SSL Certificate on Container Optimized OS (Docker) - docker

Question

Question: How do you make web traffic run through certbot server and THEN to your app when port 80/443 can only be assigned to one server within Container Opimized OS?
Context:
Regular certbot install doesn't work for Google Cloud's "Container Optimzed OS" (which prevents write access, so no file can be executed). So I used a docker container of cerbot from letsencrypt, but it requires port 80/443 to be open, which my current web app is using.
Previously I would run certbot and then stop the server on my old instance and the certification would remain for 90 days. However, running the certbot docker container only gives SSL while it runs on port 80/443, but once stopped, SSL certificate is no longer valid.
Docker for letsencrypt: https://hub.docker.com/r/linuxserver/letsencrypt
Docker web app I want to host on port 80/443: https://hub.docker.com/r/lbjay/canvas-docker
Google Container Optimized Instance Info: https://cloud.google.com/container-optimized-os/docs/concepts/features-and-benefits

Answer 1

Here's a solution for using DNS validation for Certbot via Cloud DNS in the certbot/dns-google container image. It will use service account credentials to run the certbot-dns-google plugin in an executable container; this will configure the LetsEncrypt certs in a bind-mounted location on the host.
You'll first need to add a file to your instance with service account credentials for the DNS Administrator role - see the notes below for more context. In the example command below, the credentials file is dns-svc-account.json (placed in the working directory from which the command is called).
docker run --rm \
-v /etc/letsencrypt:/etc/letsencrypt:rw \
-v ${PWD}/dns-svc-acct.json:/var/dns-svc-acct.json \
certbot/dns-google certonly \
--dns-google \
--dns-google-credentials /var/dns-svc-acct.json \
--dns-google-propagation-seconds 90 \
--agree-tos -m team#site.com --non-interactive \
-d site.com
Some notes on the flags:
-v config-dir-mount
This mounts the configuration directory so that the files Certbot creates in the container propagate in the host's filesystem as well.
-v credentials-file-mount
This mounts the service account credentials from the host on the container.
--dns-google-credentials path-to-credentials
The container will use the mounted service account credentials for administering changes in Cloud DNS for validation with the ACME server (involves creating and removing a DNS TXT record).
--dns-google-propagation-seconds n | optional, default: 60
--agree-tos, -m email, --non-interactive | optional
These can be helpful for running the container non-interactively; they're particularly useful when user interaction might not be possible (e.g. continuous delivery).
Certbot command-line reference