Internet.nl test suite now available as a Docker package

"Easier testing will boost adoption of modern internet standards"

Last month, the Platform for Internet Standards published version 1.8 of the Internet.nl software. The main thing that distinguishes version 1.8 from previous versions is that the entire software suite is now available as a Docker package. So bulk users of the test portal are no longer restricted by the capacity of the Internet.nl service or reliant on a complex and time-consuming installation. Instead, they can quickly realise their own Docker instance, and use that for testing. "For anyone familiar with Docker, the installation, configuration and start-up is a half-hour job."

Limits and limitations

"We had reached the limits of the existing set-up's capabilities, in terms of the numbers of sites, connections and domains that could be tested," explains Bart Knubben, who works on the Platform for Internet Standards for the Forum for Standardisation. "That goes for both our own testing and the testing we do for others. This year, the number of individual tests performed via our front-end (the web portal) will top a million. Then you've got the authorised users who use the API and the dashboard to test numerous names at one go. That's more than another 5 million tests a year."

"Because we don't have unlimited scope for scaling up, we came up with the idea of putting all the software for Internet.nl into a Docker package so that other people can easily run it themselves."

"One of the limitations of the Internet.nl portal is that the tests are performed from a single point," adds Marco Davids, Research Engineer at SIDN Labs, who was involved in the development of Internet.nl. "As a result, only publicly accessible domain names can be tested. However, some organisations would like to install the Internet.nl suite on their own premises, so that they can test their internal systems. The availability of the new Docker package makes that much easier."

A week's work

Although the old Internet.nl software was already available in open-source form, it consisted of so many interdependent components that its installation could be a week's work for an external user. The individual components of the software suite include:

Getting down to work

In the latest version of the Internet.nl software, the various components and their interrelated configurations have been brought together in the form of a single, standardised Docker package. "For anyone familiar with Docker, the installation, configuration and start-up is a half-hour job," says Knubben.

"The Internet.nl software has already been used to build national test portals in Denmark [1], Brazil and Australia. But all those countries are continuing to use old versions of the software because configuration is so time-consuming. As a result, they're missing the RPKI test functionality [added in August 2022], for example. So they're switching to the Docker package, which will enable them to stay updated without too much effort. The same goes for hosters that use our software to test their whole domain name portfolios. And, of course, it goes for us too. The Internet.nl portal now runs on the new Docker package."

Screenshot of the Docker version of Internet.nl

Figure 1: The new Docker version of Internet.nl entered production in mid-November.

Many hosters are taking up the Docker package as well. Some hosters test their entire portfolios – hundreds of thousands of domain names in some cases – on a weekly basis. One reason for doing so is the incentives offered by SIDN and other registries for supporting certain internet standards [1, 2]. Another is the desire to check their own domain names (e.g. for compliance reasons), or to assess the quality of a portfolio they are thinking of acquiring. And, in some cases, hosters test domain names for their customers.

IPv6 support

"This update was a lot more work than originally anticipated," says Johan Bloemberg an external programmer responsible for Dockerising the software. "For example, the limitations of Docker's IPv6 support were problematic, and meant that we initially had to configure the networks manually. Fortunately, things improved as the project progressed: the support is still experimental, but now works well enough for our purposes."

"IPv6 support on the internal Docker networks works perfectly. So the new test environment (which only uses the local networks) has no performance issues. The difficulties mainly involved connections with the outside world. On the Mac, for example, a Linux virtualisation is used, and that implies an extra network connection. Now that the support for interaction between the firewall and proxies and the outside world has been improved, you can test real sites from the test environment. And, if your host system doesn't have native IPv6 connectivity, you can use a tunnel."

Quality improvement

As well as being Dockerised, the latest version of the Internet.nl software features various upgrades:

  • The documentation has been considerably improved.

  • Monitoring and metrics have been added.

  • The underlying software components have been updated.

  • Numerous other minor refinements and improvements have been made across the board.

The new software therefore represents a significant step forwards in both functional and quality terms.

"While we were doing the work, we encountered all sorts of legacy issues," says Knubben. "As a result, we had to invest more time and money than originally anticipated." One thing that cost us a lot of time was the implementation of an automated test environment. The new environment means that the working of the Internet.nl software itself can be validated and reproduced much better than before."

Memory leak

Addition of the monitoring component has paid dividends for the developers of the Internet.nl software themselves. "We've been grappling with a memory leak in the software for some time," says Bloemberg. "The issue meant that we had to restart the Internet.nl system twice a day. We haven't yet stopped the leak. But, because everything now runs in discrete containers, we have been able to isolate it."

Screenshot of the Docker version of Internet.nl

Figure 2: Amongst other things, this graph shows memory usage by the nassl-worker (a Python-wrapper on OpenSSL). As soon as the container's memory limit is reached, it's restarted, resulting in the sawtooth trace.

Open

All things considered, Knubben sees the update as a success. "It's been a bigger effort than we anticipated, but we've created a sound foundation. Internet.nl's source code was already open, otherwise we couldn't have done this. Now the entire package is also available in a standard format [OCI]."

"We also made the whole development process for this version open by sharing our work on GitHub. So people could follow what we were doing, and give input and feedback. The people who got involved included users who started testing at an early stage."

A Docker package that anyone can easily start working with has the disadvantage that the developers lose sight of both usage and outcomes to some degree. After all, Internet.nl was originally conceived by the Platform for Internet Standards as a tool for promoting the adoption of modern internet standards.

As a result, there are open-source projects with an inbuilt telemetry function. "That's not something that we ever really considered ourselves," continues Knubben. "Partly because we attach great importance to user privacy and autonomy. Nevertheless, it can be interesting to get insight into how the product is reused and what the results are. Hopefully the people who reuse our software will keep us in the picture – as the Danish team that created a test portal based on Internet.nl did, sharing usage data with us." Of course, the main dividend is that people will do more testing now that installation of the Internet.nl suite is so easy. And that has to be good for adoption of the standards.

Support from SIDN Fund

Development of the latest version of the Internet.nl software was assisted by SIDN Fund. "As well as investing in the project ourselves, we secured a grant from the Fund," recounts Knubben. "The aim was to increase the API's usage limits for batch jobs. Batches were limited to 5,000 domain names, up to twice a week, which was nowhere near enough for some users. That led to the idea of Dockerising the entire software suite, so that we could then scale up our own systems in a controlled way, while other people could easily use the software on their own systems. Because the updates were a lot more work than we estimated beforehand, we put in far more hours ourselves."

"We classed the project as a pioneering project," says Elise van Schaik, Project Coordinator at SIDN Fund. "That's a project that's intended to take an idea from the drawing board to initial implementation in the space of 6 to 12 months. In this case, we supported the project with a grant of 10,000 euros or so, which is a typical amount for a pioneering project. When considering pioneering project applications, we look mainly at the impact. And we particularly liked this project's potential for contributing to an accessible, robust and secure internet."