dsiem icon indicating copy to clipboard operation
dsiem copied to clipboard

[Question] Reload directives

Open aphilas opened this issue 2 years ago • 0 comments

TLDR: How can I reload directives while dsiem is running?

I am using dsiem for a user-facing product. The setup includes a bunch of containers managed with docker compose. Directives can be updated from the UI and then persisted in the filesystem (a shared volume).

There are a few options I have thought of to apply the changes:

  1. Reload directives from within dsiem as the container is running (say by hitting a certain endpoint). Does not currently seem to be possible.
  2. Use a named pipe to restart the container with regular docker/docker compose command - SO answer. This is probably wielding too much power over the host and a little hacky to get results back.
  3. Mount /var/run/docker.sock into a container then use the Docker Go SDK to find and restart the dsiem container. This is the solution I am using at the moment. It still flaky, and despite adding locks to the API calls, it does not seem like a good idea to restart the container every so often from a user facing operation. What if the restart fails? Of course, part of the mitigation is that I validate the directives.
  4. Use some sort of orchestration. I am not familiar with container orchestration, and I have not investigated this.

aphilas avatar Sep 21 '22 06:09 aphilas