Production checklist

Start with the production security checklist. This page covers the rest - fixed code, data that survives a container replacement, and the changes that turn the blueprint's script into a production one.

Run fixed code

By default, a container fetches the latest Zato code each time it starts, and the Dashboard installs updates on a schedule. In production, turn both off with Zato_Install_Updates=False and reference the image by its digest instead of latest:

zatosource/zato-4.1@sha256:<digest>

To update, run the new digest in a test environment first, then in production - see updating environments.

Keep data outside the container

Every image update replaces the container, and whatever was stored only inside it is gone. In production:

• Export all configuration to enmasse and commit it to Git
• Run the audit log and pub/sub on an external database, through Zato_Audit_Log_DB_* and Zato_PubSub_DB_*
• Mount the logs directory - see logging

Set the passwords

Set Zato_Dashboard_Password, Zato_SSH_Password, Zato_IDE_Password and Zato_Metrics_Password individually. A password you do not set is generated again on every start, and Zato_Password, which gives them all one value, is meant for development.

Leave Zato_Log_Env_Details unset, because it writes every password to files inside the container.

Adapt the blueprint script

The blueprint's run-container.sh is set up for development. For production:

• Use the image digest and remove --pull=always
• Publish 11224 instead of 11223
• Publish 8184 on an internal address only, and remove 8183
• Remove 22022 and 11225
• Remove Zato_Log_Env_Details=true
• Pass each password separately instead of one generated value
• Add a health check against /zato/ping and a --log-opt max-size for Docker's own log

Run more than one container

Each container is a complete environment of its own. If you run several behind your own load balancer, start the scheduler in one of them only, with Zato_Start_Scheduler=False on the others, and use pub/sub in one of them only. Health checks are scheduler jobs, so they run where the scheduler runs.

If the load balancer sets X-Forwarded-For, set Zato_Trust_Forwarded_Headers=True so Zato records the caller's address rather than the load balancer's.

Check the result

1. curl https://api.example.com:11224/zato/ping succeeds without -k
2. Ports 11223, 8183 and 22 are not reachable from outside
3. A replacement container in a test environment comes back with the configuration, the audit events and the pub/sub messages

See also

Learn more