3 ms·
> Poking a hole directly to the container is a leaky abstraction. A reverse proxy like HAProxy or Varnish should be sitting in front of the container. It might
by goblin89 13y ago
> Poking a hole directly to the container is a leaky abstraction. A reverse proxy like HAProxy or Varnish should be sitting in front of the container.
It might be a stupid question but I wonder what's considered a leaky abstraction in this case.
By the way, I'm not sure I fully understand your concerns over reverse proxy routing, but I recall that Ambassador pattern linking[0] is a suggested way of tying Docker containers over network. Also, these slides by dotCloud[1] may be helpful as well (I'm not sure if approaches described are up-to-date, though).
[0] http://docs.docker.io/en/latest/use/ambassador_pattern_linking/#ambassador-pattern-linking http://docs.docker.io/en/latest/use/ambassador_pattern_linki...
[1] http://www.slideshare.net/dotCloud/deploying-containers-and-managing http://www.slideshare.net/dotCloud/deploying-containers-and-...
- Xdes 13y ago>It might be a stupid question but I wonder what's considered a leaky abstraction in this case. I consider poking a hole a leaky abstraction because you are exposing the internals of your stack. The consumer should not know or care that you are using docker containers to serve the application. From a security perspective directly exposing a container may lead to potential exploits of docker itself.
- cpuguy83 13y agoExposing a container would not to exposing potential exploits of Docker. Docker is not running in the container (and doesn't know anything about Docker). Exposing a container is a hell of a lot safer than exposing a service on the host OS. Also not sure I follow you how a consumer would know you are using docker or not.