Installing Flowspy v1.7 with Docker

Flowspy users may wish to test Flowspy in a container rather than directly onto a server or virtual host; this document shows how to build and deploy Flowspy in a Docker container.

Flowspy installs into /srv/flowspy by default; if you wish to use a different directory then you will need to update several configuration files. It is also assumed that the root user will perform every action.

Requirements

Docker must be installed on your target OS; the installation of Docker is outside the scope of this document.

Docker images require disk space on the host OS; approximately 2 GB for Flowspy and approximately 200 MB for CentOS 7 which is the default OS used.

Although the default Dockerfile = Dockerfile.fod.debian is for Debian, Dockerfile.fod.centos.new for CENTOS 7, and Dockerfile.fod.centos.old left for compatibility, several older Dockerfiles for both Debian and CentOS and can be found in the Dockerfiles.d directory. These are meant for testing only and are not production-ready.

The containers run gunicorn, celeryd and Redis - and use a SQLite database (/srv/flowspy/example-data) to hold resources. They also make a web server available on port 8000.

Building the Flowspy container

First build your Flowspy container. The default (Dockerfile = Dockerfile.fod.debian) is a container which uses Debian and supervisord, but there are other options; Dockerfile.fod.centos.\* uses CENTOS 7, Dockerfile.fod.centos.new with supervisord, Dockerfile.fod.centos.old is left for compatibility without supervisord. Dockerfile.fod.debian and Dockerfile.fod.centos.new by default will split the installation of FoD during container build into 3 phases (OS dependencies, python/pip dependencies, FoD proper installation) to exploit Docker build cache for faster rebuilding. Moreover, Dockerfile.fod.debian and Dockerfile.fod.centos.new can be edited for uncommenting/commenting to switch more options: e.g., use systemd instead of supervisord or not splitting the FoD installation into 3 phases (first docker build will be a bit faster and the docker container building is more efficient, as the number of docker image layers is reduced, but subsequent build after some changes in code or settings will require nearly the same amount of time as the first build)

Although the examples below use CentOS, just replace Dockerfile.centos.new with Dockerfile.debian if you wish to use Debian instead.

CentOS with `supervisord`

docker build -f Dockerfile.centos.new -t fod-centos .

Running Flowspy

You should now be able to see relevant images for Flowspy in your Docker environment;

[user@host-os ~]$ docker images
REPOSITORY          TAG                 IMAGE ID            CREATED             SIZE
fod-centos          latest              42da1eb2b4a5        3 minutes ago       1.73 GB

Although the web server listens on port 8000 by default you can map this to a different port on the Docker command line. Our examples map port 8000 on the docker container to port 80 on the host OS.

docker run -p 80:8000 fod-centos # run in foreground
or
docker run -d -p 80:8000 fod-centos # run in background

If you are using the Debian container then replace fod-centos with fod-debian.

You can confirm that the docker container is running with docker ps - this will also give you the autogenerated name of the container and show you port mappings if any;

[user@host-os Dockerfiles.d]$ docker ps
CONTAINER ID        IMAGE               COMMAND                    CREATED             STATUS              PORTS                  NAMES
5b125f76470d        fod-centos          "/srv/flowspy/runfod.sh"   1 month ago         Up 2 days           0.0.0.0:80->8000/tcp   lucid_mcnulty

You can connect the container directly and start a shell using either the CONTAINER ID or the NAME and the docker exec -it command;

[user@host-os Dockerfiles.d]$ docker exec -ti lucid_mcnulty bash # replace with name of whose of your container
[root@5b125f76470d /]#

Initial setup of Flowspy

You need to set a couple of options once the container is running; the password for the admin user and the details of the NETCONF-enabled router which Flowspy will use to inject FLOWSPEC routes.

NETCONF_DEVICE
NETCONF_PORT
NETCONF_USER
NETCONF_PASS

via Web GUI

Access the Flowspy web server at http://127.0.0.1:8000/setup/ (if you are connecting from inside the container) or http://your.host-os.ipaddress/ if you are connecting from outside the container (and have mapped port 8000 to port 80).

Once you hit "Save", the config will be saved in the container as /srv/flowspy/flowspy/settings_local.py.

You will need to restart the container for Flowspy to pick up this config; from the Host OS

docker restart lucid_mcnulty # replace name with whose of your container

You can now access the Flowspy web server using your new credentials.

via manual configuration

This needs to be done from inside the container.

The relevant file is /srv/flowspy/flowspy/settings.py; the relevant variables are

NETCONF_DEVICE
NETCONF_PORT
NETCONF_USER
NETCONF_PASS

You will then need to use the manage.py script to change the admin password;

cd /srv/flowspy; ./pythonenv ./manage.py changepassword admin

You will need to restart the container for Flowspy to pick up this config; from the Host OS

docker restart lucid_mcnulty # replace name with whose of your container

You can now access the Flowspy web server using your new credentials.

As fixed parameters in the Dockerfile

As a new alternative, admin user name/password and NETCONF parameters can be specified in the Dockerfile.fod.debian or Dockerfile.fod.centos.new:

Comment the line

RUN ./install-centos.sh --both --here --supervisord

and as replacement uncomment the line

#RUN ./install-centos.sh --both --here --supervisord --setup_admin_user --setup_admin_user5 admin adminpwd admin@localhost.local testpeer 0.0.0.0/0 --netconf 172.17.0.3 830 netconf netconf (In case of Dockerfile.fod.debian ./install-centos.sh is replaced by ./install-debian.sh)

Replace values as it suits you, the 2 parameters following "--setup_admin_user5" are admin username and password, the 4 parameters following "--netconf" are NETCONF_DEVICE, NETCONF_PORT, NETCONF_USER, NETCONF_PASS .

The docker container built with this changed Dockerfile will have the respective values setup and /setup URL will not be usable any more.

Testing NETCONF connectivity

Please make sure that the docker container has IP connectivity to your NETCONF device!

If you wish to confirm this, then use yum install telnet to install telnet in your container and telnet to whichever port on which your NETCONF device is listening (netconf-ssh/830 by default);

[root@5b125f76470d flowspy]# telnet 192.0.2.1 netconf-ssh
Trying 192.0.2.1...
Connected to 192.0.2.1.
Escape character is '^]'.
SSH-2.0-OpenSSH_7.5
^]
telnet> close
Connection closed.
[root@5b125f76470d flowspy]#

Misc

You may access the containerised Web GUI after the password of the admin user has been reset via http://127.0.0.1:8000/altlogin.

Do not try to use the Shibboleth login via /altlogin as it will not work without a fully configured Shibboleth SP

Persistent storage

The configuration will only last as long as the docker container itself; if the container is stopped or the host OS rebooted then the configuration will be lost.

You can use Docker volumes for persistent storage;

[user@host-os]$ docker volume create Flowspy-srv
Flowspy-srv
[user@host-os]$ docker volume inspect Flowspy-srv
[
    {
        "Driver": "local",
        "Labels": {},
        "Mountpoint": "/var/lib/docker/volumes/Flowspy-srv/_data",
        "Name": "Flowspy-srv",
        "Options": {},
        "Scope": "local"
    }
]

Then use the Docker CLI argument -v (volume) to mount the container at runtime;

docker run -d -p 80:8000  -v Flowspy-srv:/srv fod-centos

Keys	Action
`?`	Open this help
`n`	Next page
`p`	Previous page
`s`	Search