Running the OPAL Docker Containers
Before you begin
Running docker containers
Since running OPAL is simply spinning docker containers, OPAL is cloud-ready and can fit in many environments: AWS (ECS, EKS, etc), Google Cloud, Azure, Kubernetes, etc.
Each environment has different instructions on how to run container-based applications, and as such, environment-specific instructions are outside the scope of this tutorial. We will show you how to run the container locally with
docker run, and you can then apply the necessary changes to your runtime environment.
Example production setup
We at Permit.io currently run our OPAL production cluster using the following services:
- AWS ECS Fargate - for container runtime.
- AWS Secrets Manager - to store sensitive OPAL config vars.
- AWS Certificate Manager - for HTTPS certificates.
- AWS ELB - for load balancer.
Example docker run command
Example docker run command (no worries, we will show real commands later):
docker run -it \
-v ~/.ssh:/root/ssh \
-e "OPAL_AUTH_PRIVATE_KEY=$(OPAL_AUTH_PRIVATE_KEY)" \
-e "OPAL_AUTH_PUBLIC_KEY=$(OPAL_AUTH_PUBLIC_KEY)" \
-e "OPAL_POLICY_REPO_URL=$(OPAL_POLICY_REPO_URL)" \
-p 7002:7002 \
|This command||In production environments|
|Runs the docker container in interactive mode||Typically no such option|
|Mounts the ||Varies between environment, e.g in AWS ECS you would mount volumes via the task definition.|
|Passes the following env vars to the docker container as config: ||Varies between environment, e.g in AWS ECS you would specify env vars values via the task definition.|
|Exposes port 7002 on the host machine.||Varies between environment, e.g in AWS ECS you would specify exposed ports in the task definition, and will have to expose these ports via a load balancer.|