search

DefensePointSecurity / threat_note

DPS' Lightweight Investigation Notebook
Apache License 2.0
421 stars 97 forks source link

Data Loss if Update to New Docker Image #148

Open grecs opened 8 years ago

grecs commented 8 years ago

I've been trying to run this via Docker, partly to learn more about Docker, and noticed that there is no easy way save data if I update to a new docker image (e.g., if going from 3.1 to 3.2 version of threat_note and wanting to stay ). Recommendations online seem to be to have another "data" docker container and have the threat_note container just reference the data container. Not sure if it is worth doing something like yet but thought I would throw it out there.

swannysec commented 8 years ago

Thanks for pointing this out! I'll see if I can work something out when I formalize the Docker image down the road. For now, I would treat this as dev/testing only.

sroberts commented 8 years ago

@grecs The API does allow export/import.

grecs commented 8 years ago

Exactly. Best practice for docker is to not store data in containers. The application container should mount a storage area and use that. That way when you update the container containing threat_note, it doesn't affect the data. Here is more info I found on the topic. Still, this seems like a future enhancement. https://getcarina.com/docs/best-practices/docker-best-practices-data-stateful-applications/

grecs commented 8 years ago

Saw this article today on how they did something similar with MSF. Used the -v to specify a data location that exists outside of the container.

https://zeltser.com/metasploit-framework-docker-container/

swannysec commented 8 years ago

That's exactly what I was going to recommend. I will look at amending this this weekend, but feel free to give it a go and submit a PR if you get there before I do. On May 12, 2016 11:01 PM, "grecs" notifications@github.com wrote:

Saw this article today on how they did something similar with MSF. Used the -v to specify a data location that exists outside of the container.

https://zeltser.com/metasploit-framework-docker-container/

— You are receiving this because you commented. Reply to this email directly or view it on GitHub https://github.com/defpoint/threat_note/issues/148#issuecomment-218940928