Evaluate Webapp container(Spring boot 1.x + Zuul) replacement options

[wu-sheng]

We were using Spring boot 1.x and Zuul gateway as the webapp container to host UI, and bypass GraphQL query to OAP. According to @hanahmily #7119 (comment), we are facing continuous CVEs, which should drive us to look for a replacement solution.

To all @apache/skywalking-committers , we have the following options.

1. Keep in Java, upgrade to Spring boot 2.x, use Spring Gateway or something in Spring ecosystem to host UI. This solution would be coherent.
2. Use NodeJS server to provide service, which basically we to just simply distribute rocketbot-ui in a server mode, and 100% adopt NodeJS ecosystem. @Jtrust @Fine0830 What do you think about this?

[wu-sheng]

Any other suggestion is also welcome.

[hanahmily]

If we adopted to 2, the dev UI docker image building artifacts should be transferred to the UI repo, the release UI docker process should be updated correspondingly.

[kezhenxu94]

Both works for me.

But I just want to remind that the number of dependencies in NodeJS is sometimes unpredictably LARGE even if you only import a simple package, and CVEs in NodeJS is not necessarily less than Java. It would be helpful if UI team could evaluate before we make a final decision.

[wu-sheng]

Both works for me.

But I just want to remind that the number of dependencies in NodeJS is sometimes unpredictably LARGE even if you only import a simple package, and CVEs in NodeJS is not necessarily less than Java. It would be helpful if UI team could evaluate before we make a final decision.

Yes, NodeJS server doesn't mean less CVE at all. All web containers are the place exposing CVEs, as it is a network port.

[wu-sheng]

Notice, in this issue, we don't discuss UI release separately. The query protocol keeps upgrading and enhancing, this is not a good time to do so. We don't recommend mismatched UI and OAP versions.

[Fine0830]

Can we use Nginx to provide web server? CVEs seems to be avoided.

[wu-sheng]

Can we use Nginx to provide web server? CVEs seems to be avoided.

We could use Nginx or APISIX/OpenResty, if we want. @Fine0830 So, you don't like NodeJS to host service directly, right?

[Fine0830]

Can we use Nginx to provide web server? CVEs seems to be avoided.

We could use Nginx or APISIX/OpenResty, if we want. @Fine0830 So, you don't like NodeJS to host service directly, right?

Yes. For fixing CVEs, If we adopted to 2, there will be other uncontrollable problems. like this,

[wu-sheng]

OK than. @hanahmily it seems moving to Spring Gateway + Spring boot 2 would be better.

[heyanlong]

I think it would be good to use nginx to host the UI, and i often do this in my work. only need to put the compiled UI in the www directory to provide high-quality services.

[wu-sheng]

I think it would be good to use nginx to host the UI, and i often do this in my work. only need to put the compiled UI in the www directory to provide high-quality services.

The challenge about Nignx/OpenResty/APISIX is all about how to distribute so many distributions for different OS.

[heyanlong]

as far as i know, nginx can run on unix, linux and windows