Proper way to automatically start and expose ssh when running my app container

Question

I have containers with python apps and I need them to automatically start and expose ssh when running them. I know it's against Docker's best practices, but right now I don't have any other solution. I'd be interested to know the best way to automatically run an additionnal service in a docker container anyway.

Since Docker will only start one process, installing sshd isn't enough. There are apparently multiple options to deal with it:

1. use a process manager like Monit or Supervisor
2. use the ENTRYPOINT option
3. append a command (service sshd start, for instance) at the end of /etc/bash.bashrc (see this answer)

Option 1 seems overkill to me. Also I suppose I'll have to run the container with a cmd calling the process manager instead of bash or my python app: not exactly what I want.

I don't know how to use Option 2 for such a case. Should I write a custom script starting sshd and then running the provided command if any ? How should this script look like ?

Option 3 is very straightforward but quite dirty. Also it won't work if I run the container with another command than /bin/bash.

What's the best solution and how to set it up ?

Answer 1

You mention that option 1 seems like overkill. Why is it overkill? Supervisor is very simple to configure and will basically do what you want.

First, write supervisor config files that starts your python app and sshd:

[supervisord]
nodaemon=true

[program:sshd]
command=/usr/sbin/sshd -D

[program:pythonapp]
command=/path/to/python myapp.py -x args etc etc

Call that file supervisord.conf and commit it somewhere in your repo. In your Dockerfile, copy that file to the container as one of the container build steps, expose the ports for SSH and your app (if needed) and set the CMD to start supervisord:

COPY supervisord.conf /etc/supervisor/conf.d/supervisord.conf
EXPOSE 22 80
CMD ["/usr/bin/supervisord"]

This is clean and easy to understand. It's how I run multiple processes in a container when needed. It is even suggested in the Docker docs as a nice solution.