Is it possible to run tang in a docker container?

[AdrianKoshka]

I wanted to setup tang, but also am using fedora atomic host, and thought I could just whip up a quick docker container to run tang for me. I was very wrong, after countless hours I've pretty much gotten no-where. Due to the way tangd is designed, is it possible to run it from a docker container at all and have it work properly? The repo for anyone interested: https://github.com/AdrianKoshka/tang-docker-container

The issue I would run into is that I'd never get tang to respond properly on port 80. Curl would always say connection reset by peer, or that the response was empty.

[npmccallum]

There is no particular problem with running Tang in a container. However, there are some considerations.

1. Tang uses socket connection activation. This can be handled by either systemd (run /sbin/init) or by something like xinetd.

2. Containers raise a question about storage isolation. Basically, Tang needs to have its keys inaccessable to the data you encrypt with clevis. But if you are running two containers: one with Tang and another with data encrypted with Clevis using a Tang policy, it is very possible that both sides of that key exchange could land their key material on the same disk.

It is still probably worth having a Tang container. But don't use it to encrypt data on the same node.

[npmccallum]

I sent you a PR that makes Tang work in docker using xinetd. I'll close the bug now, but feel free to ask any questions.

[hddmet]

I tried the docker image, it is fully functional. It seems like the service response fail to terminate. It is the same whether the base image is ubuntu or centos. I think it is a quick fix if you have a chance to a look at a running container instance. Thanks.

[npmccallum]

@hddmet This is not the repository for the docker image. Please file an issue here: https://github.com/AdrianKoshka/tang-docker-container

[ctr49]

@AdrianKoshka do you have a new place for the docker repo? The link above doesn't work anymore.
(also the link to the GitLab repo in the tang readme doesn't work)

[AdrianKoshka]

I don't, I didn't realize the gitlab repo still existed either.

[hddmet]

Hi there, You could try, https://hub.docker.com/r/cloggo/tangd <https://hub.docker.com/r/cloggo/tangd>. github repo: https://github.com/cloggo/tangd

…

On Oct 7, 2019, at 6:31 AM, Adrian Lucrèce Céleste ***@***.***> wrote: I don't, I didn't realize the gitlab repo still existed either. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#27?email_source=notifications&email_token=ABGE3ZZK32QB64BZ3N3S3GLQNMT3DA5CNFSM4FDW4O4KYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEAQEYSI#issuecomment-538987593>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ABGE3Z5E5OGKZ5P364UOPQTQNMT3DANCNFSM4FDW4O4A>.

[rugk]

Ugh this is all confusing given the "official" docker image linked in the Readme is not there anymore(?). See #48