[HN Gopher] My personal reasons to not run my Nginx reverse-prox...
       ___________________________________________________________________
        
       My personal reasons to not run my Nginx reverse-proxy inside Docker
        
       Author : ebenes
       Score  : 14 points
       Date   : 2024-06-19 19:35 UTC (3 hours ago)
        
 (HTM) web link (ewaldbenes.com)
 (TXT) w3m dump (ewaldbenes.com)
        
       | JohnMakin wrote:
       | Oof, in his reasons to use docker (which it seems like he uses as
       | a synonym for containerization), misses probably the most
       | important one -
       | 
       | 6. Provides an additional layer of security between the
       | application and its host
       | 
       | As far as his availability concerns, I don't see why running or
       | not running docker would help this problem. You can certainly
       | build highly available nginx reverse proxies in docker, and can
       | do in place upgrades with no downtime. This has been solved for a
       | very long time.
        
         | SPascareli13 wrote:
         | Docker (and containers in general) adds namespacing, but not
         | security, for applications. If anything, docker can add MORE
         | attack vectors.
         | 
         | No one should use containers primarily for security ever.
        
           | JohnMakin wrote:
           | Sorry but what you said makes absolutely no sense. The
           | security implication I am talking about is that in a typical
           | container the application cannot escalate privilege out of
           | the container and touch the host, with the exception of
           | obvious things like shared file systems, etc. This is a known
           | benefit of containerization and not at all controversial.
        
       | bootloop wrote:
       | Just run it in LXC. Then the container is not immutable but the
       | process will still be isolated with it's dependencies. And
       | infrastructure as code, with Ansible etc, all possible.
       | 
       | Also the talk about docker being itself a dependency I can't
       | really follow. I guess you would have many other dockers also
       | running, otherwise being nxing the only thing within docker..
       | that doesn't make much sense..
        
       | smitty1e wrote:
       | This a good analysis.
       | 
       | However, for a quick skim of the article, all of cited issues
       | with Docker as such are in fact solved by services such as
       | ECS[0].
       | 
       | Thus, the question of whether to manage nginx directly may be
       | more of a business decision (am I dealing with a cloud provider?)
       | than a technical one (are these requirements delivered by a
       | service?).
       | 
       | [0] https://docs.aws.amazon.com/ecs/
        
       ___________________________________________________________________
       (page generated 2024-06-19 23:02 UTC)