From a87980e5c21b17a60ba46cb53208140143ed8b15 Mon Sep 17 00:00:00 2001 From: Steven Dake Date: Sat, 28 Mar 2015 08:11:34 -0700 Subject: Remove EXPOSE options from Dockerfiles The EXPOSE options will create a local docker-proxy. This is unnecessary with --net=host mode. The docker-proxy adds about 20 microseconds of latency. Add documentation to the specification to indicate where to find the ports that are exposed by the services in case someone were to desire to add EXPOSE back to the Dockerfiles. Change-Id: I398e922fe096d6022a2d5985bb92498f89a5ea31 --- specs/containerize-openstack.rst | 9 +++++++++ 1 file changed, 9 insertions(+) (limited to 'specs') diff --git a/specs/containerize-openstack.rst b/specs/containerize-openstack.rst index 3aeb67be1..f035ec2e0 100644 --- a/specs/containerize-openstack.rst +++ b/specs/containerize-openstack.rst @@ -188,6 +188,15 @@ with the --privileged=true flag to docker that: leaf directories with no other host operating system use. * shares any namespace with the --ipc=host, --pid=host, or --net=host flags +We will not use the Docker EXPOSE operation since all containers will use +--net=host. One motive for using --net=host is it is inherently simplier. +A different motive for not using EXPOSE is the 20 microsecond penalty +applied to every packet forwarded and returned by docker-proxy. +If EXPOSE functionality is desired, it can be added back by +referencing the default list of OpenStack ports to each Dockerfile: + + http://docs.openstack.org/trunk/config-reference/content/firewalls-default-ports.html + We will use the docker flag --restart=always to provide some measure of high availability for the individual containers and ensure they operate correctly as currently designed. -- cgit v1.2.3