Forum OpenACS Development: OpenACS 5.10.1 with PostgreSQL 17

Integrating OpenACS with Docker Swarm, Portainer, and Traefik
Hi Gustaf,
Thank you for providing the excellent OpenACS Docker image. I've successfully integrated it into our Docker Swarm environment with Portainer, Traefik, and Cloudflare. I wanted to share my implementation and the challenges I encountered, which might help others looking to deploy OpenACS in similar environments.
Environment Overview

Docker Swarm cluster (multi-node)
Portainer CE for container management
Traefik v3.2 as reverse proxy with Let's Encrypt SSL
Cloudflare for DNS and edge routing
Host OS: Debian-based Linux

Docker Stack Configuration
I created a stack in Docker Swarm that contains both the OpenACS container and a PostgreSQL database. The key was to use Docker volumes instead of host-mounted volumes for the application files to ensure proper initialization.

Key Configuration Decisions
1. Volume Management Strategy
Using named Docker volumes instead of host-mounted volumes for the OpenACS application data:

Ensures proper initialization during first startup
Prevents permission issues common with host mounts
Improves performance and portability

The only host-mounted volume is for custom configurations at /home/kmw/openacs/config/etc.
2. Network Architecture
Two distinct networks are used:

traefik-public: External overlay network shared with Traefik
internal: Private overlay network for secure container-to-container communication

Setting attachable: true for the internal network aids in debugging.
3. Security Considerations

Docker secrets for database credentials
Internal network isolated from external access
Proper reverse proxy headers for secure communication

4. Health Checks
Custom health checks with generous timeouts ensure containers have enough time to initialize:

OpenACS: 300s start period to allow for initial setup
PostgreSQL: Standard database connectivity check

Conclusion
Your OpenACS Docker image works exceptionally well in a Docker Swarm environment. The approach of using a fully containerized solution with PostgreSQL and named volumes makes it easy to deploy, backup, and manage.
The integration with modern infrastructure components like Traefik and Cloudflare enhances the deployment with automatic SSL, load balancing, and edge routing capabilities.
Direct port access (8081) was essential for initial setup and troubleshooting, while the Traefik integration provides proper SSL termination for production use.
Thank you for creating such a well-designed container image that integrates seamlessly with modern DevOps practices.

The slides (in PDF format) are available along with the video at:
https://openacs.org/conf2024/info/schedule

You may have noticed that I frequently rebuild the Docker images- Docker Scout detects new vulnerabilities in the base images, so refreshing them periodically is recommended.

I maintain several versions of the docker-compose files and various configuration setups. For example, in some scenarios the database runs inside Docker while in others it runs externally; similarly, the Tcl files and content repository can be located inside or outside Docker. This approach provides flexibility, including the option to use different Tcl versions, although it means the docker-compose files are somewhat more verbose than necessary for a single scenario.

I haven’t worked with ]po[ myself, but I understand that Frank is exploring using these images with it.

all the best
-g