<p>One could pass <a href="https://docs.docker.com/v1.7/reference/run/" rel="nofollow noreferrer">environment variables</a> when running docker, e.g.:</p>

<blockquote>
  <p>Additionally, the operator can set any environment variable in the
  container by using one or more -e flags, even overriding those
  mentioned above, or already defined by the developer with a Dockerfile
  ENV:</p>

<pre><code>$ docker run -e "deep=purple" --rm ubuntu /bin/bash -c export
</code></pre>
</blockquote>

CC BY-SA 3.0
2017-08-10T15:21:17.483Z
2017-08-10T15:21:17.483Z
030
<p>One solution would be to create a base image with OpenVPN and global configurations and child images for the certs.</p>

<p>The base <code>Dockerfile</code> might look like this.</p>

<pre><code>FROM debian:latest
RUN apt-get update &amp;&amp; apt-get -y install \
  openvpn \
  easy-rsa \
  etc

RUN &lt;any needed configurations&gt;
</code></pre>

<p><code>docker build -t openvpn:baseimage .</code></p>

<p>The cert <code>Dockerfile</code>.</p>

<pre><code>FROM openvpn:baseimage
COPY certs /etc/easy-rsa/

CMD openvpn
</code></pre>

<p><code>docker build -t useast:1 .</code></p>

<p>You could push the certs to the respective nodes with some kind of management tool and <code>build</code> the child images there. The base image would live in an available registry. Once the base image is cached on each node in Docker, the builds should be quick. </p>

<p>There are multiple solutions to this problem depending on what's best for the given environment.           </p>

CC BY-SA 3.0
2017-08-18T15:36:36.180Z
2017-08-18T15:36:36.180Z
wesley
<p>If I get it right you use the same image for each container but their "state" change regarding the location, so you need an uniq cert per container.</p>

<p>I suppose, if you have the need of OpenVPN, this is not a Swarm cluster. (If it was no need for openVPN), so no access to docker <code>config</code> or <code>secret</code>.</p>

<p>I would go for a key/value store like <a href="https://www.consul.io/intro/index.html" rel="nofollow noreferrer">consul</a> and bundle it with <a href="https://github.com/hashicorp/consul-template" rel="nofollow noreferrer">consul-template</a> so your config are store to the same place and consul-template generate the related files directly in the container.</p>

CC BY-SA 3.0
2017-08-10T10:30:28.270Z
2017-08-10T10:30:28.270Z
Juub
<p>You can use sharing volumes between the host that run the container and the instance, in this case you can put the crt files in anywhere in the hosts then map it to specific folder in the container, the same for configuration you can configure the service to read the configuration file from specific path and every time you mount whatever configuration you like to that specific folder and the service will read it.</p>

<p>For more info:
<a href="https://docs.docker.com/engine/admin/volumes/volumes/" rel="nofollow noreferrer">https://docs.docker.com/engine/admin/volumes/volumes/</a></p>

CC BY-SA 3.0
2017-08-13T08:37:05.657Z
2017-08-13T08:37:05.657Z
Wissam Roujoulah
<p>As you are trying to manage multiple servers you should start looking into any config management tools.</p>

<p>You could start looking into Ansible, as it is easier to setup and manage than other CM tools like Chef and Puppet (which have their own dependent resources to manage and run) .</p>

<p>Ansible is agentless, SSH based config tool written on python. (But it does not require you to code in py)</p>

<p>You just have to learn yml syntax (Jinja2) which is pretty easy . Its just a set of instructions on how to configure the server</p>

<p>Now coming to your use case</p>

<ol>
<li><p>When you say that you push the docker images to multiple server across globe (which means you have a central node which can connect to all servers). This node can behave like the Ansible master (Where you install all ansible dependencies) </p>

<p>If its is Deb based I have the scripts handy</p>

<pre><code>    sudo apt-get -y install python-dev 
    sudo apt-get -y install libffi-dev
    sudo apt-get -y install libssl-dev
    sudo pip install paramiko 
    sudo pip install PyYAML 
    sudo pip install Jinja2 
    sudo pip install httplib2 
    sudo pip install six 
    sudo pip install markupsafe  
    sudo pip install ansible
</code></pre></li>
<li><p>After you install ansible write a sample playbook  (with just a echo command)
<a href="http://docs.ansible.com/ansible/latest/playbooks_intro.html" rel="nofollow noreferrer">http://docs.ansible.com/ansible/latest/playbooks_intro.html</a></p></li>
<li><p>Lists all your servers in the inventory file
<a href="http://docs.ansible.com/ansible/latest/intro_inventory.html" rel="nofollow noreferrer">http://docs.ansible.com/ansible/latest/intro_inventory.html</a></p></li>
<li><p>Execute your playbook for testing with below command
ansible-playbook  -i  --extra-vars "key=Value"</p></li>
<li><p>Modify your playbook to include Docker image and set env variables of your credentials. Encrypt your creds using Bcrypt or some util</p></li>
<li><p>Store your playbooks in Git or other Source control</p></li>
</ol>

<p>Happy Coding in Ansible.</p>

CC BY-SA 3.0
2017-08-13T08:51:20.703Z
2017-08-13T08:51:20.703Z
Ameen Ibrahim Raffic - 'AIR'
<p>I got an application server image built with Docker. However, this image contains an OpenVPN client which needs a different certificate for each client, among other minimal configuration files.</p>

<p>I push this image to multiple servers across the globe. Every of them communicates with each other, thats the reason to use the VPN.</p>

<p>How should I put the configuration for such servers? I think this is out the scope of Docker. Must I use a configuration server like Ansible or so?</p>

<docker><deployment><configuration>
Same Docker image, multiple configurations
burntface
# Same Docker image, multiple configurations

(Asked by: username_0 on 2017-08-10)

I got an application server image built with Docker. However, this image contains an OpenVPN client which needs a different certificate for each client, among other minimal configuration files.

I push this image to multiple servers across the globe. Every of them communicates with each other, thats the reason to use the VPN.

How should I put the configuration for such servers? I think this is out the scope of Docker. Must I use a configuration server like Ansible or so?

**Tags:** docker, deployment, configuration


---

## 5 answers

### Answer by username_1 on 2017-08-10. Score: 2

One could pass environment variables when running docker, e.g.:

Additionally, the operator can set any environment variable in the
  container by using one or more -e flags, even overriding those
  mentioned above, or already defined by the developer with a Dockerfile
  ENV:
$ docker run -e "deep=purple" --rm ubuntu /bin/bash -c export


---

### Answer by username_2 on 2017-08-18. Score: 2

One solution would be to create a base image with OpenVPN and global configurations and child images for the certs.
The base Dockerfile might look like this.
FROM debian:latest
RUN apt-get update && apt-get -y install \
  openvpn \
  easy-rsa \
  etc

RUN 

docker build -t openvpn:baseimage .
The cert Dockerfile.
FROM openvpn:baseimage
COPY certs /etc/easy-rsa/

CMD openvpn

docker build -t useast:1 .
You could push the certs to the respective nodes with some kind of management tool and build the child images there. The base image would live in an available registry. Once the base image is cached on each node in Docker, the builds should be quick. 
There are multiple solutions to this problem depending on what's best for the given environment.


---

### Answer by username_3 on 2017-08-10. Score: 0

If I get it right you use the same image for each container but their "state" change regarding the location, so you need an uniq cert per container.

I suppose, if you have the need of OpenVPN, this is not a Swarm cluster. (If it was no need for openVPN), so no access to docker `config` or `secret`.

I would go for a key/value store like [consul](https://www.consul.io/intro/index.html) and bundle it with [consul-template](https://github.com/hashicorp/consul-template) so your config are store to the same place and consul-template generate the related files directly in the container.


---

### Answer by username_4 on 2017-08-13. Score: 0

You can use sharing volumes between the host that run the container and the instance, in this case you can put the crt files in anywhere in the hosts then map it to specific folder in the container, the same for configuration you can configure the service to read the configuration file from specific path and every time you mount whatever configuration you like to that specific folder and the service will read it.

For more info:
<https://docs.docker.com/engine/admin/volumes/volumes/>


---

### Answer by username_5 on 2017-08-13. Score: 0

As you are trying to manage multiple servers you should start looking into any config management tools.
You could start looking into Ansible, as it is easier to setup and manage than other CM tools like Chef and Puppet (which have their own dependent resources to manage and run) .
Ansible is agentless, SSH based config tool written on python. (But it does not require you to code in py)
You just have to learn yml syntax (Jinja2) which is pretty easy . Its just a set of instructions on how to configure the server
Now coming to your use case

When you say that you push the docker images to multiple server across globe (which means you have a central node which can connect to all servers). This node can behave like the Ansible master (Where you install all ansible dependencies) 
If its is Deb based I have the scripts handy
    sudo apt-get -y install python-dev 
    sudo apt-get -y install libffi-dev
    sudo apt-get -y install libssl-dev
    sudo pip install paramiko 
    sudo pip install PyYAML 
    sudo pip install Jinja2 
    sudo pip install httplib2 
    sudo pip install six 
    sudo pip install markupsafe  
    sudo pip install ansible

After you install ansible write a sample playbook  (with just a echo command)
http://docs.ansible.com/ansible/latest/playbooks_intro.html
Lists all your servers in the inventory file
http://docs.ansible.com/ansible/latest/intro_inventory.html
Execute your playbook for testing with below command
ansible-playbook  -i  --extra-vars "key=Value"
Modify your playbook to include Docker image and set env variables of your credentials. Encrypt your creds using Bcrypt or some util
Store your playbooks in Git or other Source control

Happy Coding in Ansible.


---

