<div dir="ltr"><div><div><div><div>Hi Keith,<br></div>I can't talk specifically about the IdP but I can give you some general answers to your questions:<br></div>Logging - I'm looking at Docker for AWS (currently a beta offering) and that stores container logs in AWS CloudWatch which is simple/easy to get to.<br></div>Credentials - You could use a volume mount from a simple container and then link to those mounts from other containers. <br>The mounts will remain, even if the original container is gone, as long as they are being referenced by a runnuing container (according to the docs).<br></div><div>Metadata - we use Jenkins to rebuild our container images daily so there are no issues with staleness.<br></div><div>HTH<br></div><div>Regards, Pete<br></div><br></div><div class="gmail_extra"><br clear="all"><div><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><br><div dir="ltr"><p style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:12.727272033691406px;background-color:rgb(255,255,255);margin:0px"><b>Peter L.K. Newing, CISSP, CCSP, CISA</b></p><p style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:12.727272033691406px;background-color:rgb(255,255,255);margin:0px"><b><span lang="EN-GB">Customer Services Director</span></b></p><p style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:12.727272033691406px;background-color:rgb(255,255,255);margin:0px"><b><span lang="EN-GB"> </span></b></p><div style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:12.727272033691406px;background-color:rgb(255,255,255);margin:0px"><span style="font-family:'Imprint MT Shadow'" lang="EN-GB"><a value="+447545073406" style="color:rgb(17,85,204)">+44 7545 073 406</a></span></div><span><p dir="ltr" style="line-height:1.15;margin-top:0pt;margin-bottom:0pt"><br></p><p dir="ltr" style="line-height:1.15;margin-top:0pt;margin-bottom:0pt"><span style="text-decoration:none;font-size:15px;font-family:Arial;color:rgb(11,83,148);vertical-align:baseline;white-space:pre-wrap;background-color:transparent"><a href="http://www.flexeye.com/" style="text-decoration:none" target="_blank">www.flexeye.com</a></span></p><div><span></span><br><font style="font-size:13px"><div style="font-size:small"><span lang="EN-GB"><div style="font-family:arial"><div style="font-family:arial,sans-serif"><img src="cid:ii_159db1bc2b1f953c" alt="Inline images 1" style="margin-right:0px" width="175" height="53"><br></div><div><br></div></div></span></div></font><div><font color="#000000"><font size="1"><font face="arial, helvetica, sans-serif">This
email and any attachments are confidential and may be privileged. If
you have received it in error, do not read it, copy it, forward it,
disclose its contents or use it for any purpose. Please notify us
immediately and then delete it. Any views or opinions expressed are
solely those of the author and not necessarily those of Flexeye Ltd. </font><span style="font-family:Arial,sans-serif">This
email was sent from Flexeye Limited, Hays House, Millmead, Guildford
GU2 4HJ. Registered Office: Wey Court West, Union Road, Farnham, Surrey
GU9 7PT United Kingdom. Registered in England No 4852559. VAT no GB 821
3432 66A</span></font></font></div></div></span></div></div></div></div></div></div></div></div></div></div></div>
<br><div class="gmail_quote">On 20 February 2017 at 19:35, Wessel, Keith <span dir="ltr"><<a href="mailto:kwessel@illinois.edu" target="_blank">kwessel@illinois.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">All,<br>
<br>
Hoping others who have already done this might have some wisdom to share.<br>
<br>
We're in the process of moving our IdP to the cloud, specifically to an AWS Elastic Beanstalk instance. Dockerizing the IdP isn't hard and, in fact, we can leverage TIER's packaging should we choose to and if we're willing to move from jetty back to Tomcat.<br>
<br>
Specific areas of interest are logging and data sealer credential storage.<br>
<br>
I'm assuming, with all of the logs coming out of Tomcat/Jetty and the IdP, it's best to send the application server logs to stdout and everything else to a syslog server, but I'm curious if others have other ideas.<br>
<br>
The data sealker creds lend themselves to externally mounted storage for consistency across restarts, but if anyone can suggest another way to handle this that's lighter weight, I'd be interested.<br>
<br>
Of less significance is metadata: presumably, the IdP will pull down the latest federation metadata aggregate on start-up, but if for som reason that's unavailable, we'll be stuck with any metadata stored in the Docker image as a fallback. This could be stale. Any recommendations for dealing with this?<br>
<br>
Thanks for any guidance,<br>
Keith<br>
<span class="HOEnZb"><font color="#888888"><br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.<wbr>net</a><br>
</font></span></blockquote></div><br></div>