As has been mentioned previously
[https://civilized-discourse-construction-kit-inc.ghost.io/2015/01/our-discourse-hosting-configuration/], we lurve us some
Docker here at Discourse. We also lurve us some security, and I've recently been
replacing our "artisinally handcrafted iptables firewall rules" with a Shorewall
[http://shorewall.net/]-managed configuration, which plays better with Puppet.