I am very new to docker and have successfully created several containers for my own personal use. When I consider using docker to separate services on a server I administer, I do not understand how it can work for multiple users.
Q1: How do multiple users use the same volume/shared folder?
Example: Multiple developers working together needing to use a common python environment that is not well supported on the base OS. For example RHEL6 with the latest Python using tensorflow and/or other packages which require system libraries outside of python. In the past, I would put all of this in a virtual environment but it would still require the base packages match and the outside system libraries be installed. I can easily build a docker image for this. However, I run into two problems.
- Source code folder is outside the docker image so it is a mounted volume. All source files that are created or modified are now owned by whatever user started docker
- One solution is to let each user run their own container and specify the user when they start the container. However, this would require they be given access to the docker executable which means they can control all the containers. Also I don't know what would stop them from entering any user or root?
Q2: How to authenticate inside a container?
Example: My server authenticates to a Microsoft Active Directory using winbind. I've read that ideally, each container would only have one process. If I wanted SSH in its own container, how would SSH know how to authenticate? Wouldn't it be stuck in the namespace of the container? What about other services like NFS, Samba, etc.
A more general question, is there a "best practices" guide for which services applications should be split into separate containers? I've seen apache under its own container and database under a separate container. This works because they communicate over a network. Some services arent connected via network (ie. iptables, winbind, nfsd, samba) yet I still see images for them in docker hub. Wouldn't this create a mess for services that need to see everything like Auditd, Crond, autofs? This also seems like a mess for something like python. Maybe one user wants matplotlib and the other wants pyqtgraph. It seems easier to have them use a virtualenv then have to setup and maintain docker containers for each especially if I need to configure each one for security (ie. auditd, iptables, authentication, various settings, etc).
Reset to default
