5 ms·

How do your reproduce your production environment with "just" Docker? I don't get it. As an example of a very simple production environment of mine: a VPC (priv

How do your reproduce your production environment with "just" Docker? I don't get it. As an example of a very simple production environment of mine: a VPC (private network) with 1 webserver, 1 nginx proxy, 1 db server and 1 jumpserver. The only place I use Docker is in the webserver (I run a Django shop, so I pack everything needed in a Docker image); but the other servers do not run Docker containers, I use Ansible to provision these servers and also to maintain them (e.g., OS security updates, etc.) I use systemd as well. With Docker I can only mimic the webserver. I cannot reproduce the interaction of systemd and nginx for example; I cannot reproduce the way Ansible provision my machines in production. Docker alone is not enough. What I do to reproduce my production environment locally is: Vagrant. I spin up 4 VM machines, a private network and voila: I have the same prod. environment on my laptop! Now I can use Ansible and configure systemd as I would do in production.

juanse 5y ago
Wow! Super interested in this (as it is similar to what I had in mind) Could you share further detail please? The jumpserver is haproxy or something similar? I thought previously that you had to put nginx + server application in every node. How do you configure and manage the whole thing? Thanks in advance!
- sdevonoes 5y ago
  - The jumpserver is just an Ubuntu machine with the ssh daemon running. It's open to the internet. I try to follow the "best security practices" to harden this machine (but I still have a lot to learn): don't allow root access, only allow access via ssh keys, etc. I don't have ssh access to any of the machines inside the VPC, I use the jumpserver for this: I ssh into the jumpserver and then ssh into any other server (of course, I do this automatically. Search "ssh jumphost") - nginx is installed only in one server. This server is also public to the internet: it's the main entrance to my web application (so whenever you type mydomainname.com, it's nginx the one that handles the request and redirects it to my web application) The other servers (the webserver with my application code) and the database server are only accessible from within the VPC (internal network) and are not open to the internet (there are some iptables rules set up) - At the moment I have everything in DigitalOcean. I use Terraform to create the servers (droplets) and then provision them via Ansible. So far so good. > I thought previously that you had to put nginx + server application in every node. I only have one application server because my load is low. In order to scale, sure you can have N application servers and M nginx servers. I don't know why would I put nginx and the application code in 1 server (I think K8s does this?)
  - juanse 5y ago
    Thank you very much for the answer. I've got now a concept to try and develop.

juanse 5y ago

Wow! Super interested in this (as it is similar to what I had in mind) Could you share further detail please? The jumpserver is haproxy or something similar? I thought previously that you had to put nginx + server application in every node. How do you configure and manage the whole thing? Thanks in advance!

sdevonoes 5y ago
- The jumpserver is just an Ubuntu machine with the ssh daemon running. It's open to the internet. I try to follow the "best security practices" to harden this machine (but I still have a lot to learn): don't allow root access, only allow access via ssh keys, etc. I don't have ssh access to any of the machines inside the VPC, I use the jumpserver for this: I ssh into the jumpserver and then ssh into any other server (of course, I do this automatically. Search "ssh jumphost") - nginx is installed only in one server. This server is also public to the internet: it's the main entrance to my web application (so whenever you type mydomainname.com, it's nginx the one that handles the request and redirects it to my web application) The other servers (the webserver with my application code) and the database server are only accessible from within the VPC (internal network) and are not open to the internet (there are some iptables rules set up) - At the moment I have everything in DigitalOcean. I use Terraform to create the servers (droplets) and then provision them via Ansible. So far so good. > I thought previously that you had to put nginx + server application in every node. I only have one application server because my load is low. In order to scale, sure you can have N application servers and M nginx servers. I don't know why would I put nginx and the application code in 1 server (I think K8s does this?)
- juanse 5y ago
  Thank you very much for the answer. I've got now a concept to try and develop.