LXC webhost seperation - brainstorm request for comments

rroethof

Renowned Member
Nov 22, 2017
8
2
68
48
Hi all,

I'm currently working on a design for a small scale webhosting test setup.
I want this to be container based for security and the small overhead.. but for security I want all containers even network seperated.. etc
customer A must not even be able to ping customer B, even though its webhosting containers only
What's your view on the following ?

I was thinking of the following setup as test:

proxmox 6 base with LXC
- NGINX reverse proxy for SSL offloading, other options are haproxy or traefik, although nginx would be the simplest setup i think
- Squid as the proxy for traffic to the outside world for the containers
- dnsmasq as the DNS proxy for containers

design wise :
design1.jpg
 
Why use the proxies, if all containers should belong to separate customers? Wouldn't it be easier/better to treat a CT as a single unit? And the proxies introduce more complexity and a single point of failure.