Contrarian View: Cloud-Native Is a Scam for Startups – Self-Hosting on Bare Metal with Docker 27 Cuts Costs by 60%

#!/bin/bash
# Provision bare metal Ubuntu 22.04 node with Docker 27 CE
# Includes: cgroup v2 config, firewall rules, Docker daemon tuning for production
# Error handling: exit on any non-zero return code, log all steps
set -euo pipefail
LOG_FILE="/var/log/bare-metal-provision.log"
exec > >(tee -a "$LOG_FILE") 2>&1

echo "[$(date +'%Y-%m-%dT%H:%M:%S%z')] Starting bare metal provisioning for Docker 27"

# 1. Validate system requirements
validate_requirements() {
  echo "Validating system requirements..."
  if [ "$(id -u)" -ne 0 ]; then
    echo "ERROR: Script must be run as root" >&2
    exit 1
  fi
  if [ "$(uname -m)" != "x86_64" ]; then
    echo "ERROR: Only x86_64 architectures supported" >&2
    exit 1
  fi
  # Check for at least 4 cores, 16GB RAM
  CORES=$(nproc)
  RAM_GB=$(free -g | awk '/^Mem:/{print $2}')
  if [ "$CORES" -lt 4 ] || [ "$RAM_GB" -lt 16 ]; then
    echo "ERROR: Minimum 4 cores and 16GB RAM required (found ${CORES} cores, ${RAM_GB}GB RAM)" >&2
    exit 1
  fi
  echo "Requirements validated: ${CORES} cores, ${RAM_GB}GB RAM"
}

# 2. Install Docker 27 CE with official repo
install_docker() {
  echo "Installing Docker 27 CE..."
  # Remove old versions
  apt-get remove -y docker docker-engine docker.io containerd runc || true
  # Install prerequisites
  apt-get update && apt-get install -y \
    ca-certificates \
    curl \
    gnupg \
    lsb-release
  # Add Docker official GPG key
  mkdir -p /etc/apt/keyrings
  curl -fsSL https://download.docker.com/linux/ubuntu/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg
  # Set up repository
  echo \
    "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu \
    $(lsb_release -cs) stable" | tee /etc/apt/sources.list.d/docker.list > /dev/null
  # Install Docker 27 (pin version to avoid accidental upgrades)
  apt-get update && apt-get install -y \
    docker-ce=5:27.0.3-1~ubuntu.22.04~jammy \
    docker-ce-cli=5:27.0.3-1~ubuntu.22.04~jammy \
    containerd.io \
    docker-compose-plugin
  # Verify Docker version
  DOCKER_VERSION=$(docker --version | awk '{print $3}' | tr -d ',')
  if [[ "$DOCKER_VERSION" != "27.0.3" ]]; then
    echo "ERROR: Docker version mismatch. Expected 27.0.3, got ${DOCKER_VERSION}" >&2
    exit 1
  fi
  echo "Docker ${DOCKER_VERSION} installed successfully"
}

# 3. Configure Docker daemon for production workloads
configure_docker() {
  echo "Configuring Docker daemon..."
  mkdir -p /etc/docker
  cat > /etc/docker/daemon.json << EOF
{
  "exec-opts": ["native.cgroupdriver=systemd"],
  "log-driver": "json-file",
  "log-opts": {
    "max-size": "100m",
    "max-file": "3"
  },
  "storage-driver": "overlay2",
  "storage-opts": [
    "overlay2.override_kernel_check=true"
  ],
  "live-restore": true,
  "ipv6": false,
  "fixed-cidr-v4": "172.17.0.0/16"
}
EOF
  # Restart Docker to apply changes
  systemctl restart docker
  systemctl enable docker
  echo "Docker daemon configured and restarted"
}

# 4. Configure firewall (UFW) for container traffic
configure_firewall() {
  echo "Configuring UFW firewall..."
  ufw --force reset
  ufw default deny incoming
  ufw default allow outgoing
  # Allow SSH
  ufw allow 22/tcp
  # Allow Docker Swarm ports (if used)
  ufw allow 2377/tcp
  ufw allow 7946/tcp
  ufw allow 7946/udp
  ufw allow 4789/udp
  # Allow HTTP/HTTPS
  ufw allow 80/tcp
  ufw allow 443/tcp
  ufw --force enable
  echo "Firewall configured: SSH, Docker Swarm, HTTP/HTTPS ports open"
}

# 5. Enable cgroup v2 (required for Docker 27 resource limits)
enable_cgroup_v2() {
  echo "Enabling cgroup v2..."
  if [ -f /sys/fs/cgroup/cgroup.controllers ]; then
    echo "cgroup v2 already enabled"
    return 0
  fi
  # Update grub to enable cgroup v2
  sed -i 's/GRUB_CMDLINE_LINUX=""/GRUB_CMDLINE_LINUX="systemd.unified_cgroup_hierarchy=1"/' /etc/default/grub
  update-grub
  echo "cgroup v2 enabled. Reboot required to apply changes."
}

# Main execution
validate_requirements
install_docker
configure_docker
configure_firewall
enable_cgroup_v2

echo "[$(date +'%Y-%m-%dT%H:%M:%S%z')] Provisioning complete. Reboot the node to apply cgroup v2 changes."

# Docker Compose v3.8 stack for startup microservices on Docker 27
# Includes: resource limits, healthchecks, rolling update config, local volumes
# Compatible with Docker Swarm 27 for orchestration
version: "3.8"

networks:
  app-network:
    driver: overlay
    attachable: true

volumes:
  postgres-data:
    driver: local
  redis-data:
    driver: local

services:
  # Nginx reverse proxy with rate limiting
  nginx:
    image: nginx:1.25-alpine
    ports:
      - target: 80
        published: 80
        mode: host
      - target: 443
        published: 443
        mode: host
    volumes:
      - ./nginx/nginx.conf:/etc/nginx/nginx.conf:ro
      - ./nginx/ssl:/etc/nginx/ssl:ro
    deploy:
      mode: replicated
      replicas: 2
      resources:
        limits:
          cpus: "0.5"
          memory: 512M
        reservations:
          cpus: "0.25"
          memory: 256M
      restart_policy:
        condition: on-failure
        delay: 5s
        max_attempts: 3
      update_config:
        parallelism: 1
        delay: 10s
        order: stop-first
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://localhost:80/health"]
      interval: 10s
      timeout: 5s
      retries: 3
    networks:
      - app-network
    depends_on:
      - web

  # Node.js web frontend
  web:
    image: node:20-alpine
    working_dir: /app
    volumes:
      - ./web:/app
      - /app/node_modules
    command: sh -c "npm install && npm run start:prod"
    environment:
      - NODE_ENV=production
      - API_URL=http://api:3000
    deploy:
      mode: replicated
      replicas: 3
      resources:
        limits:
          cpus: "1"
          memory: 1G
        reservations:
          cpus: "0.5"
          memory: 512M
      restart_policy:
        condition: on-failure
        delay: 5s
        max_attempts: 3
      update_config:
        parallelism: 1
        delay: 10s
        order: stop-first
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://localhost:3000/health"]
      interval: 10s
      timeout: 5s
      retries: 3
    networks:
      - app-network
    depends_on:
      - api

  # Go REST API backend
  api:
    image: golang:1.22-alpine
    working_dir: /app
    volumes:
      - ./api:/app
    command: sh -c "go mod download && go run main.go"
    environment:
      - DB_HOST=postgres
      - DB_PORT=5432
      - DB_USER=appuser
      - DB_PASSWORD=changeme
      - DB_NAME=appdb
      - REDIS_HOST=redis
      - REDIS_PORT=6379
    deploy:
      mode: replicated
      replicas: 4
      resources:
        limits:
          cpus: "1.5"
          memory: 2G
        reservations:
          cpus: "0.75"
          memory: 1G
      restart_policy:
        condition: on-failure
        delay: 5s
        max_attempts: 3
      update_config:
        parallelism: 2
        delay: 10s
        order: stop-first
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://localhost:3000/health"]
      interval: 10s
      timeout: 5s
      retries: 3
    networks:
      - app-network
    depends_on:
      - postgres
      - redis

  # PostgreSQL 16 database with persistent storage
  postgres:
    image: postgres:16-alpine
    volumes:
      - postgres-data:/var/lib/postgresql/data
    environment:
      - POSTGRES_USER=appuser
      - POSTGRES_PASSWORD=changeme
      - POSTGRES_DB=appdb
    deploy:
      mode: replicated
      replicas: 1
      resources:
        limits:
          cpus: "2"
          memory: 4G
        reservations:
          cpus: "1"
          memory: 2G
      restart_policy:
        condition: on-failure
        delay: 5s
        max_attempts: 3
      placement:
        constraints:
          - node.role == worker
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U appuser -d appdb"]
      interval: 10s
      timeout: 5s
      retries: 3
    networks:
      - app-network

  # Redis 7 cache with persistence
  redis:
    image: redis:7-alpine
    volumes:
      - redis-data:/data
    command: redis-server --appendonly yes
    deploy:
      mode: replicated
      replicas: 1
      resources:
        limits:
          cpus: "1"
          memory: 2G
        reservations:
          cpus: "0.5"
          memory: 1G
      restart_policy:
        condition: on-failure
        delay: 5s
        max_attempts: 3
      placement:
        constraints:
          - node.role == worker
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 5s
      retries: 3
    networks:
      - app-network

#!/usr/bin/env python3
"""
Docker 27 cost monitor for bare metal nodes
Calculates per-container hourly and monthly costs based on node lease rates
Outputs CSV report for cost allocation
Requires: docker>=7.0.0 (compatible with Docker 27 API)
"""

import csv
import json
import os
import sys
from datetime import datetime
from typing import Dict, List, Optional

import docker
from docker.errors import DockerException, NotFound

# Configuration: update with your bare metal node costs
NODE_CONFIG = {
    "node-1": {"cores": 8, "ram_gb": 32, "monthly_cost_usd": 120},
    "node-2": {"cores": 16, "ram_gb": 64, "monthly_cost_usd": 220},
    "node-3": {"cores": 32, "ram_gb": 128, "monthly_cost_usd": 400},
}
HOURS_PER_MONTH = 730  # Average hours in a month
OUTPUT_CSV = f"docker_cost_report_{datetime.now().strftime('%Y%m%d_%H%M%S')}.csv"

def init_docker_client() -> docker.DockerClient:
    """Initialize Docker client with error handling"""
    try:
        client = docker.from_env()
        client.ping()
        print(f"Connected to Docker {client.version()['Version']}")
        return client
    except DockerException as e:
        print(f"ERROR: Failed to connect to Docker daemon: {e}", file=sys.stderr)
        sys.exit(1)

def get_node_allocatable_resources(client: docker.DockerClient, node_name: str) -> Dict[str, int]:
    """Get total allocatable CPU (in millicores) and RAM (in MB) for a node"""
    try:
        node_info = client.info()
        if node_info.get("Name") != node_name:
            print(f"WARNING: Node name mismatch. Expected {node_name}, got {node_info.get('Name')}")
        total_cores = node_info["NCPU"]
        total_ram_mb = node_info["MemTotal"] // (1024 * 1024)  # Convert bytes to MB
        return {
            "cpu_millicores": total_cores * 1000,
            "ram_mb": total_ram_mb
        }
    except Exception as e:
        print(f"ERROR: Failed to get node resources: {e}", file=sys.stderr)
        return {"cpu_millicores": 0, "ram_mb": 0}

def calculate_container_cost(
    container: dict,
    node_resources: Dict[str, int],
    node_monthly_cost: float
) -> Optional[Dict[str, float]]:
    """Calculate cost for a single container based on resource reservations"""
    try:
        # Get container resource limits (fall back to reservations if limits not set)
        host_config = container.get("HostConfig", {})
        cpu_limit = host_config.get("NanoCpus", 0) // 1_000_000  # Convert nanoseconds to millicores
        mem_limit = host_config.get("Memory", 0) // (1024 * 1024)  # Convert bytes to MB

        # If no limits set, assume 10% of node resources (default for unconstrained containers)
        if cpu_limit == 0:
            cpu_limit = node_resources["cpu_millicores"] * 0.1
        if mem_limit == 0:
            mem_limit = node_resources["ram_mb"] * 0.1

        # Calculate resource share percentages
        cpu_share = cpu_limit / node_resources["cpu_millicores"]
        mem_share = mem_limit / node_resources["ram_mb"]
        avg_share = (cpu_share + mem_share) / 2

        # Calculate cost
        hourly_cost = (node_monthly_cost / HOURS_PER_MONTH) * avg_share
        monthly_cost = hourly_cost * HOURS_PER_MONTH

        return {
            "container_id": container["Id"][:12],
            "container_name": container["Names"][0].lstrip("/"),
            "cpu_millicores": cpu_limit,
            "ram_mb": mem_limit,
            "cpu_share_pct": round(cpu_share * 100, 2),
            "mem_share_pct": round(mem_share * 100, 2),
            "hourly_cost_usd": round(hourly_cost, 4),
            "monthly_cost_usd": round(monthly_cost, 2),
        }
    except Exception as e:
        print(f"WARNING: Failed to calculate cost for container {container.get('Id', 'unknown')}: {e}")
        return None

def generate_cost_report(client: docker.DockerClient) -> List[Dict[str, float]]:
    """Generate cost report for all running containers across configured nodes"""
    report_rows = []
    for node_name, node_config in NODE_CONFIG.items():
        print(f"Processing node {node_name}...")
        node_resources = get_node_allocatable_resources(client, node_name)
        if node_resources["cpu_millicores"] == 0:
            continue

        # Get all running containers
        containers = client.containers.list(all=False)
        for container in containers:
            container_info = container.attrs
            cost_data = calculate_container_cost(
                container_info,
                node_resources,
                node_config["monthly_cost_usd"]
            )
            if cost_data:
                cost_data["node_name"] = node_name
                report_rows.append(cost_data)

    return report_rows

def write_csv_report(report_rows: List[Dict[str, float]]) -> None:
    """Write cost report to CSV file"""
    if not report_rows:
        print("No container cost data to write.")
        return

    fieldnames = [
        "node_name", "container_id", "container_name",
        "cpu_millicores", "ram_mb",
        "cpu_share_pct", "mem_share_pct",
        "hourly_cost_usd", "monthly_cost_usd"
    ]

    with open(OUTPUT_CSV, "w", newline="") as csvfile:
        writer = csv.DictWriter(csvfile, fieldnames=fieldnames)
        writer.writeheader()
        writer.writerows(report_rows)

    print(f"Cost report written to {OUTPUT_CSV}")
    total_monthly = sum(row["monthly_cost_usd"] for row in report_rows)
    print(f"Total monthly container cost: ${total_monthly:.2f}")

def main() -> None:
    """Main execution flow"""
    print(f"Starting Docker 27 cost monitor at {datetime.now().isoformat()}")
    client = init_docker_client()
    report_rows = generate_cost_report(client)
    write_csv_report(report_rows)
    print("Cost monitoring complete.")

if __name__ == "__main__":
    main()