kontena / kontena-registrator

Other
0 stars 0 forks source link

Safe policy language #1

Open SpComb opened 7 years ago

SpComb commented 7 years ago

Currently the Kontena::Registrator::Policy only supports ruby DSLs, loaded by evaluating a file. This is fine for policies distributed as part of the Docker image, but is a bit concerning for dynamically loaded user-supplied policies.

There should either be some kind of very general e.g. YAML based DSL that doesn't rely on ruby code evaluation, or some kind of simpler dynamic configuration mechanism for families of semi-generic Ruby DSL policies.

SpComb commented 7 years ago

The new Kontena::Registrator::Configuration mechanism implements arbitrary JSON configuration for schemas, so this provides some kind of mechanism for semi-generic policies.

Consider exposing the TODO Kontena::Registrator::Eval mechanism for use by Policy DSLs?

SpComb commented 7 years ago

This is not required if we assume that user policies can be deployed as separate kontena-registrator Docker services that bundle their own *.rb policies.

However, those registrator services also require Docker API access..

SpComb commented 7 years ago

Each kontena-registrator service also consumes some non-trivial amount of memory, so combining multiple policies into a single kontena-registrator service would also be more efficient.