<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8" /></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">Hello Zach,<br>
<br>
> Gluster Volume subdirectories Bind Mounted into their respective containers (i.e. /data/gluster/user1 -> container:/data/gluster)<br>
<br>
Considering this line, do you even depend on ACLs? I'd think bind mounts provide sufficient protection by itself, as long as server demons run outside containers.<br>
<br>
(I'm currently facing similar problem, but don't have first-hand experience solving it yet.)<br>
-- <br>
<br>
With Best Regards,<br>
Marat Khalili<br><br><div class="gmail_quote">On August 14, 2016 4:50:52 AM GMT+03:00, Zach Lanich <zach@zachlanich.com> wrote:<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
Hey guys, I have a crucial decision I have to make about a platform I’m building, and I really need your help to make this decision in regards to security. Here’s what I’m trying to accomplish:<div class=""><br class="" /></div><div class="">Platform: Highly Available Wordpress hosting using Galera, GlusterFS & LXD (don’t worry about the SQL part)</div><div class="">- One container per customer on a VM (or ded server)</div><div class="">- (preferably) One 3 node GlusterFS Cluster for the Wordpress files of all customers’ containers</div><div class="">- GlusterFS volume divided into subdirectories (one per customer), with ACLs to control permissions (see *)</div><div class="">- Gluster Volume subdirectories Bind Mounted into their respective containers (i.e. /data/gluster/user1 -> container:/data/gluster)</div><div class="">- LXC User/Group mappings to make the ACLs work</div><div class=""><br class="" /></div><div class="">My concerns:</div><div class="">- (*) Although the containers are isolated (all but the shared kernel), and that in itself is probably secure enough to feel ok about it, introducing a shared Gluster volume into the mix and depending on ACLs makes me a bit nervous. I’d like your opinions on what the norm is in the world (the PaaSs, etc) and if you guys think this is a terrible idea. If you think this is not a good way of handling my needs, PLEASE help me find a better solution.</div><div class=""><br class="" /></div><div class="">My hangups:</div><div class="">- I know PaaSs have found incredibly efficient ways to provide containerized apps with high availability, and I tend to highly doubt they’re throwing up 3+ GlusterFS VMs for every single app they deploy. This to me seems like an impossibly cost-ineffective approach. Correct me if I’m wrong. That being said, I’m not 100% sure how they’re doing it.</div><div class=""><br class="" /></div><div class="">Odd thoughts & alternative solutions that have crossed my mind:</div><div class="">- To avoid using a shared single Gluster Volume and ACLs altogether, while also avoiding too much infrastructure cost, I’ve thought of possible putting up a 3 VM Gluster cluster, each with matching LXD Containers on them with Gluster server daemons running in those containers. I could use those containers & networking to simulate having multiple 3 node Gluster Clusters, each being dedicated to a respective containerized app on the App Server. This to me seems like it would be an unnecessarily complex and annoying to maintain solution, so please help me here.</div><div class=""><br class="" /></div><div class="">I hugely appreciate anyones help and this is a huge passion project of mine and I’ve dedicated an absurd number of hours reading to try and figure this out.<br class="" /><div class="">
<div style="color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><br class="Apple-interchange-newline" />Best Regards,</div><div style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><br class="" /></div><div style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">Zach Lanich</div><div style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><i class="">Business Owner, Entrepreneur, Creative</i></div><div style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><b class=""><i class="">Owner/CTO</i></b></div><div style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">weCreate LLC</div><div style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><div class=""><i class=""><a href="http://www.wecreate.com" class="">www.WeCreate.com</a></i></div></div></div></div>
</div>
<br class="" /></div><p style="margin-top: 2.5em; margin-bottom: 1em; border-bottom: 1px solid #000"></p><pre class="k9mail"><hr /><br />lxc-users mailing list<br />lxc-users@lists.linuxcontainers.org<br /><a href="http://lists.linuxcontainers.org/listinfo/lxc-users">http://lists.linuxcontainers.org/listinfo/lxc-users</a></pre></blockquote></div></body></html>