3

I have a WordPress site that is gonna be hosted using ECS in AWS.

To make the management even more flexible, I plan not to store service configurations (i.e. php.ini, nginx.conf) inside the docker image itself. I found that docker swarm offers "docker configs" for such. Are there any equivalent tools doing the same thing? (I know AWS Secrets Manager can handle docker secrets though)

Any advice or alternative approaches? thank you all.

2 Answers 2

1

The most similar you could use is probably AWS SSM Parameter store

You will need some logic to retrieve the values when you are running the image.

  • If you don't want to have the files also inside of the running containers, then you pull from Parameter Store, and add them to the environment, and you will need to do probably some work in the application to read from the environment (the application stays decoupled from the actually source of the config), or you can read directly from Param store in the application (easier, but you have some coupling in your image with Parameter store.

  • if your concern is only about not having the values in the image, but it is fine if they are inside of the running container, then you can read from Param Store and inject the values in the container inside of the usual location of the files, so for the application is transparent

As additional approaches:

  • Especially for php.ini and nginx.conf I like a simple approach that is having a separate git repo, with different config files per different environments.

    • You have a common docker image regardless of the environment
    • in build time, you pull the proper file for the enviroment, and either save as env variables, or inject in the container
  • And last: need to mention classic tools like Chef or Puppet, and also ansible. More complex and maybe overkill

0

The two ways that I store configs and secrets for most services are

  • Credstash which is combination of KMS and Dynamodb, and
  • Parameter Store which has already been mentioned,

The aws command line tool can be used to fetch from Parameter Store and S3(for configs), while credstash is its own utility (quite useful and easy to use) and needs to be installed separately.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.