Hosted on Sourceforge which is now blocked almost everywhere.

You're exactly right tomaac. Thank you for your comment.

The reason: http://arstechnica.com/information-technology/2015/05/source...

I am not sure if this is the same, but Redhat's Project Atomic does similar thing using rpm-ostree

http://www.projectatomic.io/

It's a different approach. That's basically an implementation using ostree. Nix is way different than that. Neither is better in my opinion, but I use Nix happily.

Check out Project Atomic http://www.projectatomic.io/. Or its downstream project RHEL Atomic Host. The whole update process for the host is much simpler. Read more abou it here: http://rhelblog.redhat.com/2015/04/01/red-hat-enterprise-lin...

Note: I am not related to Redhat, but we are considering Docker, too. And we are evaluating how would Atomic fit in our infrastructure.

And what happens when you launch new container from the same image? You need to run apt-get/yum again. Or rebuild image.

That's why you keep everything with state in a separate volume container. Attach volume to built image and that's it.

You can, if you want, mount your root as readonly so you're not tempted to modify it. Then it behaves like a Live CD.

Mount data, logs, configuration, eventual extensions in the data container?

For pg, there might be some migration needed when jumping from a major version to the next. Which requires both versions installed, on Debian at least.

>Mount data, logs, configuration, eventual extensions in the data container?

Many programs have their state represented as files that are stable across versions. If you have a cluster of the same image with different states it's more efficient to move volume containers across a network. Easier to backup/upgrade too.

pg is going to give you those problems whether you are using Docker or not.

Not to be confused with Atlassian Bamboo https://www.atlassian.com/software/bamboo

Their lawyers will not be confused.

He is referring to https://mta.openssl.org/pipermail/openssl-announce/2015-Marc...

If you mention Bacula then you also need to mention Amanda http://www.amanda.org/

oh the countless time I've wasted on Amanda - it's just too old now.

While for many, backup is better on disks these days, tape is far better for archival and Amanda does this quite well for Linux.

With systemd we are almost there http://www.freedesktop.org/software/systemd/man/systemd-nspa...

What about SSL? HAProxy supports SSL offloading.

I didn't investigate deeply; I'd never heard of haproxy prior to Fitbit. Someone from site ops told me they use nginx + haproxy but it would be easier for me to just set up nginx.

This article does sound to me like SSL support in haproxy is brand new: http://seanmcgary.com/posts/using-sslhttps-with-haproxy

SSL support has been around for a while, but 1.5 has been considered beta for a few years now, though that hasn't stopped it from being deployed in a lot of production environments.

Before SSL was rolled into haproxy, nginx was often a good candidate to handle the SSL termination. Stunnel is also common, and stud was popular for a while, but seems it was abandoned once haproxy could handle the job.