dsiem
dsiem copied to clipboard
[Question] Reload directives
TLDR: How can I reload directives while dsiem is running?
I am using dsiem for a user-facing product. The setup includes a bunch of containers managed with docker compose. Directives can be updated from the UI and then persisted in the filesystem (a shared volume).
There are a few options I have thought of to apply the changes:
- Reload directives from within dsiem as the container is running (say by hitting a certain endpoint). Does not currently seem to be possible.
- Use a named pipe to restart the container with regular docker/docker compose command - SO answer. This is probably wielding too much power over the host and a little hacky to get results back.
- Mount
/var/run/docker.sock
into a container then use the Docker Go SDK to find and restart the dsiem container. This is the solution I am using at the moment. It still flaky, and despite adding locks to the API calls, it does not seem like a good idea to restart the container every so often from a user facing operation. What if the restart fails? Of course, part of the mitigation is that I validate the directives. - Use some sort of orchestration. I am not familiar with container orchestration, and I have not investigated this.