signet/rsync repository overview

⁠Build the image

docker build -t signet/rsync:1.0.0-rc01 .

⁠Special Notes

• Since rsync is a generic service as opposed to an application, there is no application version tag associated with this container as is our standard.

  Typical application tag:

  • signet/app:<APPVERS>_<RELVERSION>-rc01

  Service/Utility tag:

  • signet/svc:<RELVERSION>-rc01

• This image is designed to be a run-once utility container. It is intended to be run in similar fashion that you would run rsync from the command line, but with some standardization around some of the inputs.

⁠Run the container

docker run \
-e PRIVATE_KEY="-----BEGIN RSA PRIVATE KEY-----
...
-----END RSA PRIVATE KEY-----" \
-e SSH_PORT=8022 \
-e DEST_HOST="conflhost" \
-e DEST_USER="onek" \
-e DEST_DIR="/dest/confluence-home" \
-e SRC_DIR="/confluence-home" \
-v confluence-home:/confluence-home:ro
-d signet/rsync:1.0.0-rc01 --del --exclude='confluence.cfg.xml' --exclude='somedir/somefile'

The above would be the same as running the following command:

rsync -azv \
-e "ssh -o StrictHostKeyChecking=no -p 8022" \	# ${SSH_PORT}
--del \										# Rsync options
--exclude='confluence.cfg.xml' \			# Rsync options
--exclude='somedir/somefile' \			# Rsync options
/confluence-home/ \							# ${SRC_DIR}
onek@$conflhost:/dest/confluence-home	# ${DEST_USER}@${DEST_HOST}:${DEST_DIR}

⁠Overview

The purpose of this container is to work together with the signet/sshd container image, although it may work with any target which facilitates the requirements. The use case it solves is a need to securely sync the production NFS application volumes to the offline environment NFS applicaiton volumes. In order to securely rsync from one node to another, both nodes must have rsync, and SSH keys must be setup for authorization from the production node to the offline environment node. We run sshd on the offline environment so as not to open up SSH to connections to our production environment. In this setup, we push data from production to the offline environments.

This rsync image will use the private key passed in for authorization to the target, expecting that the target has the matching public key in the "authorized_keys" file of the DEST_USER. Using the sshd container image, it is likely that we will be connecting to a non-standard SSH port; therefore, it must be passed in to the SSH_PORT environment variable in order for the rsync command to process successfully.

⁠Environment Variables

⁠PRIVATE_KEY (required)

This variable requires a double quoted string containing the contents of the typical id_rsa file in a RSA key pair. This can usually be obtained by "cat'ing" the file.

cat ~/.ssh/id_rsa

-----BEGIN RSA PRIVATE KEY-----
...
-----END RSA PRIVATE KEY-----

The private key which is set by this variable should be the matching side of the public key by which the signet/sshd container was started up with.

⁠SSH_PORT (default=22)

A non-standard port can be specified. If you are connecting to a container, it is likely that you will be connecting to a non-standard port.

⁠DEST_HOST (required)

rsync needs to know what host it will be pushing the files to. This can be a DNS name, an actual host name, or an IP address. The only requirements are that if a name is used, that it will resolve to an IP, and that there is a route to the resulting or provided IP.

⁠DEST_USER (required)

This is the account to be used to gain access to the destination host. It is assumed that the matching public key has been inserted into the "authorized_keys" file of a non-privileged account who has access to the DEST_DIR. This non-privileged account is the account that should be provided by this environment variable.

⁠DEST_DIR (required)

This is the directory where the source files will be sync'd to. Usually this will be set to the application home directory.

⁠SRC_DIR (required)

This is the directory of files we want sync'd to the destination host. All files in this directory will be sync'd to the destination.

⁠Additonal Rsync Options (optional)

This image is designed with an entrypoint that allows you to pass any combination of supported rsync options. These options will be fed into the existing command.

By default, if no options are provided, the following command will be run:

rsync -azv \
-e "ssh -o StrictHostKeyChecking=no -p ${SSH_PORT}" \
${SRC_DIR} \
${DEST_USER}@${DEST_HOST}:${DEST_DIR}

However if you need to pass in additonal arguments such as --del or --exclude, or any supported rsync arguments, you may do so as arguments to the container. By doing so, the arguments are injected into the rsync command that is run by the container. The resulting command will look like this:

rsync -azv \
-e "ssh -o StrictHostKeyChecking=no -p ${SSH_PORT}" \
--del \
--exclude='confluence.cfg.xml' \
${SRC_DIR} \
${DEST_USER}@${DEST_HOST}:${DEST_DIR}

In every case, the required variables are used to compose the standard rsync command. To modify the options, simply pass them to the container as shown in the Run the Container section in this readme.