1

I'm not a docker user, just want to know if this is an accurate use case for docker.

Current State

We deploy custom Java apps on RHEL/VMware. To function properly, the apps depend on local Java runtime, Tomcat, local user accounts, start/stop scripts, and environment settings, all of which must be installed and configured ahead of time on the machine.

Problem: RHEL Upgrades/Maintenance

Periodic OS maintenance disrupts the environment, sometimes Tomcat, other times Java, but mostly local user accounts and permissions, forcing us to call SAs to fix the issues; it's a major PITA.

Question

Can we use docker containers to encapsulate our Java apps along with their dependencies (Java runtime, Tomcat, user accounts, local settings, etc), such that we're insulated from future maintenance on the underlying OS? In such a scenario, docker containers, not Java WAR/JAR files, become the main deployment artifacts, correct?

That's my understanding of docker, please pardon the ignorance if that makes no sense :-D

Improve this question

1 Answer 1

Reset to default
3

I'm working as a VMware vSphere administrator and look at docker both as a threat (might cost me my job if containers replace VMs) and an opportunity (it's a virtualization technology, after all, so maybe we could make it part of our portfolio and deliver it as a service).

But to your question: Yes, docker containers would become the main deployment artifacts.

But please consider what this means. Java, Tomcat etc. updates are done for a reason, often to fix serious security issues. If you put all dependencies of your application in a docker container you're responsible for all security updates. At the moment, your operations team is responsible to deploy security patches to Java, Tomcat and all that stuff. With docker you have to rebuild the container with the updates (not that hard, but you have to do it) and re-deploy it. So you'll have a downtime after all: Stop and delete the old container, deploy and start the new one.

Of course, you can just ignore any security updates and refuse to roll out the patches... I wonder what your IT security will say to that.

Improve this answer
4
  • 1
    This is perhaps the most compelling reason to not use Docker. It puts the job of system security updates onto developers, which is not quite where it belongs.
    – Michael Hampton
    Feb 17, 2015 at 19:20
  • Just spoke to our SA team; they raised the exact same concerns over security. Aside from rebuilding the image, are there any other options on the horizon?
    – SAFX
    Feb 17, 2015 at 19:34
  • @SAFX If you put all your dependecies in your container and one of this dependencies needs an update, the only solution is to rebuild the container. But why does OS maintenance affect local user accounts and permissions? If your operations team keeps breaking your apps, escalate to your manager. They need some very good excuses for this. Btw: Consider tools like puppet or chef to enforce the local users you need exist and have the permissions you need. And get a test environment. If OS maintenance kills your app in test, it shouldn't be deployed in prod.
    – Mario Lenz
    Feb 17, 2015 at 20:02
  • @MarioLenz That's a different story :-D, thanks for the info, this was helpful.
    – SAFX
    Feb 17, 2015 at 21:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .