This post is a log starting with an empty ec2-box (Amazon Linux) and moving toward a LAMP stack with a container for apache/php and a container for mysql. It assumes you already have images for apache/php and mysql. Local system is ubuntu linux. Containers use alpine linux.
Installing docker on a ec2 host box (see here).
Update the hosts’ package manager and install docker.
sudo yum update -y sudo yum install -y docker
Start the docker daemon.
sudo service docker start
Add ec2-user to the docker group.
sudo usermod -a -G docker ec2-user
For ease of ssh access, You can add the ec2 host to
~/.ssh/config file. I’ll name my host “fred” and the user will be ssh user will be “ec2-user”.
Host fred HostName 126.96.36.199 Port 22 User ec2-user IdentityFile [path/to/private_key]
Then you can simply run
ssh name_of_host to ssh into the box.
Docker images can be zipped up and loaded using
docker save and
First we look at our built images to see which ones we want to zip up. Then we save the images to files.
docker save -o [path_where_to_save] [image_name]
Assuming we’ve put all the saved images in the docker_images folder, we can then transfer all the images we’ve made over to our host machine.
scp * fred:/home/jerry/docker_images
However, this can take a while if your images are large. I wanted to transfer faster so I decided to compress the images before transfer. I’ll use lrzip to compress the images.
To install lrzip on the Amazon Linux host machine, you’ll need to first enabled the EPEL repo.
sudo vim /etc/yum.repos.d/epel.repo
Change enabled=0 to enabled=1 in the epel section. Exit and view the repolist with
sudo yum repolist. You should get some updates. Afterwords, you can install lrzip.
sudo yum install -y lrzip
You can zip the folder using lrzip, like so:
lrzip -z docker_images
Which will take a 400MB LAMP stack and compress it to 51MB. After transferring the compressed archive with scp, I can unpack the docker_images.tar.lrz file on the host box.
lrzip -d docker_images.tar.lrz
Which give me a
docker_images.tar file. Now I can extract the files…
tar -xf docker_images.tar
Which will put the images in the docker_images folder. To install the images, I use
docker load -i my-apache docker load -i my-mysql docker load -i my-php
Now I can view the available images on the host box with
Next I need to transfer my project files to the host. I want git to manage files, so I created a “repo” folder on the host and initialized a bare repo.
git init --bare
Now I can add the “bare” repo as a remote repository on my local repository.
git remote add fred fred:/home/ec2-user/repo
Now I can easily push my repo to “fred”.
git push fred master
And on the host box, I can create a clone of the repo.
git clone /home/ec2-user/repo project
Now I have a good workflow for pushing changes from my local filesystem to the host box. First I push to the “fred” remote. Then I go to the host and pull from the “origin” remote. Both remotes point to /home/ec2-user/repo.
So now that I have my project files and images, I can start up the stack with docker compose. First I install docker-compose on the host box (instructions). Then I can run the same docker-compose command I run on my local system.
To test the stack, I can add port 80 to my EC2 instance’s inbound security group rules, and add an entry to my local system’s hostfile.
I can now view my site at mywebsite.com.
Next I need to install an SSL certificate.
For testing purposes, I’ll run the setup process inside the container, and later add the process to my apache Dockerfile. My containers run on alpine linux. Before running
apk add apache2-ssl, I’ll run
apk update, otherwise I get “WARNING: Ignoring APKINDEX” and “ERROR: unsatisfiable constraints:” errors (see here).
apk update apk add apache2-ssl
I now have mod_ssl.so inside the apache modules folder.
To get a letsencrypt certificate, I first install certbot on my local machine. Then I manually requested an ssl using the dns challenge.
sudo certbot certonly --manual --preferred-challenges dns
After running I now had a
privkey.pem files in the
/etc/letsencrypt/live/sitename.com folder, and get this message.
IMPORTANT NOTES: - Congratulations! Your certificate and chain have been saved at /etc/letsencrypt/live/sitename.com/fullchain.pem. Your cert will expire on 2017-10-13. To obtain a new or tweaked version of this certificate in the future, simply run certbot again. To non-interactively renew *all* of your certificates, run "certbot renew" - If you like Certbot, please consider supporting our work by: Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate Donating to EFF: https://eff.org/donate-le
There was a file in
ssl.conf which was created when I installed mod_ssl.
I went through the file and made the appropriate modifications for my server config (changing document root, changing where log files are created, seting ServerName directive, and changing where SSLCertificateFile, and SSLCertificateKeyFile points to)
By default SSLCertificateFile and SSLCertificateKeyFile points to /etc/ssl/apache2. Since I would like to eventually have certbot installed on the box and running automatically, I decided to point SSLCertificateFile to the location that certbot generates certificates in.
# Server Certificate SSLCertificateFile /etc/letsencrypt/live/sitename.com/fullchain.pem # Server Private Key SSLCertificateKeyFile /etc/letsencrypt/live/sitename.com/privkey.pem
I then created the letsencrypt folder manually in the container.
mkdir -p /etc/letsencrypt/live
Then I copied /etc/letsencrypt/live/sitename.com from local box to remote box. Then I copied the files from remote box
into the container.
docker cp [folder_with_ssl_files] [containername]:/etc/letsencrypt/live/sitename.com
Since ssl operates over port 443, I needed to open port 443 on my EC2 instance. My apache Docker container already exposed
port 443, and my run command mapped port 443 on the host box to 443 on the container.
After setting up
ssl.conf I tried to restart the server and go this error.
httpd: Syntax error on line 166 of /etc/apache2/httpd.conf: Cannot load modules/mod_ssl.so into server: Error relocating /web/modules/mod_ssl.so: X509_up_ref: symbol not found
ldd /web/modules/mod_ssl.so it looked like there was a missing library that mod_ssl couldn’t find. In the end, the only solution that I could get to work was to upgrade alpine from 3.5 to 3.6 on my apache image. Before doing that, I attempted to compile apache from source. I’ll include a partial Dockerfile documenting that path for reference.
FROM nimmis/alpine-micro:3.6 RUN wget -P /tmp http://apache.mirrors.pair.com//httpd/httpd-2.4.27.tar.gz RUN wget -P /tmp http://apache.claz.org/apr/apr-util-1.6.0.tar.gz RUN wget -P /tmp http://apache.claz.org/apr/apr-1.6.2.tar.gz RUN cd /tmp && \ tar -zxvf httpd-2.4.27.tar.gz && \ tar -zxvf apr-1.6.2.tar.gz && \ tar -zxvf apr-util-1.6.0.tar.gz && \ mv apr-1.6.2 httpd-2.4.27/srclib/apr && \ mv apr-util-1.6.0 httpd-2.4.27/srclib/apr-util && \ rm *.tar.gz && \ cd httpd-2.4.27
Using apache memcache on alpine linux
There doesn’t appear to be support for mod_pagespeed in alpine linux. I started down the path of compiling mod_pagespeed myself, but decided to look into out-of-the-box apache caching instead. However, this should install the prerequisites for compiling mod_pagespeed.
RUN apk add subversion git alpine-sdk RUN cd /tmp && \ git clone -b latest-stable --recursive https://github.com/pagespeed/mod_pagespeed.git