README: Add Benefits section
* Write-up the benefits from a comment on the DO tutorial.
This commit is contained in:
parent
7f2ae880d5
commit
4cd6f89a5a
27
README.md
27
README.md
@ -109,6 +109,33 @@ packets, etc).
|
|||||||
security should prevent any malicious host from using the VPN.
|
security should prevent any malicious host from using the VPN.
|
||||||
|
|
||||||
|
|
||||||
|
## Benefits of Running Inside a Docker Container
|
||||||
|
|
||||||
|
### The Entire Daemon and Dependencies are in the Docker Image
|
||||||
|
|
||||||
|
This means that it will function correctly (after Docker itself is setup) on
|
||||||
|
all distributions Linux distributions such as: Ubuntu, Arch, Debian, Fedora,
|
||||||
|
etc. Furthermore, an old stable server can run a bleeding edge OpenVPN server
|
||||||
|
without having to install/muck with library dependencies (i.e. run latest
|
||||||
|
OpenVPN with latest OpenSSL on Ubuntu 12.04 LTS).
|
||||||
|
|
||||||
|
### It Doesn't Stomp All Over the Server's Filesystem
|
||||||
|
|
||||||
|
Everything for the Docker container is contained in two images: the ephemeral
|
||||||
|
run time image (kylemanna/openvpn) and the data image (using busybox as a
|
||||||
|
base). To remove it, remove the two Docker images and corresponding containers
|
||||||
|
and it's all gone. This also makes it easier to run multiple servers since
|
||||||
|
each lives in the bubble of the container (of course multiple IPs or separate
|
||||||
|
ports are needed to communicate with the world).
|
||||||
|
|
||||||
|
### Some (arguable) Security Benefits
|
||||||
|
|
||||||
|
At the simplest level compromising the container may prevent additional
|
||||||
|
compromise of the server. There are many arguments surrounding this, but the
|
||||||
|
take away is that it certainly makes it more difficult to break out of the
|
||||||
|
container. People are actively working on Linux containers to make this more
|
||||||
|
of a guarantee in the future.
|
||||||
|
|
||||||
## Differences from jpetazzo/dockvpn
|
## Differences from jpetazzo/dockvpn
|
||||||
|
|
||||||
* No longer uses serveconfig to distribute the configuration via https
|
* No longer uses serveconfig to distribute the configuration via https
|
||||||
|
Loading…
Reference in New Issue
Block a user