Kartoch's questions

A container described in docker-compose.yml uses logging extension to send log to a fluentd container.

version: "2"

services:

  fluentd:
    image: fluent/fluentd:v0.14.8
    container_name: fluentd

  nginx:
    image: nginx:1.11.5
    container_name: nginx
    links:
      - fluentd
    logging:
      driver: fluentd
      options:
        fluentd-address: fluentd:24224

But this configuration does not work, as the fluentd-address is seen externally by the host (aka the host) and not from within the nginx container.

So it requires a way to know the IP address of container outside the container but in a compatible way for docker-compose, any idea ?

For web hosting, my company is looking to use docker containers for each web application with a reverse proxy as front-end. It works but we are looking for a way to let our users manage their own applications, admins will control public and private accesses via the reverse proxy and the dns.

But we cannot let the user the authorization to start/stop docker instances, as user which can send command to a docker daemon can do whatever he wants (as described here and here).

So how can we let user handles start/stop and configuration of some specific docker containers ?

The only solution at the present time (found here) is to let docker detect change in the registry to download and restart updates, for instance with Watchtower).

Another alternative is to wait for the user namespace support to avoid that root container user can access root host user, but will it be enough ?

edit: docker is not so strong for security but in our case:

• Users are limited to authenticated internal employees
• Users cannot directly access to the docker daemon (this the point of my question)
• It is a better solution that the one-instance apache with hundred vhosts
• We need to deal with demands about alternatives web framework / exotic configuration (node.js, meteor, ruby) instead of the classical LAMP, and containers are great for developers to transfer their application to the hosting platform.
• This is an experiment we are conducting, we hope in the not so far future that solutions like project atomic and/or the support of user namespace will bring better guarantees.

I'm looking to the community to see how people are drawing their networks, i.e. using symbols to represent complex topology. You can have hardware approach, where every hardware unit are represented. You can also have "entity" approach, where each "service" is shown. Both are interesting but it is difficult to have both on the same schema (but this is needed, especially using virtualization environment). Furthermore, it is difficult to have complex informations on such representation. For instance security parameters (encrypted link, need for authentication) or specific details (protocol type, ports, encapsulation).

So my question is: where your are drawing a representation of your network, what is your approach? Are you using methodology and/or specific softwares? What is your recommendations for information to put (or not)? How to deal with the complexity when the network becomes large and/or you want to put a lot of information on it?