Answers: <p>One could pass <a href="https://docs.docker.com/v1.7/reference/run/" rel="nofollow noreferrer">environment variables</a> when running docker, e.g.:</p>
  
  <blockquote>
    <p>Additionally, the operator can set any environment variable in the
    container by using one or more -e flags, even overriding those
    mentioned above, or already defined by the developer with a Dockerfile
    ENV:</p>
  
  <pre><code>$ docker run -e "deep=purple" --rm ubuntu /bin/bash -c export
  </code></pre>
  </blockquote>
  
Answers: CC BY-SA 3.0
Answers: 2017-08-10T15:21:17.483Z
Answers: 2017-08-10T15:21:17.483Z
Answers: 030
Answers: <p>One solution would be to create a base image with OpenVPN and global configurations and child images for the certs.</p>
  
  <p>The base <code>Dockerfile</code> might look like this.</p>
  
  <pre><code>FROM debian:latest
  RUN apt-get update &amp;&amp; apt-get -y install \
    openvpn \
    easy-rsa \
    etc
  
  RUN &lt;any needed configurations&gt;
  </code></pre>
  
  <p><code>docker build -t openvpn:baseimage .</code></p>
  
  <p>The cert <code>Dockerfile</code>.</p>
  
  <pre><code>FROM openvpn:baseimage
  COPY certs /etc/easy-rsa/
  
  CMD openvpn
  </code></pre>
  
  <p><code>docker build -t useast:1 .</code></p>
  
  <p>You could push the certs to the respective nodes with some kind of management tool and <code>build</code> the child images there. The base image would live in an available registry. Once the base image is cached on each node in Docker, the builds should be quick. </p>
  
  <p>There are multiple solutions to this problem depending on what's best for the given environment.           </p>
  
Answers: CC BY-SA 3.0
Answers: 2017-08-18T15:36:36.180Z
Answers: 2017-08-18T15:36:36.180Z
Answers: wesley
Answers: <p>If I get it right you use the same image for each container but their "state" change regarding the location, so you need an uniq cert per container.</p>
  
  <p>I suppose, if you have the need of OpenVPN, this is not a Swarm cluster. (If it was no need for openVPN), so no access to docker <code>config</code> or <code>secret</code>.</p>
  
  <p>I would go for a key/value store like <a href="https://www.consul.io/intro/index.html" rel="nofollow noreferrer">consul</a> and bundle it with <a href="https://github.com/hashicorp/consul-template" rel="nofollow noreferrer">consul-template</a> so your config are store to the same place and consul-template generate the related files directly in the container.</p>
  
Answers: CC BY-SA 3.0
Answers: 2017-08-10T10:30:28.270Z
Answers: 2017-08-10T10:30:28.270Z
Answers: Juub
Answers: <p>You can use sharing volumes between the host that run the container and the instance, in this case you can put the crt files in anywhere in the hosts then map it to specific folder in the container, the same for configuration you can configure the service to read the configuration file from specific path and every time you mount whatever configuration you like to that specific folder and the service will read it.</p>
  
  <p>For more info:
  <a href="https://docs.docker.com/engine/admin/volumes/volumes/" rel="nofollow noreferrer">https://docs.docker.com/engine/admin/volumes/volumes/</a></p>
  
Answers: CC BY-SA 3.0
Answers: 2017-08-13T08:37:05.657Z
Answers: 2017-08-13T08:37:05.657Z
Answers: Wissam Roujoulah
Answers: <p>As you are trying to manage multiple servers you should start looking into any config management tools.</p>
  
  <p>You could start looking into Ansible, as it is easier to setup and manage than other CM tools like Chef and Puppet (which have their own dependent resources to manage and run) .</p>
  
  <p>Ansible is agentless, SSH based config tool written on python. (But it does not require you to code in py)</p>
  
  <p>You just have to learn yml syntax (Jinja2) which is pretty easy . Its just a set of instructions on how to configure the server</p>
  
  <p>Now coming to your use case</p>
  
  <ol>
  <li><p>When you say that you push the docker images to multiple server across globe (which means you have a central node which can connect to all servers). This node can behave like the Ansible master (Where you install all ansible dependencies) </p>
  
  <p>If its is Deb based I have the scripts handy</p>
  
  <pre><code>    sudo apt-get -y install python-dev 
      sudo apt-get -y install libffi-dev
      sudo apt-get -y install libssl-dev
      sudo pip install paramiko 
      sudo pip install PyYAML 
      sudo pip install Jinja2 
      sudo pip install httplib2 
      sudo pip install six 
      sudo pip install markupsafe  
      sudo pip install ansible
  </code></pre></li>
  <li><p>After you install ansible write a sample playbook  (with just a echo command)
  <a href="http://docs.ansible.com/ansible/latest/playbooks_intro.html" rel="nofollow noreferrer">http://docs.ansible.com/ansible/latest/playbooks_intro.html</a></p></li>
  <li><p>Lists all your servers in the inventory file
  <a href="http://docs.ansible.com/ansible/latest/intro_inventory.html" rel="nofollow noreferrer">http://docs.ansible.com/ansible/latest/intro_inventory.html</a></p></li>
  <li><p>Execute your playbook for testing with below command
  ansible-playbook  -i  --extra-vars "key=Value"</p></li>
  <li><p>Modify your playbook to include Docker image and set env variables of your credentials. Encrypt your creds using Bcrypt or some util</p></li>
  <li><p>Store your playbooks in Git or other Source control</p></li>
  </ol>
  
  <p>Happy Coding in Ansible.</p>
  
Answers: CC BY-SA 3.0
Answers: 2017-08-13T08:51:20.703Z
Answers: 2017-08-13T08:51:20.703Z
Answers: Ameen Ibrahim Raffic - 'AIR'
Body: <p>I got an application server image built with Docker. However, this image contains an OpenVPN client which needs a different certificate for each client, among other minimal configuration files.</p>
  
  <p>I push this image to multiple servers across the globe. Every of them communicates with each other, thats the reason to use the VPN.</p>
  
  <p>How should I put the configuration for such servers? I think this is out the scope of Docker. Must I use a configuration server like Ansible or so?</p>
  
Tags: <docker><deployment><configuration>
Title: Same Docker image, multiple configurations
UserDisplayName: burntface
ThreadText: # Same Docker image, multiple configurations
  
  (Asked by: username_0 on 2017-08-10)
  
  I got an application server image built with Docker. However, this image contains an OpenVPN client which needs a different certificate for each client, among other minimal configuration files.
  
  I push this image to multiple servers across the globe. Every of them communicates with each other, thats the reason to use the VPN.
  
  How should I put the configuration for such servers? I think this is out the scope of Docker. Must I use a configuration server like Ansible or so?
  
  **Tags:** docker, deployment, configuration
  
  
  ---
  
  ## 5 answers
  
  ### Answer by username_1 on 2017-08-10. Score: 2
  
  One could pass [environment variables](https://docs.docker.com/v1.7/reference/run/) when running docker, e.g.:
  
  > Additionally, the operator can set any environment variable in the
  > container by using one or more -e flags, even overriding those
  > mentioned above, or already defined by the developer with a Dockerfile
  > ENV:
  >
  > ```
  > $ docker run -e "deep=purple" --rm ubuntu /bin/bash -c export
  >
  > ```
  
  
  ---
  
  ### Answer by username_2 on 2017-08-18. Score: 2
  
  One solution would be to create a base image with OpenVPN and global configurations and child images for the certs.
  
  The base `Dockerfile` might look like this.
  
  ```
  FROM debian:latest
  RUN apt-get update && apt-get -y install \
    openvpn \
    easy-rsa \
    etc
  
  RUN <any needed configurations>
  
  ```
  
  `docker build -t openvpn:baseimage .`
  
  The cert `Dockerfile`.
  
  ```
  FROM openvpn:baseimage
  COPY certs /etc/easy-rsa/
  
  CMD openvpn
  
  ```
  
  `docker build -t useast:1 .`
  
  You could push the certs to the respective nodes with some kind of management tool and `build` the child images there. The base image would live in an available registry. Once the base image is cached on each node in Docker, the builds should be quick.
  
  There are multiple solutions to this problem depending on what's best for the given environment.
  
  
  ---
  
  ### Answer by username_3 on 2017-08-10. Score: 0
  
  If I get it right you use the same image for each container but their "state" change regarding the location, so you need an uniq cert per container.
  
  I suppose, if you have the need of OpenVPN, this is not a Swarm cluster. (If it was no need for openVPN), so no access to docker `config` or `secret`.
  
  I would go for a key/value store like [consul](https://www.consul.io/intro/index.html) and bundle it with [consul-template](https://github.com/hashicorp/consul-template) so your config are store to the same place and consul-template generate the related files directly in the container.
  
  
  ---
  
  ### Answer by username_4 on 2017-08-13. Score: 0
  
  You can use sharing volumes between the host that run the container and the instance, in this case you can put the crt files in anywhere in the hosts then map it to specific folder in the container, the same for configuration you can configure the service to read the configuration file from specific path and every time you mount whatever configuration you like to that specific folder and the service will read it.
  
  For more info:
  <https://docs.docker.com/engine/admin/volumes/volumes/>
  
  
  ---
  
  ### Answer by username_5 on 2017-08-13. Score: 0
  
  As you are trying to manage multiple servers you should start looking into any config management tools.
  
  You could start looking into Ansible, as it is easier to setup and manage than other CM tools like Chef and Puppet (which have their own dependent resources to manage and run) .
  
  Ansible is agentless, SSH based config tool written on python. (But it does not require you to code in py)
  
  You just have to learn yml syntax (Jinja2) which is pretty easy . Its just a set of instructions on how to configure the server
  
  Now coming to your use case
  
  1. When you say that you push the docker images to multiple server across globe (which means you have a central node which can connect to all servers). This node can behave like the Ansible master (Where you install all ansible dependencies)
  
     If its is Deb based I have the scripts handy
  
     ```
         sudo apt-get -y install python-dev 
         sudo apt-get -y install libffi-dev
         sudo apt-get -y install libssl-dev
         sudo pip install paramiko 
         sudo pip install PyYAML 
         sudo pip install Jinja2 
         sudo pip install httplib2 
         sudo pip install six 
         sudo pip install markupsafe  
         sudo pip install ansible
  
     ```
  2. After you install ansible write a sample playbook (with just a echo command)
     <http://docs.ansible.com/ansible/latest/playbooks_intro.html>
  3. Lists all your servers in the inventory file
     <http://docs.ansible.com/ansible/latest/intro_inventory.html>
  4. Execute your playbook for testing with below command
     ansible-playbook -i --extra-vars "key=Value"
  5. Modify your playbook to include Docker image and set env variables of your credentials. Encrypt your creds using Bcrypt or some util
  6. Store your playbooks in Git or other Source control
  
  Happy Coding in Ansible.
  
  
  ---
  
  