Docker UAT / Production Image Generation
Just a quick question about the best practices for creating Docker images for mission critical environments. As we know in the real world, often the deployment time of a team / company in internal testing is not the same as who is deploying client test environments and production. A problem arises because all application configuration information might not be available when building a Docker UAT / production image for example. with Jenkins. And then the question arises about the passwords that are stored in the application configuration.
So my question is, how "fully configured" is the Docker image? As I see it, in practice it is not possible to completely customize the Docker image, but some application passwords, etc. Should be omitted. But then again, this is a little off the target of the Docker image?
source to share
how "fully configured" the Docker image should be? As I see it, in practice it is not possible to completely customize the Docker image, but some application passwords, etc. Should be omitted. But then again, is that slightly out of line with the purpose of the Docker image?
There will always be trade-offs between convenience, safety and flexibility. An image that works with a zero runtime configuration is very handy to launch, but not very flexible and sensitive configuration like passwords. An image that accepts all configuration at runtime is very flexible and doesn't provide sensitive information, but can be awkward to use if no defaults are provided. If the user doesn't know some of the values, they might not use the image at all.
Sensitive information like passwords usually lands on the execution side when deciding what configuration to bake in images and what to require at runtime. However, this is not always the case. As an example, you might want to create test images with zero runtime configuration that only point to test environments. Anyway, everyone has access to the test environment credentials, zero configuration is more convenient for testers, and no one can accidentally run a build against the wrong database.
For configuration other than credentials (e.g. application properties, logarithm, log file location), the organizational structure and command dynamics can dictate which configuration you bake into. In a devops environment, changing and creating a new image can be painless. In this case, it makes sense to bake as many configurations as you want. If the ops and development operations are separate, it may take several days to make minor changes to the image. In this case, it makes sense to allow large runtime configuration.
Going back to the original question, I personally advocate choosing sensible defaults for all but credentials and allowing runtime overrides only as needed (convention with reluctant configuration). Runtime configuration is convenient for operating systems, but can make it difficult for the development team to track issues.
source to share