rpki-client / rpki-client-container Goto Github PK

Given it's implemented in rpki-client itself meanwhile, the exposure needs to be added to the container image, too. Hints and some discussion related to this happened already in rpki-client/rpki-client-portable#61 before.

As also mentioned at docker/hub-feedback#2314, Docker is sunsetting Free Team organizations at April 13th, 2023. The initial notification was sent by Docker via e-mail yesterday.

Docker expects users switching to their paid Docker plans, alternatively there is a "specific Docker-Sponsored Open Source (DSOS) program for open-source projects" for which this project might or might not be eligible.

In difference to some other projects, all container images are pushed since ever to Docker Hub and Quay.io. It could be worth considering GHCR additionally.

Which port should be exposed when running it on docker?

With the arrival of the haproxy in the container we encountered several issues due to it. When haproxy fails, multirun also kills rpki-client. This causes the container to stop (or restart, depending on docker config)

We encountered the following cases while trying to upgrade to 8.5:
haproxy does not start when no metrics file exists
haproxy does not start when the metrics file exists and is larger then 16384 bytes (normally the metrics file is about 60000, so definitely too large)
haproxy does not start when there is no IPv6 configured on the system

the first 2 issues where fixed by have rpki-client.sh (manually) run once completely, this changes the tune.bufsize in haproxy.cfg to allow the larger metric file.
I ended up making my own haproxy.cfg file and mounting the config directory in the container on /etc/haproxy. The customised haproxy.cfg had a higher (100k) tune.bufsize, and does not require an IPv6 interface. Without these modifications I could not get the container to run properly.

I hope this helps someone.