perfSONAR User Q&A and Other Discussion

[Mark Feit <>]

Johann Hugo writes:

 

I would like to run this script automatically when starting the container (with docker-compose)

/usr/lib/perfsonar/scripts/configure_firewall install

 

Where is the best place to do it ?

 

As far as I know, Docker Compose doesn’t have hooks to run programs on the host when containers are started.  I suspect that has to do with running on multiple OSes prevents them from guaranteeing consistent behavior across all of them.  The only reliable way to achieve that would be to wrap both actions in a script that does both and run that instead of Docker Compose, but that causes logistical problems if you want to keep the host systems free of container-specific code.

 

One other option is to piggyback the container directly onto an outside interface with Docker’s macvlan network driver.  The container includes the perfsonar-toolkit-security package, so it’s already properly-firewalled internally.  We’re doing at Internet2 on our internal 100 Gb/s systems and the drag on performance is essentially zero compared to bare metal on the same hardware.

 

--Mark