This document discusses deploying a resilient e-commerce platform using containers. It covers how containers can help solve issues with traditional monolithic e-commerce applications like varying OSes/middleware stacks and lack of scalability. Specific topics covered include using Docker Swarm for scalability, tools like Traefik and ProxySQL for load balancing, Portworx for distributed storage, applying security best practices to containers/orchestration, and implementing continuous integration/delivery workflows using tools like Drone.

1. Deploy a resilient E-Commerce platform
ContainerDays 2017 Hamburg
Rachid Zarouali
1

2. WHO AM I
Rachid Zarouali
Synolia
Docker CommunityLeader / Ambassador
Teacher at EPSI Lyon
@xinity / xinity.github.io
2

3. AGENDA:
Security
Scalability / Resiliency
Distributed Storage
CI/CD
E-Commerce
3

4. ONCE UPON A TIME ....
4

5. ONCE UPON A TIME:
E-COMMERCE APPLICATIONS
(Too) Many servers
Different OS version
Different middleware Stack
5

6. 6

7. ONCE UPON A TIME:
E-COMMERCE APPLICATIONS
Management and Monitoring Hell
Solutions bound to a specific stack
No scalability / resiliency
bleeding cost
7

8. ONCE UPON A TIME:
ECOMMERCE APPLICATIONS
Web
Servers
Language Databases Search cache
session
Apache PHP Mysql Elasticsearch Redis
Nginx Postgresql SolR Memcached
Mongodb
8

9. CHAPTERS:
E-Commerce meets Docker
Scalability / Resiliency
CI/CD
Security
9

10. E-COMMERCE MEETS DOCKER
10

11. E-COMMERCE MEETS DOCKER
11

12. E-COMMERCE MEETS DOCKER
Challenge Winner Benefits
Single OS RancherOS Smaller OS footprint
Improve
management
Docker-Compose Management made easy
Break stack
dependency
Docker Registry Middleware stack flexibility
Proof Of Concept
12

13. E-COMMERCE MEETS DOCKER
Proof Of Concept
13

14. 14

15. HERE COMES THE BAD TIME!!!
15

16. CHAPTERS:
E-Commerce meets Docker
Scalability / Resiliency
CI/CD
Security
16

17. SCALABILITY / RESILIENCY
DOCKER SWARM
Out Of the Box
Small learning curve
Better integration
Dead Simple
17

18. SCALABILITY / RESILIENCY:
Middleware
Web
Servers
Language Database Search cache
session
Apache PHP Mysql Elasticsearch Redis
Nginx Postgresql SolR Memcached
Mongodb
18

19. SCALABILITY / RESILIENCY:
Missing Link ?
Middleware requirements Tools
Apache / Nginx Load-Balancer Traefik
Php Load-Balancer Docker-Flow
Mysql replication + K/V Store
+ LB
PXC + Etcd +
ProxySQL
19

20. SCALABILITY / RESILIENCY:
Big Picture
Traefik Traefik
Apache ApacheApache
Mysql Mysql Mysql
ProxySQL ProxySQL
PHP PHP PHP
ElasticSearch
ElasticSearch
ElasticSearch
Varnish Varnish
Etcd Etcd Etcd
20

21. SCALABILITY / RESILIENCY:
21

22. SCALABILITY / RESILIENCY: STORAGE
E-Commerce Media (images, videos,...)
FileSystem type: NFS, CEPH
Container Built : Infinit, Longhorn, Portworx
22

23. SCALABILITY / RESILIENCY: PORTWORX
Production ready
easy integration with DockerEE / Rancher ...
Powerfull features: I/O Handling, Data commit
Nice WebUI
23

24. SCALABILITY / RESILIENCY: PORTWORX
24

25. PORTWORX UI
25

26. CHAPTERS:
E-Commerce meets Docker
Scalability / Resiliency
Security
CI/CD
26

27. TIME TO DEFEND AGAINST THE BAD GUY !!!
27

28. SECURITY: LEVELS
Hosts
Containers
Orchestration framework
Network
28

29. SECURITY: HOSTS
No root containers
Docker security benchmark
https://github.com/docker/docker-bench-security
CIS Docker Benchmark:
https://github.com/dev-sec/cis-docker-benchmark
firewalld / ufw / netfilter
29

30. SECURITY: CONTAINERS
Notary
TDD Best Practice
Security Scanning / behavior detection tools
CI/CD Workflow
30

31. SECURITY: ORCHESTRATION
Safe Managers
Access control
Secrets Management
31

32. SECURITY: NETWORK
Don't expose sensitive networks
Encrypt Network(**)
Limit service exposure
** : Only if really necessary
32

33. CHAPTERS:
Ecommerce meets Docker
Scalability / Resiliency
Security
CI/CD
33

34. CI/CD: INFRASTRUCTURE
Middleware containers only
Linting Dockerfile
Security Scanning
Drone as a CI/CD tool
34

35. CI/CD: DEPLOYMENT MODEL
Private Registry
Watchtower
Security Scanning
35

36. CI/CD: WORKFLOW EXAMPLE
git commit WebHooks
DroneCI
Linting Dockerfile Test Technical test
Registry
Swarm Node1
OK OK
KO KO KO
OK
Swarm Node2
Swarm Node3
36

37. WHAT'S NEXT ?
Full CI/CD integration
AutoScaling
Security Scanning
LinuxKit
37

38. 38