0

I have a Docker setup for my project with PHP-FPM, Nginx and many other services required by the application, but inside the PHP app I've to check the init.d/nginx configtest for new dynamic Vhosts (which are shared by volumes) generated for a tenancy based service.

The main thing its that I dont want to make a single container with PHP-FPM and Nginx for scalability reasons.

My idea is to use any Linux package for watch any change on a folder (Vhosts folder in my case) and test and then reload the service.

Any suggestion?

Edit: I've RabbitMQ in one container which is used by the PHP application but now I need to connect it with the Nginx-based container (dont know if there's a CLI or linux native client for this)

  • Why not use volumes to do that ? Bind the file to both machines. – jayooin Jan 28 at 15:17
  • @jayooin I've already, the problem is for share the response of the command nginx configtest – D8vjörk Jan 30 at 12:59
0

Here is nginx and php done as an s2i builder image. You can basically have plain old php in a git repo and run s2i to make a runtime image that runs it with nginx and php. You simply docker build that dockerfile and pass the resultant image as the builder image to s2i along with your source code.

You will notice I have archived that project. That is because redhat have security patched image for php at https://access.redhat.com/containers/#/registry.access.redhat.com/rhscl/php-72-rhel7 they happen to use apache httpd but since I don’t see that I use tell s2i “make a runtime container for my php code in git” and it just works and I get frequent security patches it’s way easier than messing around with my own dockerfile to do security patches.

  • Why your own image? You have this hub.docker.com/_/php which is the official one and it also comes with Apache – D8vjörk Jan 30 at 8:25
  • I said that I use a security parched 3rd party image and archived the one I wrote. Usually images on docker hub run as root (looking at the docker file of latest at your link it has no USER command to drop from root). Security teams on multi tenant k8s clusters don’t let you run containers that use root (eg I know one bank with 50,000 cpu support contracts for a commercial k8s distro). So I prefer to run out burins images that aren’t run as root and that have a security patching support. I find that most people starting out with docker don’t understand about container security. – simbo1905 Jan 30 at 9:42
  • Also I prefer to have one image that makes application runtime images for all our micro services. The official images don’t solve that problem. So I use s2i images and have git hooks that trigger making a new application image but also a push trigger on the docker repository of my k8s cluster that rebuilds all of the images when I push a new security patched s2i image. So in short “doing docker” as per the framework official images isn’t really state of the art it’s kinda a “generation 1” approach that I have moved beyond. Checkout s2i and OKD BuildConfig see the latest innovations. – simbo1905 Jan 30 at 9:46
  • The problem of it is that if you use Docker in production (as I imagined because of the security patched) you'll need a single container for each service Nginx and PHP-FPM because if you want to scale your app, you can replicate the PHP image instead of having multiple Nginx/Apache + PHP containers running – D8vjörk Jan 30 at 9:51
  • For the rest, you're right, Docker is not the best on security and I'll modify my images following the USER approach for it (right now the official Nginx image is the only one using this) – D8vjörk Jan 30 at 9:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.