6 ms·

This is slightly off-topic, but does Dokku take care of host level security at all? Or do you have secure the server normally before using Dokku?

josegonzalez 4y ago
It doesn't, mostly because it's a fairly large area to have opinions about, and not everyone agrees on what is required (in fact, I know of at least two orgs using Dokku that would definitely not agree on each others requirements). Honestly I think Dokku is complex enough as is without me trying to hamfist my idea of security onto a user's host. I don't think I know enough about the topic to make good decisions that everyone will agree upon (and will be friendly enough to users to not make them upset with Dokku).
- overbytecode 4y ago
  Ah I see. That's a fair point. With Heroku you delegate both (1) the server management and (2) the deployment aspects of an application. Dokku seems to solve (2), I hope someone will come up with an automated solution to turn a linux box into a secured application runtime. I use digital ocean apps and can't help but feel grifted, the price for what you're getting in specs is terrible compared to a VPS or a bare metal. The same is true with Render or Fly. But I just don't have the time or confidence to run my own server. I feel like there is an opportunity for huge savings here, I just need that fictional piece of software.
  - josegonzalez 4y ago
    Yeah that makes sense. I really liked Triton from Joyent, as it provided a neat host os that could essentially be looked at as a multi-host docker installation but didn't run much else. You could then run the Dokku docker image on top of that and only really expose `nginx` (for routing) and `openssh` (for builds and interacting with Dokku), limiting your surface area. You can do this today if you wish on top of Alpine Linux or some other small host os, but that only takes care of half the problem (the other part being firewalls and detecting intrusion attempts imo).
- toyg 4y ago
  Any chance Dokku will ever run on OpenBSD? Its philosophy of "everything disabled unless you need it" would make it an excellent choice from a default-security perspective.
  - josegonzalez 4y ago
    Dokku mostly uses existing "unix" tools or golang binaries, so it should in theory work (buildpacks are another matter, as they are mostly written for Linux, but a Dockerfile-based build should work). The big issue is actually interacting with the Docker daemon, as that is Linux only. If you could provide a `docker` binary on the host that was a wrapper around Jails for the commands we use, it should work just fine. That said, I don't use BSD and wouldn't have time to investigate adding support for any of the BSDs.

josegonzalez 4y ago

It doesn't, mostly because it's a fairly large area to have opinions about, and not everyone agrees on what is required (in fact, I know of at least two orgs using Dokku that would definitely not agree on each others requirements). Honestly I think Dokku is complex enough as is without me trying to hamfist my idea of security onto a user's host. I don't think I know enough about the topic to make good decisions that everyone will agree upon (and will be friendly enough to users to not make them upset with Dokku).

overbytecode 4y ago
Ah I see. That's a fair point. With Heroku you delegate both (1) the server management and (2) the deployment aspects of an application. Dokku seems to solve (2), I hope someone will come up with an automated solution to turn a linux box into a secured application runtime. I use digital ocean apps and can't help but feel grifted, the price for what you're getting in specs is terrible compared to a VPS or a bare metal. The same is true with Render or Fly. But I just don't have the time or confidence to run my own server. I feel like there is an opportunity for huge savings here, I just need that fictional piece of software.
- josegonzalez 4y ago
  Yeah that makes sense. I really liked Triton from Joyent, as it provided a neat host os that could essentially be looked at as a multi-host docker installation but didn't run much else. You could then run the Dokku docker image on top of that and only really expose `nginx` (for routing) and `openssh` (for builds and interacting with Dokku), limiting your surface area. You can do this today if you wish on top of Alpine Linux or some other small host os, but that only takes care of half the problem (the other part being firewalls and detecting intrusion attempts imo).
toyg 4y ago
Any chance Dokku will ever run on OpenBSD? Its philosophy of "everything disabled unless you need it" would make it an excellent choice from a default-security perspective.
- josegonzalez 4y ago
  Dokku mostly uses existing "unix" tools or golang binaries, so it should in theory work (buildpacks are another matter, as they are mostly written for Linux, but a Dockerfile-based build should work). The big issue is actually interacting with the Docker daemon, as that is Linux only. If you could provide a `docker` binary on the host that was a wrapper around Jails for the commands we use, it should work just fine. That said, I don't use BSD and wouldn't have time to investigate adding support for any of the BSDs.