6

First of all let me say that I'm aware of related questions here in SO:

Or articles out there:

But I'm having trouble understanding real benefit they provide for a web developer (e.g. Full stack developer with (PHP/react)). You know? None of them is that clear for me in:

  • what facilities they could provide & how they make my job easier?
  • When do they become semi vital for project success & non-self-repeating activities?

Would you mind clarifying these concepts/techs from my POV? If you mind, please avoid comparing with routine "Vs." literature & Try to introduce real-life good-parts. A brief explanation from anybody would sufficient.

  • 1
    interesting question, though I wonder if it won't be considered as too broad ... I wouldn't be surprised if an expert (not me) could write a book to answer this question ... Anyway, good luck! – Pierre.Vriens Mar 10 '17 at 14:05
  • I hope so. First I asked it in SO, They forced me to narrow it down, & after that closed because of being "opinion based". Some one forwarded me here & now I'm asking. I hope it won't get closed. Any Brief explanation from any user would suffice – Behrad Khodayar Mar 10 '17 at 14:14
6

First of all, I strongly advise against "feature comparisons" blog post for similar software, they're quickly outdated and I'll try to keep this answer generic for a system configuration manager (SCM) and let docker out of the talk for the first part.

What it can brings you:

  • Reproduction of configuration from environment to environment
  • Versioning of the configuration
  • Enforcing the configuration

To get a real life example for a PHP application you'll need:

  • an operating system
  • a webserver
  • php libs
  • configuration of your app for external services (smtp, database IP, etc.)

What a SCM can provide is starting from a minimal base OS:

  • taking care of installing the webserver (apache/nginx)
  • installing PHP (either by package or source)
  • installing the necessary libs
  • Setting up your site config (vhost in apache)
  • Setting up your php.ini with any tweaks needed
  • deploying your app from a repository (from git to nexus, wide range of choice)
  • Writing your application configuration (here can be the smtp or database server for this environment)
  • Starting the webserver
  • Eventually running some smoke tests on your app.

Now if someone comes to connect to the machine and do a manual change to any of the configuration, the goal of a SCM is to keep the machine in its desired state, at next run, the change will be detected and the file changed will be put back to its desired state.

This has the advantage of enforcing any change to be put in the desired state description and not be forget between environments. Usually chef or puppet are set up to run on a periodic schedule, default for Chef is 30 minutes.

Now the big difference with docker is that you will do the same thing, installing you middleware, libs, forcing a templatized configuration, etc.
Once in the runtime phase, if there's a breach in your app and an attacker use it to tweak your config or modifying your webserver configuration it can stay unnoticed for a while if it doesn't break the app.

A SCM will revert the changes if you use it properly it will even remove unwanted sites in the sites-enabled directory of apache and thus will raise the complexity for an attacker.

Likewise if your webserer dies, the container will stop and unless you have a system to monitor it an relaunch it you're down. A SCM will notice the service is stopped and restart it at its next run, less immediate than runit but it will correct a rotate script which didn't properly restart the service (like the default apache logrotate conf on Ubuntu which may time out and let your apache stopped)

A SCM may be interesting even to create your docker containers, you know you'll have the same behavior on a centos or ubuntu machine (most community code handle using the proper package names if you go this way) and so it will remove problem of edit to package names in a dockerfile.


The main idea behind a SCM is to manage your infrastructure as you manage your application, code it, version it, test it and be sure it will always behave the same.

If you rely on human procedure for configuration of the middleware/libs/app config you can be sure there will be a step forget during the deploy process once in a while, and spotting this problem can be really hard. With a SCM you prevent this omission.

  • Excellent, detailed answer. I have just one bone to pick - I can't agree that "A SCM will notice the service is down and restart it". That's way, way outside the scope of configuration management. What you describe is the job of a process manager like runit, supervisord, forever, and the like. – Adrian Mar 10 '17 at 20:02
  • @Adrian that's the scope of chef and puppet , when you declare service X with state started, their job is to start the service. Process manager will only correct a crash, not an error in a schedule job (stop SN, backup, forget to start/fail to start for example). That's not way outside the scope, just we're talking about a different responsibility:) – Tensibai Mar 10 '17 at 20:05
  • When it converges, it will ensure that the state of the service is what is expected (i.e. started). When it converges. It does not "notice" anything as it happens, and it does not converge continuously. A process manager will immediately detect process termination and restart it. A scheduled job isn't a service, so I'm not sure why you mention it. – Adrian Mar 10 '17 at 20:32
  • @adrian I mean a scheduled job stopping a service on purpose, like a dB backup,, and yes it's when the SCM converge, Should I stressed again a SCM should run periodically ? – Tensibai Mar 10 '17 at 20:35
  • Point is the difference between periodic and continuous. It isn't practical to converge more than every 5 minutes or so in the majority of cases, which is 5 minutes of downtime for a service. This is why we have process managers to manage processes, and configuration managers to manage configuration. I don't want people reading this answer to conflate the two. – Adrian Mar 10 '17 at 20:37

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.