Boulder: document how to use boulder with a custom docker network

Created on 1 Nov 2017 · 3Comments · Source: letsencrypt/boulder

I use boulder to test acme clients using docker containers. In my case all containers run on a common docker network. The default docker-compose.yml and test/config are not suitable for this setup.

The files configure boulder to use the legacy networking mode and fake dns server. For my setup I need boulder and related containers to join a docker network with my clients and use the resolver from /etc/resolve in the containers provided by the docker.

Although the changes to the configuration files are straightforward, currently there is no documentation how to do that. It would be nice to either document this or perhaps provide an alternative configuration so just running docker-compose up is enough to provide boulder service for other docker containers.

aretools kinquestion

Source

ibukanov

Most helpful comment

I've actually considered switching Boulder to use Docker networking instead of legacy networking by default. It solves a few problems for us, like a weird ordering dependency between prometheus and Boulder. It would also make running Boulder<->Certbot integration tests simpler, since Certbot could run inside its own container. I think we'd be open to a change making this the default in Boulder if it wasn't too disruptive to our workflows. We'd all need to stop/restart (and maybe create/destroy) our containers, but I think that's not terribly bad.

jsha on 1 Nov 2017

👍2

All 3 comments

Hi @ibukanov,

For my setup I need boulder and related containers to join a docker network with my clients and use the resolver from /etc/resolve in the containers provided by the docker.

This setup (using /etc/resolv.conf) will break our integration tests & development workflow that relies on using the FAKE_DNS setting.

Although the changes to the configuration files are straightforward, currently there is no documentation how to do that. It would be nice to either document this or perhaps provide an alternative configuration so just running docker-compose up is enough to provide boulder service for other docker containers.

We haven't documented this because it isn't how we use the Docker environment :-) If you know what configuration changes are required and can implement them in a minimally disruptive way I'd be open to reviewing the PR for including it in Boulder. If the changes break our existing usage or are significantly complicated it may be something that's better handled external to Boulder in one of your own repositories.