Ansible-templated resource limits for weaker/stronger hosts #12

New issue

Open

opened 2023-08-13 20:57:40 +02:00 by so-rose · 0 comments

so-rose commented

2023-08-13 20:57:40 +02:00

Owner

In Docker stacks, using resources: limits: to define reserved/maximum CPU/RAM/IOPS usage of services is very important. If left out, simple DDoS attacks on one service can bring down the entire host and/or be catalysts for memory buffer attacks on other parts of the host system.

However, reasonable limits may vary between different environments. Thus, the limits should be templated based on the capabilities of the hosts. Possibly manually, with a switch. Ansible already has all of this information readily available in the inventory.

In Docker stacks, using `resources: limits:` to define reserved/maximum CPU/RAM/IOPS usage of services is very important. If left out, simple DDoS attacks on one service can bring down the entire host and/or be catalysts for memory buffer attacks on other parts of the host system. However, reasonable limits may vary between different environments. Thus, the limits should be templated based on the capabilities of the hosts. Possibly manually, with a switch. Ansible already has all of this information readily available in the inventory.

so-rose added the

security

deployment-usability

labels

2023-08-13 20:57:40 +02:00

so-rose added this to the Refactor and Cleanup project

2023-08-13 20:57:41 +02:00

so-rose changed title from ~~Antible-templated resource limits for weaker/stronger hosts~~ to Ansible-templated resource limits for weaker/stronger hosts

2023-08-13 20:58:30 +02:00