalOcean. I use Terraform to create the servers (droplets) and then provision them via Ansible. So far so good. > I thought previously that you had to put nginx + server application in every node. I only have one application server because my load is low. In order to scale, sure you can have N application servers and M nginx servers. I don't know why would I put nginx and the application code in 1 server (I think K8s does this?)
  - juanse 5y ago
    Thank you very much for the answer. I've got now a concept to try and develop.