From: Tom Lane <tgl@sss.pgh.pa.us>
To: Gustav Karlsson <gustav.karlsson@bekk.no>
cc: "pgsql-admin@postgresql.org" <pgsql-admin@postgresql.org>
Subject: Re: Risks of running Postgres as a Docker container?
In-reply-to: 
 <HE1PR0402MB33877605E20BDD4839CE5D61EB7A0@HE1PR0402MB3387.eurprd04.prod.outlook.com>
References: 
 <HE1PR0402MB33877605E20BDD4839CE5D61EB7A0@HE1PR0402MB3387.eurprd04.prod.outlook.com>
Comments: In-reply-to Gustav Karlsson <gustav.karlsson@bekk.no>
	message dated "Mon, 25 Sep 2017 05:08:38 -0000"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <17549.1506347026.1@sss.pgh.pa.us>
Content-Transfer-Encoding: quoted-printable
Date: Mon, 25 Sep 2017 09:43:46 -0400
Message-ID: <17550.1506347026@sss.pgh.pa.us>
Precedence: bulk
Sender: pgsql-admin-owner@postgresql.org

Gustav Karlsson <gustav.karlsson@bekk.no> writes:
> At my company we are getting more and more small databases and are consid=
ering moving to deploying them as Docker containers for easier management. =
However, every time I am trying to research the topic of databases as conta=
iners, I come across people saying "I would not run a production database i=
n Docker" and similar. Though there do also seem to be plenty of people doi=
ng that as well!

> So, I was just wondering what the experiences in the community are?
> - Anybody running production databases in Docker? Have you experienced ma=
ny issues?
> - What are the risks of doing it? (We would of course mount an external v=
olume for the data-directory)

I wouldn't count on an external data directory to save you if the Docker
instance crashes.  The trouble with any virtualized environment (not just
Docker) is that you have an extra layer of I/O abstraction between you and
the hardware, which for this purpose means one more place that might break
fsync semantics/write ordering guarantees.  You'd never notice till you
get a hard crash and find your database is corrupted.

If it's throwaway data, this doesn't matter of course.  If your recovery
strategy is mostly depending on streaming standby servers, and not on
being able to recover the primary, it might not matter either.  But if you
need the DB to be crash-safe, you really had better do plug-pull-type
testing before trusting a setup like this.

			regards, tom lane


--=20
Sent via pgsql-admin mailing list (pgsql-admin@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-admin