Same Docker image, multiple configurations

Question

I got an application server image built with Docker. However, this image contains an OpenVPN client which needs a different certificate for each client, among other minimal configuration files.

I push this image to multiple servers across the globe. Every of them communicates with each other, thats the reason to use the VPN.

How should I put the configuration for such servers? I think this is out the scope of Docker. Must I use a configuration server like Ansible or so?

Answer 1

One could pass environment variables when running docker, e.g.:

Additionally, the operator can set any environment variable in the container by using one or more -e flags, even overriding those mentioned above, or already defined by the developer with a Dockerfile ENV:

$ docker run -e "deep=purple" --rm ubuntu /bin/bash -c export

Answer 2

One solution would be to create a base image with OpenVPN and global configurations and child images for the certs.

The base Dockerfile might look like this.

FROM debian:latest
RUN apt-get update && apt-get -y install \
  openvpn \
  easy-rsa \
  etc

RUN <any needed configurations>

docker build -t openvpn:baseimage .

The cert Dockerfile.

FROM openvpn:baseimage
COPY certs /etc/easy-rsa/

CMD openvpn

docker build -t useast:1 .

You could push the certs to the respective nodes with some kind of management tool and build the child images there. The base image would live in an available registry. Once the base image is cached on each node in Docker, the builds should be quick.

There are multiple solutions to this problem depending on what's best for the given environment.

Answer 3

If I get it right you use the same image for each container but their "state" change regarding the location, so you need an uniq cert per container.

I suppose, if you have the need of OpenVPN, this is not a Swarm cluster. (If it was no need for openVPN), so no access to docker config or secret.

I would go for a key/value store like consul and bundle it with consul-template so your config are store to the same place and consul-template generate the related files directly in the container.

Answer 4

You can use sharing volumes between the host that run the container and the instance, in this case you can put the crt files in anywhere in the hosts then map it to specific folder in the container, the same for configuration you can configure the service to read the configuration file from specific path and every time you mount whatever configuration you like to that specific folder and the service will read it.

For more info: https://docs.docker.com/engine/admin/volumes/volumes/

Answer 5

As you are trying to manage multiple servers you should start looking into any config management tools.

You could start looking into Ansible, as it is easier to setup and manage than other CM tools like Chef and Puppet (which have their own dependent resources to manage and run) .

Ansible is agentless, SSH based config tool written on python. (But it does not require you to code in py)

You just have to learn yml syntax (Jinja2) which is pretty easy . Its just a set of instructions on how to configure the server

Now coming to your use case

1. When you say that you push the docker images to multiple server across globe (which means you have a central node which can connect to all servers). This node can behave like the Ansible master (Where you install all ansible dependencies)

   If its is Deb based I have the scripts handy

       sudo apt-get -y install python-dev 
       sudo apt-get -y install libffi-dev
       sudo apt-get -y install libssl-dev
       sudo pip install paramiko 
       sudo pip install PyYAML 
       sudo pip install Jinja2 
       sudo pip install httplib2 
       sudo pip install six 
       sudo pip install markupsafe  
       sudo pip install ansible
   

2. After you install ansible write a sample playbook (with just a echo command) http://docs.ansible.com/ansible/latest/playbooks_intro.html

3. Lists all your servers in the inventory file http://docs.ansible.com/ansible/latest/intro_inventory.html

4. Execute your playbook for testing with below command ansible-playbook -i --extra-vars "key=Value"

5. Modify your playbook to include Docker image and set env variables of your credentials. Encrypt your creds using Bcrypt or some util

6. Store your playbooks in Git or other Source control

Happy Coding in Ansible.