In our Docker environment, we are using the Lucee images and have a line in the

lucee-server.xml

for the scope settings, but the examples don’t show how to change this specific scope setting. We have something like this, but I don’t see a parameter for the session storage, that I can see anywhere as I’ve searched.

<scope applicationtimeout="1,0,0,0" cascade-to-resultset="yes" cascading="strict" client-directory-max-size="10mb" client-max-age="90" clientmanagement="no" merge-url-form="no" requesttimeout="0,0,0,50" sessionmanagement="yes" sessiontimeout="0,0,30,0" setclientcookies="yes" setdomaincookies="no" local-mode="classic"/>

If using the Lucee extension, the class name will be

<http://lucee.extension.io|lucee.extension.io>.cache.redis.simple.RedisCache

...and the bundle name

redis.extension

Clicking on the

<?/>

under the setting gave me the answer for the Application.cfc, which is way better than playing around with the XML files.

And if you use CommandBox for local dev as well, you can get 95% the same setup across the board with very little local installs to mess with. (I hate local Docker development with a passion 🙂 )

These "Server Is Up" shirts actually came from a conversation in Slack, no joke. https://www.ortussolutions.com/about-us/shop#!/server+is+up!?idea=60b4a32396e7c070517d5872

generally it all gets simpler since there are bult-in way to accomplish most of what you had to do manually in the past

I'm not clear if you have a custom made Lucee docker container or if you're using the Daemonite's image for Lucee

Custom made ones can be real snowflakes (in terms of being special and custom) so there's no one guide to convert

But even with the Lucee one-- what you'd need to do would depend on which configuration features you were using

Stuff can be spread all over Tomcat's config files, but generally, it all just goes in the

server.json

file like CommandBox needs

If you know how to start up a CommandBox server, then you pretty much know how to configure the CommandBox-based docker images.

And your nginx config could be its own container setup / repo that loads already

Our goal has been for CommandBox to be a full production web server. Now with multi-site, lockdown profiles, HTTP/SSL bindings, SNI, and rewrites, it should pretty much do it all

are there publicly available load testing against the server and Pen testing for vulnerabilities running daily?

and published results of these tests

It's a very powerful enterprise tool with a lot of production usage, and they have very fast response to any vulns

We always update to the latest Undertow version every release

CommandBox itself has gone through a lot of security scans, but generally ones customers do which aren't published per se. In production mode, it will pass pretty much any scanner test, including hackmyCF

Generally speaking, people don't generally care what's inside the box so long as it's fast and secure. We keep all our libraries up to date and RedHat worries about keeping Undertow patched.

It's all worth noting, most of this has nothing to do with whether or not you use Nginx. Whether or not you put a proxy in front of your servlet, the traffic still passes through the HTTP listener that's baked into Tomcat/Undertow/etc. So fronting with Nginx doesn't make anything faster-- it just adds a network hop to the traffic!

The two main reasons people tend to front with a web server is usually to serve static assets or because they need features not supported like client cert auth, etc (which CommandBox supports 🙂 )

In the cbauth docs, it shows…

settings = {
            userServiceClass = "",
            sessionStorage = "SessionStorage@cbstorages",
            requestStorage = "RequestStorage@cbstorages"
        };

Where does

SessionStorage@cbstorages

point to?