Recommended practices for Dockerizing the IdP

[Pete Newing]

Hi Keith,
I can't talk specifically about the IdP but I can give you some general
answers to your questions:
Logging - I'm looking at Docker for AWS (currently a beta offering) and
that stores container logs in AWS CloudWatch which is simple/easy to get to.
Credentials - You could use a volume mount from a simple container and then
link to those mounts from other containers.
The mounts will remain, even if the original container is gone, as long as
they are being referenced by a runnuing container (according to the docs).
Metadata - we use Jenkins to rebuild our container images daily so there
are no issues with staleness.
HTH
Regards, Pete



*Peter L.K. Newing, CISSP, CCSP, CISA*

*Customer Services Director*


+44 7545 073 406


www.flexeye.com

[image: Inline images 1]

This email and any attachments are confidential and may be privileged. If
you have received it in error, do not read it, copy it, forward it,
disclose its contents or use it for any purpose.  Please notify us
immediately and then delete it.  Any views or opinions expressed are solely
those of the author and not necessarily those of Flexeye Ltd.  This email
was sent from Flexeye Limited, Hays House, Millmead, Guildford GU2
4HJ. Registered Office: Wey Court West, Union Road, Farnham, Surrey GU9 7PT
United Kingdom.  Registered in England No 4852559. VAT no GB 821 3432 66A

On 20 February 2017 at 19:35, Wessel, Keith <kwessel at illinois.edu> wrote:

> All,
>
> Hoping others who have already done this might have some wisdom to share.
>
> We're in the process of moving our IdP to the cloud, specifically to an
> AWS Elastic Beanstalk instance. Dockerizing the IdP isn't hard and, in
> fact, we can leverage TIER's packaging should we choose to and if we're
> willing to move from jetty back to Tomcat.
>
> Specific areas of interest are logging and data sealer credential storage.
>
> I'm assuming, with all of the logs coming out of Tomcat/Jetty and the IdP,
> it's best to send the application server logs to stdout and everything else
> to a syslog server, but I'm curious if others have other ideas.
>
> The data sealker creds lend themselves to externally mounted storage for
> consistency across restarts, but if anyone can suggest another way to
> handle this that's lighter weight, I'd be interested.
>
> Of less significance is metadata: presumably, the IdP will pull down the
> latest federation metadata aggregate on start-up, but if for som reason
> that's unavailable, we'll be stuck with any metadata stored in the Docker
> image as a fallback. This could be stale. Any recommendations for dealing
> with this?
>
> Thanks for any guidance,
> Keith
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170221/1a277fea/attachment-0001.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image.png
Type: image/png
Size: 27466 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/users/attachments/20170221/1a277fea/attachment-0001.png>