I'm trying to build a solution, using Docker that will allow me to house multiple user spaces on one Linux host machine, fully secured and not able to access one another. This of this something like a reseller hosting platform but using Docker and a lot more simplified.
My idea is that i will create n number of containers (one per private user) and these containers have installed typical LEMP stack tools (i.e. Nginx, PHP, MySQL) as well as one or two other things such as Python. I would like these containers to be on their own network and fully isolated. They will have no public exposed ports on the host.
Next i would like to run 3 (maybe more) proxy/gateway containers that will have host exposed ports (i.e. 80/443 for web traffic and 22 for SSH) and will relay/proxy these request back onto the suitable container based attributes such as subdomain (for web requests) and username for SSH requests.
I have attached a diagram to help explain what i'm trying to achieve.
At this stage i'm trying to consider whether there are any bottlenecks/hurdles that i have not considered so that i can determine the feasibility of this as a solution.
Here are the type of considerations i've been thinking about:
- Do we have enough host ports?
- We have 1025 - 65,535 (leaving 64511 usable host ports)
- We have less than 10,000 accounts needed leaving 54,511 unused ports
- Will the host machine manage to run this many networks and Docker containers
- Network:
- I may need some advice on this one!
- Docker containers:
- Not sure on this one either
- Can we proxy SSH connections suitably and will this be secure
- What RAM will we need?
- Will this need to be divided up between the containers, or can we just use host pool
- What CPU will we need
- Will this need to be divided up between the containers, or can we just use host pool
- I think we need to test this with about 100 containers and check
- I think the containers will just piggy back on available host CPU
- Can we proxy web traffic suitably and will this be secure
- How will we handle TLS
- Suggest that we wildcard the proxy web server and pass through to port 80 on user containers
- Are we confident that the actors/users will not be able to escape
I’m mainly concerned about the networking. Can anyone find a reason something like the proposed would not be possible from a networking perspective?
