Re: [gentoo-user] invitation to gentobb project

[Ural]

Daniel Campbell:
> On Sun, Mar 12, 2017 at 08:56:00PM +0000, Ural wrote:
>> Hello guys. I am sorry about a bit of offtopic, but if everyone is
>> interested, I am inviting anyone into
>> https://github.com/edannenberg/gentoo-bb project discussion thread here:
>> https://github.com/edannenberg/gentoo-bb/issues/102, where we user
>> Docker as engine and Gentoo GNU/Linux as host OS. We have some ideas on
>> (possibly) the best server and LAMP/LEMP management using Gentoo, Docker
>> and GentooBB. Discussing the most table, fastest and secure dedicated
>> server configuration to host everything. Thanks
>>
>
> The concept sounds pretty neat; what do you guys do different than a
> typical Gentoo installation?
>
> What does Gentoo do for a containerized environment? Does this project
> include easier container management than usual? I like the
> containers-as-services idea. If it's not hard to write/make one, I could
> see this project taking off.

The idea of this project is very simple. Manage containers, based on
Gentoo. The only OS you can configure everything. I.E. -march=native,
which decreases php memory usage by 25% and accelerates binaries.

But in usual way, you will do
# docker import stage3-xxx.tar.bz2 gentoo
and emerge needed service, like nginx, mariadb or php.
This way you will have bunch of unmanaged >1GB containers, which have
90% unneded files and is hard to update.

Our project solves this problem. You have bunch of preconfigured
packages, which you already can install and use. Or you can easily
create yours. The images are layered and nested, and your nginx
container will be 17MB and have only what it need.
You can easily rebuild/upgrade/recompile any container, or upgrade all
at once. You just define all settings once.
Example. To build php7 container, it will build busybox, glibc, openssl,
and then including all previous containers will create a resulting
nested container. So you have only one glibc or one bash for all child
containers. So you can take one container as source, add to it a package
and have another nested container.

Why this 'container-per-service' is the best way?
* Security. Containers are just isolated from host OS, thanks to
cgroups, and if hijacked, don't access your rest system. That way if I
use separate php containers for phpBB, piwik and other community-driven
projects, hijacking phpBB will not allow access to rest services. Most
containers runs unprivileged.

* No any overhead. It is just another namespace inside kernel.

* Ability to have blk and cpu priorities for different services, even
when it is not possible to assign in usual native way, like priority for
a mariadb database. If you have 3 mariadb containers, you can easily
manage priorities as needed.

* Easy to upgrade on production, preserving old versions. I described my
way to do this in referenced issue, and I have just a few seconds of
downtime, when I turn off old containers and start new, but all configs
and data are mounted as volumes. If something is not well with upgraded
containers, I can switch it back temporarily.

* This project is already working well, mostly stable and is used on
production. All I did was edited package config files for my need, and
./main.sh build mynamespace. It builds all packages, emerging latest
versions and compiling them from scratch, creating docker containers.
After all built, you start using your containers.

(the developing is going in spring branch and soon we will have big
version update)



>
> Thanks for sharing!
>