For web hosting, my company is looking to use docker containers for each web application with a reverse proxy as front-end. It works but we are looking for a way to let our users manage their own applications, admins will control public and private accesses via the reverse proxy and the dns.
So how can we let user handles start/stop and configuration of some specific docker containers ?
Another alternative is to wait for the user namespace support to avoid that root container user can access root host user, but will it be enough ?
edit: docker is not so strong for security but in our case:
- Users are limited to authenticated internal employees
- Users cannot directly access to the docker daemon (this the point of my question)
- It is a better solution that the one-instance apache with hundred vhosts
- We need to deal with demands about alternatives web framework / exotic configuration (node.js, meteor, ruby) instead of the classical LAMP, and containers are great for developers to transfer their application to the hosting platform.
- This is an experiment we are conducting, we hope in the not so far future that solutions like project atomic and/or the support of user namespace will bring better guarantees.