SlideShare a Scribd company logo

2015 03-11_todd-fritz_devnexus_2015

Download as PPTX, PDF
Todd Fritz, profile picture
Todd Fritz

The document discusses the process of containerizing a monolithic application into a microservice-based platform as a service (PaaS) using Docker. It outlines the business value, adoption challenges, Docker basics, orchestration tools, and steps for decomposing a monolith. Key topics include the advantages of containers for deployment and scaling, and the need for technical expertise in adopting this approach.

Software
Related topics:
Software Architecture
1 of 91
Downloaded 131 times
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
Docker Containerizing a Monolithic Application into a Microservice-based PaaS Todd Fritz March 11, 2015
tafritz@outlook.com www.linkedin.com/in/tfritz/en http://www.slideshare.net/ToddFritz https://github.com/todd-fritz
License: CC BY-SA 3.0 Agenda MARCH 11, 2015 2 1. Why Containers? 2. Business Value 3. Adoption 4. Docker Basics 5. Orchestration Toolkit 6. Decompose the Monolith 7. Microservices 8. API Gateway 9. Service Discovery 10.Security & Networking 11.Putting it Together 12.Questions?
License: CC BY-SA 3.0MARCH 11, 2015 3 • Senior Software Architect @ Altisource Labs • The opinions contained herein may not represent my employer, but I believe they should. • Platform Development, Middleware, MoM, EIP, EDA, etc • Deployment perspective • Exposed to many environments, technologies, people • Life-long learner and always curious • Novice bass player • Scuba diver - next adventure • https://www.bikiniatoll.com/divetour.html About Me
License: CC BY-SA 3.0MARCH 11, 2015 4 DevNexus 2015 (today!) http://www.slideshare.net/ToddFritz/2015-03- 11_Todd_Fritz_Devnexus_2015 Great Wide Open - Atlanta (April 3, 2014) http://www.slideshare.net/ToddFritz/2014-04-03legacytocloud AJUG (April 15, 2014) http://www.slideshare.net/ToddFritz/2014-april-15-atlanta-java- users-group Video - https://vimeo.com/94556976 Presentations
License: CC BY-SA 3.0MARCH 11, 2015 5 Why Containers?
License: CC BY-SA 3.0 Why Containers? MARCH 11, 2015 6 • Familiarity with Docker helpful • Not Cargo Cult Programming (pun intended) • Streamline development and testing • Portable and predictable across environments • Composable and dynamic • Ideal for Microservices • Deployment • Scaling • Clocker, Apache Brooklyn, RancherOS
License: CC BY-SA 3.0MARCH 11, 2015 7 • More disruptive to cloud providers who have defined their own cloud deployment architectures • Does a heavy O/S get in the way? • Docker fever! Rapid innovation during past year! • Red Hat – early adopters • IBM – Q4 2014 - Enterprise Hosting for Docker • Microsoft - Q4 2014 - Azure • Amazon – Q4 2014 • Digital Ocean, Joynet • Need for more standards • Blueprints, e.g. Apache Brooklyn Why Containers?
License: CC BY-SA 3.0MARCH 11, 2015 8 Ancestry? • Jailing / BSD • Solaris Zones / Containers have been around for a long time Why Containers?
License: CC BY-SA 3.0MARCH 11, 2015 9 Thought: a paradigm shift for the O/S? • Redefines “Kernel Space”? CoreOS, RancherOS • Redefines “User Space”? • Better fit for distributed computing Why Containers? http://www.ibm.com/developerworks/library/l-linux-kernel/
License: CC BY-SA 3.0MARCH 11, 2015 10 Business Value
License: CC BY-SA 3.0 Business value MARCH 11, 2015 11 • xPaaS • Decoupled, separated concerns, vendor specialization https://img.en25.com/Web/RedHat/JB_xPaaS_Tech_Overview_11454037_v3_0913cd_web.pdf
License: CC BY-SA 3.0 Business Value MARCH 11, 2015 12 • Necessary? “If it ain’t broke, don’t fix it.” • Simplifies deployment, management, administration • Enhances Architecture, Developers, Dev Ops • Speed to market with scale-up • Replaces sandboxing with containers • Reduces cost • Portable and predictable • Streamline development, QA • Scales via configuration • Emerging technologies for autonomic self- management
License: CC BY-SA 3.0 Business Value MARCH 11, 2015 13 Containers enable the “Intelligent Cloud”? • Container is basic unit • Self-scaling • Self-managing; platform intelligence reduces TCO • Self-healing • Containers/apps expose metrics and events (security) • Container manager collects metrics • Machine learning interprets metrics to identify stimuli • Platform reacts to interpreted stimuli (OPS, security)
License: CC BY-SA 3.0MARCH 11, 2015 14 Adoption
License: CC BY-SA 3.0MARCH 11, 2015 15 Whale you be my container? Adoption
License: CC BY-SA 3.0 Adoption MARCH 11, 2015 16 Adoption cycle graphic © 2012 Simon Wardley and CC BY-SA 3.0 “#@$%!
License: CC BY-SA 3.0 Adoption - Obstacles MARCH 11, 2015 17 Management • Need right skills and people to pull it off • Heard it is complex with perceived security flaws • Lack of in-house technical expertise, schedule, time • Learning curve, fear of change, unable to quantify risk • How to justify the expense? Developers, QA, DevOps • Learning curve • Need for direction and guidance • Know-it-alls or superficial, tangential decision making Architects and Technical Leadership • Learning curve • Executive sponsorship
License: CC BY-SA 3.0MARCH 11, 2015 18 Architects • Begins with a knowledgeable evangelist • Sell to developers and articulate technical / business benefits • Involve DevOps – “Not a Chef replacement” • Mentor growth of in-house expertise Developers / QA • Evangelize benefits to team, generate excitement, spike it • Obtain buy in, get team to sell up the chain • Try it out, be curious do a PoC! Management • Evangelize to forward-thinkers who “get it” • Sell ROI, speed to market, benefits of good architecture • Reduces TCO of engineering and operations Adoption - Overcoming Obstacles
License: CC BY-SA 3.0MARCH 11, 2015 19 Docker Basics
License: CC BY-SA 3.0MARCH 11, 2015 20 • Open-source • Easier scalability • Lightweight, portable, insulated containers • Reuse from dev (“local cloud”) through production • Can run at scale on VMs, bare metal, cloud • Encapsulate any payload - application • Run consistently including hybrid environments • PaaS enabler • Replaces sandboxing Docker Basics
License: CC BY-SA 3.0MARCH 11, 2015 21 • What is Docker? • “(…) an open platform (…) to build, ship, and run distributed applications.” • Docker Engine • “Portable, lightweight, runtime and packaging tool.” • Docker Hub Registry • “Cloud service for sharing applications and automation workflows.” Docker Basics https://www.docker.com/whatisdocker/
License: CC BY-SA 3.0MARCH 11, 2015 22 • Docker Image • Configured Snapshot of server or service. • Can be extended • Docker Container • Docker images run within the container • DockerFile • Instructions/commands that create image Docker Basics
License: CC BY-SA 3.0MARCH 11, 2015 23 • Used to build containers by scripting creation actions of image layers • Less powerful than traditional configuration management software • Example • In discrete steps, instruct Docker to build an image by taking a default Ubuntu distro, apt-get install dependencies, and then add the application. • Each Dockerfile command creates a new image layer, and clever structuring of the commands enables reuse Docker Basics – Dockerfiles
License: CC BY-SA 3.0 VM MARCH 11, 2015 24 http://www.slideshare.net/dotCloud/docker-intro-november
License: CC BY-SA 3.0MARCH 11, 2015 25 • Automates app deployment within containers • Originally based on Linux Containers (LXC) via an API to expose lightweight virtualization that: • Process isolation • Utilizes LXC, cgroups, and the kernel • Does not include a separate operating system • Kernel provides resource isolation • CPU, memory, block I/O, network • Now have libcontainer (native Go) – replaces use of LXC • Interface between user space and kernel • Works well with Chef, Puppet, Vagrant • Dynamic provisioning – ideal for PaaS Docker Basics – How, What, Why
License: CC BY-SA 3.0MARCH 11, 2015 26 • Container is the basic building block • Analogous to a slice of a VM image, containing application code or binaries, as well as the execution environment and dependencies • Images may be built atop each other • An image contains only the incremental changes required to transform its base image to the state required by the image • May contain metadata, such as how to run what is inside the image, expose ports, etc • Acts as an instantiable container template Docker Basics
License: CC BY-SA 3.0MARCH 11, 2015 27 Docker Basics http://www.slideshare.net/dotCloud/docker-intro-november
License: CC BY-SA 3.0MARCH 11, 2015 28 • Intra-container communication via sockets (Docker links). Containers can talk to each other. • Familiar lifecycle: started, stopped, or kill • Can create images from previously run containers, to persist changes made while container was executing Docker Basics
License: CC BY-SA 3.0MARCH 11, 2015 29 • Docker has three parts • docker daemon runs as root to manage containers • docker containers spawn from images, which are tiny and can be versioned • docker repository allows images to be exchanged and versioned like code (public or private) • Each container has a unique IP address • Port and pipework to expose containers outside host • Share volumes, multi home, integrate containers into host network (and more) • Continuous integration can generate versioned docker images, web hooks, repo notifications Docker Basics
License: CC BY-SA 3.0MARCH 11, 2015 30 • Common use cases • Automate application packaging and deployment • Lightweight PaaS environments • Automate testing, continuous integration, and deployment • Deploy and scale web apps, databases, backend services Docker Basics
License: CC BY-SA 3.0MARCH 11, 2015 31 Docker Basics http://www.slideshare.net/dotCloud/docker-intro-november
License: CC BY-SA 3.0MARCH 11, 2015 32 • Docker sold DotCloud PaaS to cloudControl • Not opinionated • Deis, Flynn • (Both provide scaffolding to support distributed, containerized, service implementations) • Opinionated • CloudFoundry, OpenShift, Apcera Continuum • Integrates Docker into their systems • CoreOS, RancherOS Docker Basics – PaaS Frameworks
License: CC BY-SA 3.0MARCH 11, 2015 33 Docker Basics - CoreOS • CoreOS uses fleet to run containers with systemd https://coreos.com/using-coreos/
License: CC BY-SA 3.0MARCH 11, 2015 34 • A “System Docker” as PID1 manages “User Dockers” • Separate Docker daemon runs in User Docker container Docker Basics - RancherOS http://rancher.com/rancher-os/
License: CC BY-SA 3.0MARCH 11, 2015 35 Orchestration Toolkit
License: CC BY-SA 3.0MARCH 11, 2015 36 • Portability across environments, providers • Composable • New technologies (beta), not production ready 1. Docker Machine 2. Docker Swarm 3. Docker Compose (based on fig) • http://www.infoq.com/news/2015/03/docker-machine-swarm-compose • Micro Virtualization to follow? Orchestration Toolkit http://thenewstack.io/orchestration-toolkit-release-aims-prove-dockers-commitment-flexibility-community-ecosystem/
License: CC BY-SA 3.0MARCH 11, 2015 37 Docker Machine • (Separate project from Docker Engine) • Abstraction used to provision to different environments • Support for 12 environment providers • Virtualbox (local) • Digital Ocean, AWS, Azure, Vmware, and more • Hybrid environments • https://github.com/docker/machine % machine create -d [infrastructure provider] [provider options] [machine name] Orchestration Toolkit – Docker Machine http://blog.docker.com/2014/12/announcing-docker-machine-swarm-and-compose-for-orchestrating-distributed-apps/
License: CC BY-SA 3.0MARCH 11, 2015 38 • Native clustering • A pool of Docker hosts exposed as a single, virtual host • Schedule containers to run atop • Automatic workload management • Uses standard Docker API • Any tool using docker daemon can Swarm transparently • Dokku, Compose, Krane, Flynn, Desi, DockerUI, Shipyard, Jenkins • Docker client • H/A and Failover • Swarm performs health checks with auto- rebalancing Orchestration Toolkit – Docker Swarm
License: CC BY-SA 3.0MARCH 11, 2015 39 • Scheduling algorithm • Standard filters • Constraint (storage=ssd, storage=disk, etc) • storagedriver, executiondriver, kernelversion, operatingsystem • Affinity • Certain containers may perform better on same host • “Locality of Reference” • Port • Health • Even Azure cloud computing platform supports it • http://www.eweek.com/cloud/docker-swarms-onto-microsofts-cloud.htm Orchestration Toolkit – Docker Swarm
License: CC BY-SA 3.0MARCH 11, 2015 40 • Undergoing development • Adding feature to reschedule container on failed host Orchestration Toolkit – Docker Swarm
License: CC BY-SA 3.0MARCH 11, 2015 41 Orchestration Toolkit – Docker Swarm # create a cluster $ docker run --rm swarm create 6856663cdefdec325839a4b7e1de38e8 # <- this is your unique <cluster_id> # on each of your nodes, start the swarm agent # <node_ip> doesn't have to be public (e.g. 192.168.0.X), # as long as the swarm manager can access it. $ docker run -d swarm join --addr=<node_ip:2375> token://<cluster_id> # start the manager on any machine or your laptop $ docker run -d -p <swarm_port>:2375 swarm manage token://<cluster_id> # use the regular docker cli $ docker -H tcp://<swarm_ip:swarm_port> info $ docker -H tcp://<swarm_ip:swarm_port> run ... $ docker -H tcp://<swarm_ip:swarm_port> ps $ docker -H tcp://<swarm_ip:swarm_port> logs ... ... # list nodes in your cluster $ docker run --rm swarm list token://<cluster_id> <node_ip:2375>
License: CC BY-SA 3.0MARCH 11, 2015 42 • Final piece of orchestration puzzle • After provisioning with Machine • After defining clustering with Swarm • Based on Fig • Define application components within one file • Containers, container configuration, links, volumes • Assemble multi-container distributed apps to run atop Swarm-managed clusters • Simple YAML configuration • https://github.com/docker/docker/issues/9694 Orchestration Toolkit – Docker Compose
License: CC BY-SA 3.0MARCH 11, 2015 43 • Commands to manage lifecycle: start, stop, rebuild • Obtain status of running services or view logs • On Roadmap: • Support for test, staging, production environments • Integration with Swarm • Support for multi-team and multi-registry development • Improved container build automation (e.g. auto C.I.) • https://github.com/docker/compose/blob/master/ROADMAP.md#applicat ions-spanning-multiple-teams Orchestration Toolkit – Docker Compose
License: CC BY-SA 3.0MARCH 11, 2015 44 containers: web: build: . command: python app.py ports: - "5000:5000" volumes: - .:/code links: - redis environment: - PYTHONUNBUFFERED=1 redis: image: redis:latest command: redis-server --appendonly yes Orchestration Toolkit – Docker Compose
License: CC BY-SA 3.0MARCH 11, 2015 45 Schedulers are responsible for starting containers on available hosts. Orchestration Toolkit - Schedulers https://www.digitalocean.com/community/tutorials/the-docker-ecosystem-an-introduction-to-common- components
License: CC BY-SA 3.0MARCH 11, 2015 46 Options • Fleet • Marathon • Swarm • Kubernetes • Compose Orchestration Toolkit - Schedulers
License: CC BY-SA 3.0MARCH 11, 2015 47 Decompose the Monolith
License: CC BY-SA 3.0MARCH 11, 2015 48 • So, you have a monolithic app that needs to be modernized… For whatever reason. • How to rebuild it? (insert: Six Million Dollar Man ref.) Decompose the Monolith
License: CC BY-SA 3.0 Decompose the Monolith MARCH 11, 2015 49 • No smoking in the Emergency Room! • System Analysis • Use an iterative methodology • Leverage existing knowledge and literature • Some analysis before • Decompose and modularize (scale cube) • Separation of concerns • Proof of concepts are your friend
License: CC BY-SA 3.0MARCH 11, 2015 50 A simple metaphor to follow (Please do not leave) Decompose the Monolith
License: CC BY-SA 3.0 Decompose the Monolith MARCH 11, 2015 51 I’m a proud stovepipe, just bolted together, vroom vroom vroom vroom vroom.
License: CC BY-SA 3.0 Decompose the Monolith MARCH 11, 2015 52 Oh, nooo... My job security...
License: CC BY-SA 3.0 Decompose the Monolith MARCH 11, 2015 53 I now have free nights and weekends...
License: CC BY-SA 3.0MARCH 11, 2015 54 “Bounded Context” from Domain-Driven Design • Identify discrete business capabilities (“Functions”) • Functions govern part of enterprise data model • A Microservice implements a Function • Microservices encapsulate data access via API (REST) • Data store per microservice (no sharing) • Overlap managed by higher-order microservices or hypermedia • Functions may share – e.g. “Addresses” Also consider the “Scale Cube” • http://microservices.io/articles/scalecube.html Decompose the Monolith - Technique
License: CC BY-SA 3.0MARCH 11, 2015 55 Microservices
License: CC BY-SA 3.0MARCH 11, 2015 56 Why? • Good fit for containers • Ideal for distributed computing • Correct implementation is hard • A warning • http://highscalability.com/blog/2014/4/8/microservices-not-a-free-lunch.html The ESB from yesterday does not fit • https://www.voxxed.com/blog/2015/01/good-microservices- architectures-death-enterprise-service-bus-part-one/ • Once upon a time, Enterprise Application Integration (EAI) • SOA emerges, vendors rebrand EAI offerings as ESBs • Old ESBs were centralized  new ESBs decentralized Microservices
License: CC BY-SA 3.0 • Various definitions (sometimes a “Holy War”) • Why Microservices? • Because building monoliths is so 2005… • What runs in the container, matters • http://microservices.io/patterns/microservices.html • Architecture for delivery of systems as a set of services • Small • Collaborating • Independent Microservices MARCH 11, 2015 57
License: CC BY-SA 3.0MARCH 11, 2015 58 Single Responsibility Principle (SRP) • “One reason to change” Open-Closed Principle (OCP) • Open for Extension, closed for modification • Swappable implementations behind API, Polyglot persistence Liskov Substitution Principle (LSP) • Implementation honors API contract Interface Segregation Principle (ISP) • Clients should not be forced to implement unused methods • “Fat Interfaces” Dependency Inversion Principle (DIP) • Abstractions should not depend upon details. API GATEWAY. Microservices – tenets – SOLID
License: CC BY-SA 3.0MARCH 11, 2015 59 • Familiar concept? SOA without the ESB? • Simple services, focused on doing one thing (well) • Loose coupling • Facilitates parallel development; multiple teams • Easier to test • Enables C.I. / C.D. • Decouple technology and tooling from service • Use what you want to implement (polyglot) Microservices – Advantages
License: CC BY-SA 3.0MARCH 11, 2015 60 • Complexity of distributed system • Operationalization overhead • Each service needs load balancing, monitoring, • Testing distributed systems is hard • Deployment complexity; DevOps skill • Implicit Interfaces between collaborating components • Backwards compatibility quicksand • Some duplication of effort Microservices – Disadvantages http://highscalability.com/blog/2014/4/8/microservices-not-a-free-lunch.html
License: CC BY-SA 3.0MARCH 11, 2015 61 • Separate data store per microservice • Similar level of code maturity • Separate build, CI per microservice • Containerize! • Stateless! Microservices – Best Practices http://nginx.com/blog/microservices-at-netflix-architectural-best-practices/
License: CC BY-SA 3.0MARCH 11, 2015 62 Google gRPC • http://www.infoq.com/news/2015/02/grpc Microservices
License: CC BY-SA 3.0MARCH 11, 2015 63 API Gateway
License: CC BY-SA 3.0MARCH 11, 2015 64 Two peas in a pod • API Gateway & Microservice Architecture API Gateway acts as single point of entry into Microservice architecture for a client • Serve different types of clients • Protocol Translation, etc (EIP – Camel) • http://techblog.netflix.com/2013/01/optimizing-netflix- api.html Handles requests in two ways • Proxy/routing to service • Fan-out to multiple services API Gateway
License: CC BY-SA 3.0MARCH 11, 2015 65 Benefits • Decouples clients from services • Improves client’s API experience • Abstract logic for orchestrated services into gateway • Reduces request/response round trips Disadvantages • More complex • Possible increase in latency (network hop through gateway) API Gateway http://microservices.io/patterns/apigateway.html
License: CC BY-SA 3.0MARCH 11, 2015 66 API Gateway http://microservices.io/patterns/apigateway.html
License: CC BY-SA 3.0MARCH 11, 2015 67 • Dynamic Polyglot Runtime • Fully Synch Service Layer • Reactive Programing Model API Gateway – At Netflix http://techblog.netflix.com/2013/01/optimizing-netflix-api.html
License: CC BY-SA 3.0MARCH 11, 2015 68 Service Discovery
License: CC BY-SA 3.0 Service Discovery MARCH 11, 2015 69 • Service Discovery requires a Service Registry • Apps need need to register exposed services • Clients lookup, bind, invoke • Applications then query discovery service for how to connect to an application • Responsibilities 1. Provide clients with metadata to connect to service 2. Allow applications to register to provide #1 3. Expose global location to start arbitrary configuration 4. Store metadata about cluster members
License: CC BY-SA 3.0MARCH 11, 2015 70 Service Discovery https://www.digitalocean.com/community/tutorials/the-docker-ecosystem-an-introduction-to-common- components
License: CC BY-SA 3.0MARCH 11, 2015 71 Popular service discovery tools • Etcd • Created by CoreOS. HTTP API and a CLI. • Consul • “Advanced features”: health checks, ACL, HAProxy config • Zookeeper • Older and lacks new features, but more stable and mature Service Discovery
License: CC BY-SA 3.0MARCH 11, 2015 72 Value adds • Crypt • Components can use keys to protect information • Clients can read if they have decryption key • Confd • Dynamic reconfiguration of apps • Vulcand • Load balancer. “Etcd aware” • Marathon • Scheduler and basic HAProxy config management • Nerve • Used with Synapse for health checks and auto cluster mgmt Service Discovery
License: CC BY-SA 3.0MARCH 11, 2015 73 Alternatives to Asynch? • Why deal with the heaviness? Lightweight threads and Actors for JVM • Quasar • https://github.com/puniverse/quasar • Lightweight threads, Go-like channels, Erlang like actors, etc • COMSAT • https://github.com/puniverse/comsat • Scalable, concurrent web-apps • Not Web Framework • Implementations to popular (and standard) APIs, including JAX-RS, JDBC, Servlet, etc – that are called with Quasar fibers Service Discovery – Fibers > Asynch? https://www.voxxed.com/blog/2015/02/farewell-to-asynchronous-code/
License: CC BY-SA 3.0MARCH 11, 2015 74 Service Discovery – Clay.io example http://zolmeister.com/2015/02/10x-service-discovery-at-clay-io.html http://zolmeister.com/2014/12/10x-docker-at-clay-io.html
License: CC BY-SA 3.0MARCH 11, 2015 75 Security and Networking
License: CC BY-SA 3.0MARCH 11, 2015 76 • Very hot topic • Ongoing investment and innovation • Docker adds security experts to team • Announced last week • Docker acquires SocketPlane • Announced last week • 3 months from startup to acquisition? A record? • Native to Docker • Software defined network services • For distributed applications that span hybrid clouds • http://www.programmableweb.com/news/docker-extends-api-reach- socketplane-acquisition/2015/03/05 Security and Networking
License: CC BY-SA 3.0 Security and Networking MARCH 11, 2015 77 • Swarm • TLS AuthN between CLI and Swarm • TLS between Swarm and Docker nodes • Containers weaker than VM for isolation • VM’s can use ring-1 hardware isolation • Prevents VM’s from “breaking out” • Containers lack hardware isolation • “Shocker” attack (for pre 1.0 Docker containers) • Running atop hypervisor enhances resource isolation but does not necessarily make this more secure • Container in VM reduces surface area for attacks • Don’t do stupid stuff in container, follow best practices
License: CC BY-SA 3.0MARCH 11, 2015 78 “When we feel comfortable saying that Docker out-of-the-box can safely contain untrusted uid0 programs, we will say so clearly” - Docker CTO Solomon Hykes Security and Networking
License: CC BY-SA 3.0MARCH 11, 2015 79 • Networking capabilities somewhat limited • libchan is officially sponsored approach • Go like channels over network • Flocker • Proxy based approach • Host-portable services (including underlying storage) • Weave • Powerstrip • Use Weave and Flocker together • Run a Crate cluster using Weave’s container networking and portable storage provided by Security and Networking
License: CC BY-SA 3.0MARCH 11, 2015 80 • OpenVswitch • https://github.com/openvswitch/ovs • Multilayer software switch (VM environments) • Standard control and visibility interfaces • Designed for distribution across multiple servers • Security companies not yet offering container endpoint protection • Lack of tools for encryption at container level • Lacks live migration tools Security and Networking
License: CC BY-SA 3.0MARCH 11, 2015 81 Putting it Together
License: CC BY-SA 3.0MARCH 11, 2015 82 “Without Paas, Docker is just a bunch of containers.” • http://www.zdnet.com/article/paas-and-docker/ • Needs supporting technologies Gaps • Underserved: networking, storage, granular versioning Apache Mesos for simpler clustering? • http://www.zdnet.com/article/why-amazons-docker-service-is-linking- into-apache-mesos-for-simpler-clustering/ Putting it Together
License: CC BY-SA 3.0MARCH 11, 2015 83 • How to put a solution together? • Clocker (from Cloudsoft) • Create Docker clouds orchestrated by Apache Brooklyn • Single to multi host • Intelligent container placement: resilience, scaling, fault tolerance, resource optimization • Existing Brooklyn/CAMP blueprints port without change • Apache Brooklyn • jClouds API (cloud API agnostic) for provision • Monitors and manages containers • Configuration blueprints that use docker infrastructure • Uses Dockerfiles Putting it all Together http://thenewstack.io/an-open-source-story-clocker-does-what-docker-cant-do-alone/
License: CC BY-SA 3.0MARCH 11, 2015 84 Putting it Together
License: CC BY-SA 3.0APRIL 2014 85 http://www.appneta.com/blog/automated-testing-with-docker/ Putting it Together
License: CC BY-SA 3.0MARCH 11, 2015 86 • Not part of this presentation • Worth reading • Apache Samza http://blog.confluent.io/2015/03/04/turning-the-database-inside-out-with-apache- samza/ Putting it Together
License: CC BY-SA 3.0MARCH 11, 2015 87 Appendix
License: CC BY-SA 3.0MARCH 11, 2015 88 Hardware • “Quantum” processors – Qbits • Input, Output, Memory, CPU, Network Software • Machine Learning, Artificial Intelligence • Autonomous systems • Self-Tuning -> Self-Improving -> Self-Coding Manufacturing • 3D printing • A.I. managed hardware provisioning and “data center” construction”. On-premise construction? Within 50 years, the Singularity? Trends & Innovation
License: CC BY-SA 3.0MARCH 11, 2015 89 Questions?
License: CC BY-SA 3.0MARCH 11, 2015 90 • http://highscalability.com/blog/2014/4/8/microservices-not-a-free-lunch.html • https://medium.com/aws-activate-startup-blog/using-containers-to-build-a-microservices-architecture- 6e1b8bacb7d1 • http://codesamplez.com/web-server/dockerize-an-application-from-scratch • http://blog.docker.com/2014/12/announcing-docker-machine-swarm-and-compose-for-orchestrating- distributed-apps/ • http://www.infoq.com/articles/docker-future • https://crate.io/blog/crate-flocker-weave-powerstrip-snowsprint/ • https://coreos.com/using-coreos/ • http://rancher.com/announcing-rancher-io-portable-infrastructure-services-for-docker/ • http://nginx.com/blog/microservices-at-netflix-architectural-best-practices/ • http://zolmeister.com/2015/02/10x-service-discovery-at-clay-io.html • http://zolmeister.com/2014/10/10x-architecture-at-clay-io.html • http://zolmeister.com/2014/10/10x-logging-at-clay-io.html Resources

More Related Content

PDF
Cloud Native Patterns with Bluemix Developer Console
Matthew Perrins
 
PPTX
Why to Cloud Native
Karthik Gaekwad
 
PDF
Cloud Foundry OpenTour Kiev Keynote
Patrick Chanezon
 
PPTX
Docker and Devops
Docker, Inc.
 
PPTX
server to cloud: converting a legacy platform to an open source paas
Todd Fritz
 
PDF
Making Friendly Microservices by Michele Titlol
Docker, Inc.
 
PDF
Alibaba Cloud Conference 2016 - Docker Open Source
John Willis
 
PPTX
All Things Open : Crash Course in Open Source Cloud Computing
Mark Hinkle
 
Cloud Native Patterns with Bluemix Developer Console
Matthew Perrins
 
Why to Cloud Native
Karthik Gaekwad
 
Cloud Foundry OpenTour Kiev Keynote
Patrick Chanezon
 
Docker and Devops
Docker, Inc.
 
server to cloud: converting a legacy platform to an open source paas
Todd Fritz
 
Making Friendly Microservices by Michele Titlol
Docker, Inc.
 
Alibaba Cloud Conference 2016 - Docker Open Source
John Willis
 
All Things Open : Crash Course in Open Source Cloud Computing
Mark Hinkle
 

What's hot (20)

PPTX
FLUX - Crash Course in Cloud 2.0
Mark Hinkle
 
PPTX
Hypervisor "versus" Linux Containers with Docker !
Francisco Gonçalves
 
PPTX
Delivering Developer Tools at Scale
Oracle Developers
 
PPT
IBM Bluemix OpenWhisk: Interconnect 2016, Las Vegas: CCD-1088: The Future of ...
OpenWhisk
 
PPTX
Oracle Code Keynote with Thomas Kurian
Oracle Developers
 
PPT
OpenWhisk Introduction
Ioana Baldini
 
PPTX
Docker for the enterprise
Bert Poller
 
PDF
Containers, microservices and serverless for realists
Karthik Gaekwad
 
PDF
Alibaba Cloud Conference 2016 - Docker Enterprise
John Willis
 
PPTX
Docker and Microservice
Samuel Chow
 
PDF
Cloud Native In-Depth
Siva Rama Krishna Chunduru
 
PDF
Fully Orchestrating Applications, Microservices and Enterprise Services with ...
Docker, Inc.
 
PPTX
Driving Enterprise Architecture Redesign: Cloud-Native Platforms, APIs, and D...
Chris Haddad
 
PPTX
The Architecture of Continuous Innovation - OSCON 2015
Chip Childers
 
PDF
Containers - Transforming the data centre as we know it 2016
Keith Lynch
 
PDF
Intro - Cloud Native
Albert Suwandhi
 
PDF
Transform Digital Business with DevOps
Daniel Oh
 
PDF
The Container Evolution of a Global Fortune 500 Company with Docker EE
Docker, Inc.
 
PDF
Containers and microservices for realists
Karthik Gaekwad
 
PDF
DCSF 19 How Entergy is Mitigating Legacy Windows Operating System Vulnerabili...
Docker, Inc.
 
FLUX - Crash Course in Cloud 2.0
Mark Hinkle
 
Hypervisor "versus" Linux Containers with Docker !
Francisco Gonçalves
 
Delivering Developer Tools at Scale
Oracle Developers
 
IBM Bluemix OpenWhisk: Interconnect 2016, Las Vegas: CCD-1088: The Future of ...
OpenWhisk
 
Oracle Code Keynote with Thomas Kurian
Oracle Developers
 
OpenWhisk Introduction
Ioana Baldini
 
Docker for the enterprise
Bert Poller
 
Containers, microservices and serverless for realists
Karthik Gaekwad
 
Alibaba Cloud Conference 2016 - Docker Enterprise
John Willis
 
Docker and Microservice
Samuel Chow
 
Cloud Native In-Depth
Siva Rama Krishna Chunduru
 
Fully Orchestrating Applications, Microservices and Enterprise Services with ...
Docker, Inc.
 
Driving Enterprise Architecture Redesign: Cloud-Native Platforms, APIs, and D...
Chris Haddad
 
The Architecture of Continuous Innovation - OSCON 2015
Chip Childers
 
Containers - Transforming the data centre as we know it 2016
Keith Lynch
 
Intro - Cloud Native
Albert Suwandhi
 
Transform Digital Business with DevOps
Daniel Oh
 
The Container Evolution of a Global Fortune 500 Company with Docker EE
Docker, Inc.
 
Containers and microservices for realists
Karthik Gaekwad
 
DCSF 19 How Entergy is Mitigating Legacy Windows Operating System Vulnerabili...
Docker, Inc.
 
Ad

Viewers also liked (20)

PPTX
2014, April 15, Atlanta Java Users Group
Todd Fritz
 
PPTX
Building Reactive Fast Data & the Data Lake with Akka, Kafka, Spark
Todd Fritz
 
PPTX
Reactive Fast Data & the Data Lake with Akka, Kafka, Spark
Todd Fritz
 
PPTX
The Agile Roots of Microservices
Matt McLarty
 
PPTX
Service Orchestrierung mit Apache Mesos
Ralf Ernst
 
PDF
How to Build Cloud-based Microservice Environments with Docker and VoltDB
VoltDB
 
PPT
TransitioningToMicroServonDocker_MS
Lana Kalashnyk
 
PDF
MicroService and MicroContainer with Apache Camel
Charles Moulliard
 
PPTX
building microservices
Cisco DevNet
 
PDF
Introduction to Docker and Linux Containers @ Cloud Computing Rhein Main
Puja Abbassi
 
PPT
Operating Guidelines for Finite-State Services
Universität Rostock
 
PDF
Dockerize node.js application
Seokjun Kim
 
PDF
Import golang; struct microservice - Codemotion Rome 2015
Giorgio Cefaro
 
PDF
CQRS and EventSourcing
DevOWL Meetup
 
PDF
A Pattern Language for Microservices (@futurestack)
Chris Richardson
 
PDF
Что такое современная Frontend разработка
DevOWL Meetup
 
PDF
Full lifecycle of a microservice
Luigi Bennardis
 
PDF
Microservices architecture examples
Channy Yun
 
ODP
BDD with Cucumber
Knoldus Inc.
 
PDF
Akka: Simpler Scalability, Fault-Tolerance, Concurrency & Remoting through Ac...
Jonas Bonér
 
2014, April 15, Atlanta Java Users Group
Todd Fritz
 
Building Reactive Fast Data & the Data Lake with Akka, Kafka, Spark
Todd Fritz
 
Reactive Fast Data & the Data Lake with Akka, Kafka, Spark
Todd Fritz
 
The Agile Roots of Microservices
Matt McLarty
 
Service Orchestrierung mit Apache Mesos
Ralf Ernst
 
How to Build Cloud-based Microservice Environments with Docker and VoltDB
VoltDB
 
TransitioningToMicroServonDocker_MS
Lana Kalashnyk
 
MicroService and MicroContainer with Apache Camel
Charles Moulliard
 
building microservices
Cisco DevNet
 
Introduction to Docker and Linux Containers @ Cloud Computing Rhein Main
Puja Abbassi
 
Operating Guidelines for Finite-State Services
Universität Rostock
 
Dockerize node.js application
Seokjun Kim
 
Import golang; struct microservice - Codemotion Rome 2015
Giorgio Cefaro
 
CQRS and EventSourcing
DevOWL Meetup
 
A Pattern Language for Microservices (@futurestack)
Chris Richardson
 
Что такое современная Frontend разработка
DevOWL Meetup
 
Full lifecycle of a microservice
Luigi Bennardis
 
Microservices architecture examples
Channy Yun
 
BDD with Cucumber
Knoldus Inc.
 
Akka: Simpler Scalability, Fault-Tolerance, Concurrency & Remoting through Ac...
Jonas Bonér
 
Ad

Similar to 2015 03-11_todd-fritz_devnexus_2015 (20)

PPTX
Intro to Docker November 2013
Docker, Inc.
 
PPTX
Docker intro
spiddy
 
PPTX
Docker introduction
dotCloud
 
PDF
Powering Microservices with Docker
Cognizant
 
PPTX
Containerization
Suryadeep Chatterjee
 
PPTX
ma-formation-en-Docker-jlklk,nknkjn.pptx
imenhamada17
 
PPTX
Intro to Docker October 2013
Docker, Inc.
 
PPTX
The challenge of application distribution - Introduction to Docker (2014 dec ...
Sébastien Portebois
 
PDF
Whales, Clouds, and Bubbles...?
Mary Anthony
 
PDF
Containers, Docker, and Microservices: the Terrific Trio
Jérôme Petazzoni
 
PPTX
Intro Docker october 2013
dotCloud
 
PDF
Docker handons-workshop-for-charity
Yusuf Hadiwinata Sutandar
 
PDF
Docker-v3.pdf
Bruno Cornec
 
PDF
Docker in Production: How RightScale Delivers Cloud Applications
RightScale
 
PPTX
Developer workflow with docker
Wyn B. Van Devanter
 
PDF
Accelerate your software development with Docker
Andrey Hristov
 
PPTX
Accelerate your development with Docker
Andrey Hristov
 
PDF
Introduction to Docker
Aditya Konarde
 
PPTX
Abc of docker
shohan_slideshare
 
PDF
A to Z of Docker
Swapnil Jain
 
Intro to Docker November 2013
Docker, Inc.
 
Docker intro
spiddy
 
Docker introduction
dotCloud
 
Powering Microservices with Docker
Cognizant
 
Containerization
Suryadeep Chatterjee
 
ma-formation-en-Docker-jlklk,nknkjn.pptx
imenhamada17
 
Intro to Docker October 2013
Docker, Inc.
 
The challenge of application distribution - Introduction to Docker (2014 dec ...
Sébastien Portebois
 
Whales, Clouds, and Bubbles...?
Mary Anthony
 
Containers, Docker, and Microservices: the Terrific Trio
Jérôme Petazzoni
 
Intro Docker october 2013
dotCloud
 
Docker handons-workshop-for-charity
Yusuf Hadiwinata Sutandar
 
Docker-v3.pdf
Bruno Cornec
 
Docker in Production: How RightScale Delivers Cloud Applications
RightScale
 
Developer workflow with docker
Wyn B. Van Devanter
 
Accelerate your software development with Docker
Andrey Hristov
 
Accelerate your development with Docker
Andrey Hristov
 
Introduction to Docker
Aditya Konarde
 
Abc of docker
shohan_slideshare
 
A to Z of Docker
Swapnil Jain
 

Recently uploaded (20)

PPTX
ai tools demonstartion for schools and inter college
harshavardhanreddyka11
 
PDF
System and Network Administraation Chapter 3
jaramharo
 
PDF
medical staffing services at VALiNTRY
Tiyan Grayson
 
PPTX
L1 - Introduction to python Backend.pptx
MoizAhmed480282
 
PDF
Design an Analysis of Algorithms II-SECS-1021-03
DilanEscobar1
 
PPT
Introduction Database Management System for Course Database
ReinertYosua
 
PPTX
ManageIQ - Sprint 268 Review - Slide Deck
ManageIQ
 
PDF
SAP S4 Hana Brochure 3 (PTS SYSTEMS AND SOLUTIONS)
pts464036
 
PDF
Adobe Illustrator 28.6 Crack My Vision of Vector Design
ghrom2211g
 
PPTX
Oracle E-Business Suite: A Comprehensive Guide for Modern Enterprises
Conacent Consulting
 
PDF
Audit Checklist Design Aligning with ISO, IATF, and Industry Standards — Omne...
rohnjim07
 
PDF
2025 Textile ERP Trends: SAP, Odoo & Oracle
Aetos Technologies
 
PPTX
Odoo POS Development Services by CandidRoot Solutions
CandidRoot Solutions Private Limited
 
PDF
System and Network Administration Chapter 2
jaramharo
 
PPTX
Transform Your Business with a Software ERP System
Canada Software Company
 
PPTX
Lecture 3: Operating Systems Introduction to Computer Hardware Systems
hci7se
 
PPTX
CHAPTER 2 - PM Management and IT Context
KevinPutra14
 
PDF
Nekopoi APK 2025 free lastest update
umarali35kp
 
PPTX
Agentic AI : A Practical Guide. Undersating, Implementing and Scaling Autono...
IT IDOL Technologies
 
PDF
Design an Analysis of Algorithms I-SECS-1021-03
DilanEscobar1
 
ai tools demonstartion for schools and inter college
harshavardhanreddyka11
 
System and Network Administraation Chapter 3
jaramharo
 
medical staffing services at VALiNTRY
Tiyan Grayson
 
L1 - Introduction to python Backend.pptx
MoizAhmed480282
 
Design an Analysis of Algorithms II-SECS-1021-03
DilanEscobar1
 
Introduction Database Management System for Course Database
ReinertYosua
 
ManageIQ - Sprint 268 Review - Slide Deck
ManageIQ
 
SAP S4 Hana Brochure 3 (PTS SYSTEMS AND SOLUTIONS)
pts464036
 
Adobe Illustrator 28.6 Crack My Vision of Vector Design
ghrom2211g
 
Oracle E-Business Suite: A Comprehensive Guide for Modern Enterprises
Conacent Consulting
 
Audit Checklist Design Aligning with ISO, IATF, and Industry Standards — Omne...
rohnjim07
 
2025 Textile ERP Trends: SAP, Odoo & Oracle
Aetos Technologies
 
Odoo POS Development Services by CandidRoot Solutions
CandidRoot Solutions Private Limited
 
System and Network Administration Chapter 2
jaramharo
 
Transform Your Business with a Software ERP System
Canada Software Company
 
Lecture 3: Operating Systems Introduction to Computer Hardware Systems
hci7se
 
CHAPTER 2 - PM Management and IT Context
KevinPutra14
 
Nekopoi APK 2025 free lastest update
umarali35kp
 
Agentic AI : A Practical Guide. Undersating, Implementing and Scaling Autono...
IT IDOL Technologies
 
Design an Analysis of Algorithms I-SECS-1021-03
DilanEscobar1
 

2015 03-11_todd-fritz_devnexus_2015

  • 1. Docker Containerizing a Monolithic Application into a Microservice-based PaaS Todd Fritz March 11, 2015
  • 3. License: CC BY-SA 3.0 Agenda MARCH 11, 2015 2 1. Why Containers? 2. Business Value 3. Adoption 4. Docker Basics 5. Orchestration Toolkit 6. Decompose the Monolith 7. Microservices 8. API Gateway 9. Service Discovery 10.Security & Networking 11.Putting it Together 12.Questions?
  • 4. License: CC BY-SA 3.0MARCH 11, 2015 3 • Senior Software Architect @ Altisource Labs • The opinions contained herein may not represent my employer, but I believe they should. • Platform Development, Middleware, MoM, EIP, EDA, etc • Deployment perspective • Exposed to many environments, technologies, people • Life-long learner and always curious • Novice bass player • Scuba diver - next adventure • https://www.bikiniatoll.com/divetour.html About Me
  • 5. License: CC BY-SA 3.0MARCH 11, 2015 4 DevNexus 2015 (today!) http://www.slideshare.net/ToddFritz/2015-03- 11_Todd_Fritz_Devnexus_2015 Great Wide Open - Atlanta (April 3, 2014) http://www.slideshare.net/ToddFritz/2014-04-03legacytocloud AJUG (April 15, 2014) http://www.slideshare.net/ToddFritz/2014-april-15-atlanta-java- users-group Video - https://vimeo.com/94556976 Presentations
  • 6. License: CC BY-SA 3.0MARCH 11, 2015 5 Why Containers?
  • 7. License: CC BY-SA 3.0 Why Containers? MARCH 11, 2015 6 • Familiarity with Docker helpful • Not Cargo Cult Programming (pun intended) • Streamline development and testing • Portable and predictable across environments • Composable and dynamic • Ideal for Microservices • Deployment • Scaling • Clocker, Apache Brooklyn, RancherOS
  • 8. License: CC BY-SA 3.0MARCH 11, 2015 7 • More disruptive to cloud providers who have defined their own cloud deployment architectures • Does a heavy O/S get in the way? • Docker fever! Rapid innovation during past year! • Red Hat – early adopters • IBM – Q4 2014 - Enterprise Hosting for Docker • Microsoft - Q4 2014 - Azure • Amazon – Q4 2014 • Digital Ocean, Joynet • Need for more standards • Blueprints, e.g. Apache Brooklyn Why Containers?
  • 9. License: CC BY-SA 3.0MARCH 11, 2015 8 Ancestry? • Jailing / BSD • Solaris Zones / Containers have been around for a long time Why Containers?
  • 10. License: CC BY-SA 3.0MARCH 11, 2015 9 Thought: a paradigm shift for the O/S? • Redefines “Kernel Space”? CoreOS, RancherOS • Redefines “User Space”? • Better fit for distributed computing Why Containers? http://www.ibm.com/developerworks/library/l-linux-kernel/
  • 11. License: CC BY-SA 3.0MARCH 11, 2015 10 Business Value
  • 12. License: CC BY-SA 3.0 Business value MARCH 11, 2015 11 • xPaaS • Decoupled, separated concerns, vendor specialization https://img.en25.com/Web/RedHat/JB_xPaaS_Tech_Overview_11454037_v3_0913cd_web.pdf
  • 13. License: CC BY-SA 3.0 Business Value MARCH 11, 2015 12 • Necessary? “If it ain’t broke, don’t fix it.” • Simplifies deployment, management, administration • Enhances Architecture, Developers, Dev Ops • Speed to market with scale-up • Replaces sandboxing with containers • Reduces cost • Portable and predictable • Streamline development, QA • Scales via configuration • Emerging technologies for autonomic self- management
  • 14. License: CC BY-SA 3.0 Business Value MARCH 11, 2015 13 Containers enable the “Intelligent Cloud”? • Container is basic unit • Self-scaling • Self-managing; platform intelligence reduces TCO • Self-healing • Containers/apps expose metrics and events (security) • Container manager collects metrics • Machine learning interprets metrics to identify stimuli • Platform reacts to interpreted stimuli (OPS, security)
  • 15. License: CC BY-SA 3.0MARCH 11, 2015 14 Adoption
  • 16. License: CC BY-SA 3.0MARCH 11, 2015 15 Whale you be my container? Adoption
  • 17. License: CC BY-SA 3.0 Adoption MARCH 11, 2015 16 Adoption cycle graphic © 2012 Simon Wardley and CC BY-SA 3.0 “#@$%!
  • 18. License: CC BY-SA 3.0 Adoption - Obstacles MARCH 11, 2015 17 Management • Need right skills and people to pull it off • Heard it is complex with perceived security flaws • Lack of in-house technical expertise, schedule, time • Learning curve, fear of change, unable to quantify risk • How to justify the expense? Developers, QA, DevOps • Learning curve • Need for direction and guidance • Know-it-alls or superficial, tangential decision making Architects and Technical Leadership • Learning curve • Executive sponsorship
  • 19. License: CC BY-SA 3.0MARCH 11, 2015 18 Architects • Begins with a knowledgeable evangelist • Sell to developers and articulate technical / business benefits • Involve DevOps – “Not a Chef replacement” • Mentor growth of in-house expertise Developers / QA • Evangelize benefits to team, generate excitement, spike it • Obtain buy in, get team to sell up the chain • Try it out, be curious do a PoC! Management • Evangelize to forward-thinkers who “get it” • Sell ROI, speed to market, benefits of good architecture • Reduces TCO of engineering and operations Adoption - Overcoming Obstacles
  • 20. License: CC BY-SA 3.0MARCH 11, 2015 19 Docker Basics
  • 21. License: CC BY-SA 3.0MARCH 11, 2015 20 • Open-source • Easier scalability • Lightweight, portable, insulated containers • Reuse from dev (“local cloud”) through production • Can run at scale on VMs, bare metal, cloud • Encapsulate any payload - application • Run consistently including hybrid environments • PaaS enabler • Replaces sandboxing Docker Basics
  • 22. License: CC BY-SA 3.0MARCH 11, 2015 21 • What is Docker? • “(…) an open platform (…) to build, ship, and run distributed applications.” • Docker Engine • “Portable, lightweight, runtime and packaging tool.” • Docker Hub Registry • “Cloud service for sharing applications and automation workflows.” Docker Basics https://www.docker.com/whatisdocker/
  • 23. License: CC BY-SA 3.0MARCH 11, 2015 22 • Docker Image • Configured Snapshot of server or service. • Can be extended • Docker Container • Docker images run within the container • DockerFile • Instructions/commands that create image Docker Basics
  • 24. License: CC BY-SA 3.0MARCH 11, 2015 23 • Used to build containers by scripting creation actions of image layers • Less powerful than traditional configuration management software • Example • In discrete steps, instruct Docker to build an image by taking a default Ubuntu distro, apt-get install dependencies, and then add the application. • Each Dockerfile command creates a new image layer, and clever structuring of the commands enables reuse Docker Basics – Dockerfiles
  • 25. License: CC BY-SA 3.0 VM MARCH 11, 2015 24 http://www.slideshare.net/dotCloud/docker-intro-november
  • 26. License: CC BY-SA 3.0MARCH 11, 2015 25 • Automates app deployment within containers • Originally based on Linux Containers (LXC) via an API to expose lightweight virtualization that: • Process isolation • Utilizes LXC, cgroups, and the kernel • Does not include a separate operating system • Kernel provides resource isolation • CPU, memory, block I/O, network • Now have libcontainer (native Go) – replaces use of LXC • Interface between user space and kernel • Works well with Chef, Puppet, Vagrant • Dynamic provisioning – ideal for PaaS Docker Basics – How, What, Why
  • 27. License: CC BY-SA 3.0MARCH 11, 2015 26 • Container is the basic building block • Analogous to a slice of a VM image, containing application code or binaries, as well as the execution environment and dependencies • Images may be built atop each other • An image contains only the incremental changes required to transform its base image to the state required by the image • May contain metadata, such as how to run what is inside the image, expose ports, etc • Acts as an instantiable container template Docker Basics
  • 28. License: CC BY-SA 3.0MARCH 11, 2015 27 Docker Basics http://www.slideshare.net/dotCloud/docker-intro-november
  • 29. License: CC BY-SA 3.0MARCH 11, 2015 28 • Intra-container communication via sockets (Docker links). Containers can talk to each other. • Familiar lifecycle: started, stopped, or kill • Can create images from previously run containers, to persist changes made while container was executing Docker Basics
  • 30. License: CC BY-SA 3.0MARCH 11, 2015 29 • Docker has three parts • docker daemon runs as root to manage containers • docker containers spawn from images, which are tiny and can be versioned • docker repository allows images to be exchanged and versioned like code (public or private) • Each container has a unique IP address • Port and pipework to expose containers outside host • Share volumes, multi home, integrate containers into host network (and more) • Continuous integration can generate versioned docker images, web hooks, repo notifications Docker Basics
  • 31. License: CC BY-SA 3.0MARCH 11, 2015 30 • Common use cases • Automate application packaging and deployment • Lightweight PaaS environments • Automate testing, continuous integration, and deployment • Deploy and scale web apps, databases, backend services Docker Basics
  • 32. License: CC BY-SA 3.0MARCH 11, 2015 31 Docker Basics http://www.slideshare.net/dotCloud/docker-intro-november
  • 33. License: CC BY-SA 3.0MARCH 11, 2015 32 • Docker sold DotCloud PaaS to cloudControl • Not opinionated • Deis, Flynn • (Both provide scaffolding to support distributed, containerized, service implementations) • Opinionated • CloudFoundry, OpenShift, Apcera Continuum • Integrates Docker into their systems • CoreOS, RancherOS Docker Basics – PaaS Frameworks
  • 34. License: CC BY-SA 3.0MARCH 11, 2015 33 Docker Basics - CoreOS • CoreOS uses fleet to run containers with systemd https://coreos.com/using-coreos/
  • 35. License: CC BY-SA 3.0MARCH 11, 2015 34 • A “System Docker” as PID1 manages “User Dockers” • Separate Docker daemon runs in User Docker container Docker Basics - RancherOS http://rancher.com/rancher-os/
  • 36. License: CC BY-SA 3.0MARCH 11, 2015 35 Orchestration Toolkit
  • 37. License: CC BY-SA 3.0MARCH 11, 2015 36 • Portability across environments, providers • Composable • New technologies (beta), not production ready 1. Docker Machine 2. Docker Swarm 3. Docker Compose (based on fig) • http://www.infoq.com/news/2015/03/docker-machine-swarm-compose • Micro Virtualization to follow? Orchestration Toolkit http://thenewstack.io/orchestration-toolkit-release-aims-prove-dockers-commitment-flexibility-community-ecosystem/
  • 38. License: CC BY-SA 3.0MARCH 11, 2015 37 Docker Machine • (Separate project from Docker Engine) • Abstraction used to provision to different environments • Support for 12 environment providers • Virtualbox (local) • Digital Ocean, AWS, Azure, Vmware, and more • Hybrid environments • https://github.com/docker/machine % machine create -d [infrastructure provider] [provider options] [machine name] Orchestration Toolkit – Docker Machine http://blog.docker.com/2014/12/announcing-docker-machine-swarm-and-compose-for-orchestrating-distributed-apps/
  • 39. License: CC BY-SA 3.0MARCH 11, 2015 38 • Native clustering • A pool of Docker hosts exposed as a single, virtual host • Schedule containers to run atop • Automatic workload management • Uses standard Docker API • Any tool using docker daemon can Swarm transparently • Dokku, Compose, Krane, Flynn, Desi, DockerUI, Shipyard, Jenkins • Docker client • H/A and Failover • Swarm performs health checks with auto- rebalancing Orchestration Toolkit – Docker Swarm
  • 40. License: CC BY-SA 3.0MARCH 11, 2015 39 • Scheduling algorithm • Standard filters • Constraint (storage=ssd, storage=disk, etc) • storagedriver, executiondriver, kernelversion, operatingsystem • Affinity • Certain containers may perform better on same host • “Locality of Reference” • Port • Health • Even Azure cloud computing platform supports it • http://www.eweek.com/cloud/docker-swarms-onto-microsofts-cloud.htm Orchestration Toolkit – Docker Swarm
  • 41. License: CC BY-SA 3.0MARCH 11, 2015 40 • Undergoing development • Adding feature to reschedule container on failed host Orchestration Toolkit – Docker Swarm
  • 42. License: CC BY-SA 3.0MARCH 11, 2015 41 Orchestration Toolkit – Docker Swarm # create a cluster $ docker run --rm swarm create 6856663cdefdec325839a4b7e1de38e8 # <- this is your unique <cluster_id> # on each of your nodes, start the swarm agent # <node_ip> doesn't have to be public (e.g. 192.168.0.X), # as long as the swarm manager can access it. $ docker run -d swarm join --addr=<node_ip:2375> token://<cluster_id> # start the manager on any machine or your laptop $ docker run -d -p <swarm_port>:2375 swarm manage token://<cluster_id> # use the regular docker cli $ docker -H tcp://<swarm_ip:swarm_port> info $ docker -H tcp://<swarm_ip:swarm_port> run ... $ docker -H tcp://<swarm_ip:swarm_port> ps $ docker -H tcp://<swarm_ip:swarm_port> logs ... ... # list nodes in your cluster $ docker run --rm swarm list token://<cluster_id> <node_ip:2375>
  • 43. License: CC BY-SA 3.0MARCH 11, 2015 42 • Final piece of orchestration puzzle • After provisioning with Machine • After defining clustering with Swarm • Based on Fig • Define application components within one file • Containers, container configuration, links, volumes • Assemble multi-container distributed apps to run atop Swarm-managed clusters • Simple YAML configuration • https://github.com/docker/docker/issues/9694 Orchestration Toolkit – Docker Compose
  • 44. License: CC BY-SA 3.0MARCH 11, 2015 43 • Commands to manage lifecycle: start, stop, rebuild • Obtain status of running services or view logs • On Roadmap: • Support for test, staging, production environments • Integration with Swarm • Support for multi-team and multi-registry development • Improved container build automation (e.g. auto C.I.) • https://github.com/docker/compose/blob/master/ROADMAP.md#applicat ions-spanning-multiple-teams Orchestration Toolkit – Docker Compose
  • 45. License: CC BY-SA 3.0MARCH 11, 2015 44 containers: web: build: . command: python app.py ports: - "5000:5000" volumes: - .:/code links: - redis environment: - PYTHONUNBUFFERED=1 redis: image: redis:latest command: redis-server --appendonly yes Orchestration Toolkit – Docker Compose
  • 46. License: CC BY-SA 3.0MARCH 11, 2015 45 Schedulers are responsible for starting containers on available hosts. Orchestration Toolkit - Schedulers https://www.digitalocean.com/community/tutorials/the-docker-ecosystem-an-introduction-to-common- components
  • 47. License: CC BY-SA 3.0MARCH 11, 2015 46 Options • Fleet • Marathon • Swarm • Kubernetes • Compose Orchestration Toolkit - Schedulers
  • 48. License: CC BY-SA 3.0MARCH 11, 2015 47 Decompose the Monolith
  • 49. License: CC BY-SA 3.0MARCH 11, 2015 48 • So, you have a monolithic app that needs to be modernized… For whatever reason. • How to rebuild it? (insert: Six Million Dollar Man ref.) Decompose the Monolith
  • 50. License: CC BY-SA 3.0 Decompose the Monolith MARCH 11, 2015 49 • No smoking in the Emergency Room! • System Analysis • Use an iterative methodology • Leverage existing knowledge and literature • Some analysis before • Decompose and modularize (scale cube) • Separation of concerns • Proof of concepts are your friend
  • 51. License: CC BY-SA 3.0MARCH 11, 2015 50 A simple metaphor to follow (Please do not leave) Decompose the Monolith
  • 52. License: CC BY-SA 3.0 Decompose the Monolith MARCH 11, 2015 51 I’m a proud stovepipe, just bolted together, vroom vroom vroom vroom vroom.
  • 53. License: CC BY-SA 3.0 Decompose the Monolith MARCH 11, 2015 52 Oh, nooo... My job security...
  • 54. License: CC BY-SA 3.0 Decompose the Monolith MARCH 11, 2015 53 I now have free nights and weekends...
  • 55. License: CC BY-SA 3.0MARCH 11, 2015 54 “Bounded Context” from Domain-Driven Design • Identify discrete business capabilities (“Functions”) • Functions govern part of enterprise data model • A Microservice implements a Function • Microservices encapsulate data access via API (REST) • Data store per microservice (no sharing) • Overlap managed by higher-order microservices or hypermedia • Functions may share – e.g. “Addresses” Also consider the “Scale Cube” • http://microservices.io/articles/scalecube.html Decompose the Monolith - Technique
  • 56. License: CC BY-SA 3.0MARCH 11, 2015 55 Microservices
  • 57. License: CC BY-SA 3.0MARCH 11, 2015 56 Why? • Good fit for containers • Ideal for distributed computing • Correct implementation is hard • A warning • http://highscalability.com/blog/2014/4/8/microservices-not-a-free-lunch.html The ESB from yesterday does not fit • https://www.voxxed.com/blog/2015/01/good-microservices- architectures-death-enterprise-service-bus-part-one/ • Once upon a time, Enterprise Application Integration (EAI) • SOA emerges, vendors rebrand EAI offerings as ESBs • Old ESBs were centralized  new ESBs decentralized Microservices
  • 58. License: CC BY-SA 3.0 • Various definitions (sometimes a “Holy War”) • Why Microservices? • Because building monoliths is so 2005… • What runs in the container, matters • http://microservices.io/patterns/microservices.html • Architecture for delivery of systems as a set of services • Small • Collaborating • Independent Microservices MARCH 11, 2015 57
  • 59. License: CC BY-SA 3.0MARCH 11, 2015 58 Single Responsibility Principle (SRP) • “One reason to change” Open-Closed Principle (OCP) • Open for Extension, closed for modification • Swappable implementations behind API, Polyglot persistence Liskov Substitution Principle (LSP) • Implementation honors API contract Interface Segregation Principle (ISP) • Clients should not be forced to implement unused methods • “Fat Interfaces” Dependency Inversion Principle (DIP) • Abstractions should not depend upon details. API GATEWAY. Microservices – tenets – SOLID
  • 60. License: CC BY-SA 3.0MARCH 11, 2015 59 • Familiar concept? SOA without the ESB? • Simple services, focused on doing one thing (well) • Loose coupling • Facilitates parallel development; multiple teams • Easier to test • Enables C.I. / C.D. • Decouple technology and tooling from service • Use what you want to implement (polyglot) Microservices – Advantages
  • 61. License: CC BY-SA 3.0MARCH 11, 2015 60 • Complexity of distributed system • Operationalization overhead • Each service needs load balancing, monitoring, • Testing distributed systems is hard • Deployment complexity; DevOps skill • Implicit Interfaces between collaborating components • Backwards compatibility quicksand • Some duplication of effort Microservices – Disadvantages http://highscalability.com/blog/2014/4/8/microservices-not-a-free-lunch.html
  • 62. License: CC BY-SA 3.0MARCH 11, 2015 61 • Separate data store per microservice • Similar level of code maturity • Separate build, CI per microservice • Containerize! • Stateless! Microservices – Best Practices http://nginx.com/blog/microservices-at-netflix-architectural-best-practices/
  • 63. License: CC BY-SA 3.0MARCH 11, 2015 62 Google gRPC • http://www.infoq.com/news/2015/02/grpc Microservices
  • 64. License: CC BY-SA 3.0MARCH 11, 2015 63 API Gateway
  • 65. License: CC BY-SA 3.0MARCH 11, 2015 64 Two peas in a pod • API Gateway & Microservice Architecture API Gateway acts as single point of entry into Microservice architecture for a client • Serve different types of clients • Protocol Translation, etc (EIP – Camel) • http://techblog.netflix.com/2013/01/optimizing-netflix- api.html Handles requests in two ways • Proxy/routing to service • Fan-out to multiple services API Gateway
  • 66. License: CC BY-SA 3.0MARCH 11, 2015 65 Benefits • Decouples clients from services • Improves client’s API experience • Abstract logic for orchestrated services into gateway • Reduces request/response round trips Disadvantages • More complex • Possible increase in latency (network hop through gateway) API Gateway http://microservices.io/patterns/apigateway.html
  • 67. License: CC BY-SA 3.0MARCH 11, 2015 66 API Gateway http://microservices.io/patterns/apigateway.html
  • 68. License: CC BY-SA 3.0MARCH 11, 2015 67 • Dynamic Polyglot Runtime • Fully Synch Service Layer • Reactive Programing Model API Gateway – At Netflix http://techblog.netflix.com/2013/01/optimizing-netflix-api.html
  • 69. License: CC BY-SA 3.0MARCH 11, 2015 68 Service Discovery
  • 70. License: CC BY-SA 3.0 Service Discovery MARCH 11, 2015 69 • Service Discovery requires a Service Registry • Apps need need to register exposed services • Clients lookup, bind, invoke • Applications then query discovery service for how to connect to an application • Responsibilities 1. Provide clients with metadata to connect to service 2. Allow applications to register to provide #1 3. Expose global location to start arbitrary configuration 4. Store metadata about cluster members
  • 71. License: CC BY-SA 3.0MARCH 11, 2015 70 Service Discovery https://www.digitalocean.com/community/tutorials/the-docker-ecosystem-an-introduction-to-common- components
  • 72. License: CC BY-SA 3.0MARCH 11, 2015 71 Popular service discovery tools • Etcd • Created by CoreOS. HTTP API and a CLI. • Consul • “Advanced features”: health checks, ACL, HAProxy config • Zookeeper • Older and lacks new features, but more stable and mature Service Discovery
  • 73. License: CC BY-SA 3.0MARCH 11, 2015 72 Value adds • Crypt • Components can use keys to protect information • Clients can read if they have decryption key • Confd • Dynamic reconfiguration of apps • Vulcand • Load balancer. “Etcd aware” • Marathon • Scheduler and basic HAProxy config management • Nerve • Used with Synapse for health checks and auto cluster mgmt Service Discovery
  • 74. License: CC BY-SA 3.0MARCH 11, 2015 73 Alternatives to Asynch? • Why deal with the heaviness? Lightweight threads and Actors for JVM • Quasar • https://github.com/puniverse/quasar • Lightweight threads, Go-like channels, Erlang like actors, etc • COMSAT • https://github.com/puniverse/comsat • Scalable, concurrent web-apps • Not Web Framework • Implementations to popular (and standard) APIs, including JAX-RS, JDBC, Servlet, etc – that are called with Quasar fibers Service Discovery – Fibers > Asynch? https://www.voxxed.com/blog/2015/02/farewell-to-asynchronous-code/
  • 75. License: CC BY-SA 3.0MARCH 11, 2015 74 Service Discovery – Clay.io example http://zolmeister.com/2015/02/10x-service-discovery-at-clay-io.html http://zolmeister.com/2014/12/10x-docker-at-clay-io.html
  • 76. License: CC BY-SA 3.0MARCH 11, 2015 75 Security and Networking
  • 77. License: CC BY-SA 3.0MARCH 11, 2015 76 • Very hot topic • Ongoing investment and innovation • Docker adds security experts to team • Announced last week • Docker acquires SocketPlane • Announced last week • 3 months from startup to acquisition? A record? • Native to Docker • Software defined network services • For distributed applications that span hybrid clouds • http://www.programmableweb.com/news/docker-extends-api-reach- socketplane-acquisition/2015/03/05 Security and Networking
  • 78. License: CC BY-SA 3.0 Security and Networking MARCH 11, 2015 77 • Swarm • TLS AuthN between CLI and Swarm • TLS between Swarm and Docker nodes • Containers weaker than VM for isolation • VM’s can use ring-1 hardware isolation • Prevents VM’s from “breaking out” • Containers lack hardware isolation • “Shocker” attack (for pre 1.0 Docker containers) • Running atop hypervisor enhances resource isolation but does not necessarily make this more secure • Container in VM reduces surface area for attacks • Don’t do stupid stuff in container, follow best practices
  • 79. License: CC BY-SA 3.0MARCH 11, 2015 78 “When we feel comfortable saying that Docker out-of-the-box can safely contain untrusted uid0 programs, we will say so clearly” - Docker CTO Solomon Hykes Security and Networking
  • 80. License: CC BY-SA 3.0MARCH 11, 2015 79 • Networking capabilities somewhat limited • libchan is officially sponsored approach • Go like channels over network • Flocker • Proxy based approach • Host-portable services (including underlying storage) • Weave • Powerstrip • Use Weave and Flocker together • Run a Crate cluster using Weave’s container networking and portable storage provided by Security and Networking
  • 81. License: CC BY-SA 3.0MARCH 11, 2015 80 • OpenVswitch • https://github.com/openvswitch/ovs • Multilayer software switch (VM environments) • Standard control and visibility interfaces • Designed for distribution across multiple servers • Security companies not yet offering container endpoint protection • Lack of tools for encryption at container level • Lacks live migration tools Security and Networking
  • 82. License: CC BY-SA 3.0MARCH 11, 2015 81 Putting it Together
  • 83. License: CC BY-SA 3.0MARCH 11, 2015 82 “Without Paas, Docker is just a bunch of containers.” • http://www.zdnet.com/article/paas-and-docker/ • Needs supporting technologies Gaps • Underserved: networking, storage, granular versioning Apache Mesos for simpler clustering? • http://www.zdnet.com/article/why-amazons-docker-service-is-linking- into-apache-mesos-for-simpler-clustering/ Putting it Together
  • 84. License: CC BY-SA 3.0MARCH 11, 2015 83 • How to put a solution together? • Clocker (from Cloudsoft) • Create Docker clouds orchestrated by Apache Brooklyn • Single to multi host • Intelligent container placement: resilience, scaling, fault tolerance, resource optimization • Existing Brooklyn/CAMP blueprints port without change • Apache Brooklyn • jClouds API (cloud API agnostic) for provision • Monitors and manages containers • Configuration blueprints that use docker infrastructure • Uses Dockerfiles Putting it all Together http://thenewstack.io/an-open-source-story-clocker-does-what-docker-cant-do-alone/
  • 85. License: CC BY-SA 3.0MARCH 11, 2015 84 Putting it Together
  • 86. License: CC BY-SA 3.0APRIL 2014 85 http://www.appneta.com/blog/automated-testing-with-docker/ Putting it Together
  • 87. License: CC BY-SA 3.0MARCH 11, 2015 86 • Not part of this presentation • Worth reading • Apache Samza http://blog.confluent.io/2015/03/04/turning-the-database-inside-out-with-apache- samza/ Putting it Together
  • 88. License: CC BY-SA 3.0MARCH 11, 2015 87 Appendix
  • 89. License: CC BY-SA 3.0MARCH 11, 2015 88 Hardware • “Quantum” processors – Qbits • Input, Output, Memory, CPU, Network Software • Machine Learning, Artificial Intelligence • Autonomous systems • Self-Tuning -> Self-Improving -> Self-Coding Manufacturing • 3D printing • A.I. managed hardware provisioning and “data center” construction”. On-premise construction? Within 50 years, the Singularity? Trends & Innovation
  • 90. License: CC BY-SA 3.0MARCH 11, 2015 89 Questions?
  • 91. License: CC BY-SA 3.0MARCH 11, 2015 90 • http://highscalability.com/blog/2014/4/8/microservices-not-a-free-lunch.html • https://medium.com/aws-activate-startup-blog/using-containers-to-build-a-microservices-architecture- 6e1b8bacb7d1 • http://codesamplez.com/web-server/dockerize-an-application-from-scratch • http://blog.docker.com/2014/12/announcing-docker-machine-swarm-and-compose-for-orchestrating- distributed-apps/ • http://www.infoq.com/articles/docker-future • https://crate.io/blog/crate-flocker-weave-powerstrip-snowsprint/ • https://coreos.com/using-coreos/ • http://rancher.com/announcing-rancher-io-portable-infrastructure-services-for-docker/ • http://nginx.com/blog/microservices-at-netflix-architectural-best-practices/ • http://zolmeister.com/2015/02/10x-service-discovery-at-clay-io.html • http://zolmeister.com/2014/10/10x-architecture-at-clay-io.html • http://zolmeister.com/2014/10/10x-logging-at-clay-io.html Resources