Home

tmpnb needs to run the tornado process as someone that can access the Docker socket, which could be root.

The proxy, however, can run as nobody.

Example supervisor configs:

root@demo:/srv/tmpnb# cat /etc/supervisor/conf.d/config-proxy.conf
[program:config-proxy]
command=/srv/tmpnb/node_modules/.bin/configurable-http-proxy --default-target=http://localhost:9999 --port=8000
autostart=true
autorestart=true
stderr_logfile=/var/log/config-proxy.err.log
stdout_logfile=/var/log/config-proxy.out.log
environment=CONFIGPROXY_AUTH_TOKEN=<make some token here>
root@demo:/srv/tmpnb# cat /etc/supervisor/conf.d/rando.conf
[program:rando]
command=python /srv/tmpnb/rando.py
autostart=true
autorestart=true
stderr_logfile=/var/log/rando.err.log
stdout_logfile=/var/log/rando.out.log
environment=CONFIGPROXY_AUTH_TOKEN=<same token as above>,CONFIGPROXY_ENDPOINT=http://127.0.0.1:8001