![$ docker plugin install tiborvass/no-remove
Plugin "mikegoelzer/myplugin:latest"
requested the following privileges:
- Networking: host
- Mounting host path: /data
Do you grant the above permissions? [y/N]
Plugin Permissions Model](https://image.slidesharecdn.com/whatsnewindocker1-160621030446/85/What-s-New-in-Docker-1-12-June-20-2016-by-Mike-Goelzer-Andrea-Luzzardi-26-320.jpg)
What's New in Docker 1.12 (June 20, 2016) by Mike Goelzer & Andrea Luzzardi
- 1. What’s New in Docker 1.12 Mike Goelzer (Spoiler alert: a lot!)
- 2. $ docker swarm init
- 3. $ docker swarm init $ docker swarm join <IP of manager>:2377
- 4. $ docker swarm init $ docker swarm join <IP of manager>:2377
- 5. $ docker service create --replicas 3 --name frontend --network mynet --publish 80:80/tcp frontend_image:latest mynet
- 6. $ docker service create --replicas 3 --name frontend --network mynet --publish 80:80/tcp frontend_image:latest $ docker service create --name redis --network mynet redis:latest mynet
- 7. $ docker service create --replicas 3 --name frontend --network mynet --publish 80:80/tcp frontend_image:latest $ docker service create --name redis --network mynet redis:latest mynet
- 8. $ docker service create --replicas 3 --name frontend --network mynet --publish 80:80/tcp frontend_image:latest $ docker service create --name redis --network mynet redis:latest mynet
- 9. ≠ $ docker service create --replicas 3 --name frontend --network mynet --publish 80:80/tcp frontend_image:latest $ docker service create --name redis --network mynet redis:latest mynet
- 10. $ docker service create --replicas 3 --name frontend --network mynet --publish 80:80/tcp frontend_image:latest $ docker service create --name redis --network mynet redis:latest mynet
- 11. $ docker service scale frontend=6 mynet
- 12. $ docker service scale frontend=10 mynet
- 13. $ docker service create --mode=global --name prometheus prom/prometheus mynet
- 14. docker daemon --label com.example.storage="ssd" docker daemon --label com.example.storage="ssd"
- 15. $ docker service create --replicas 3 --name frontend --network mynet --publish 80:80/tcp --constraint com.example.storage="ssd" frontend_image:latest docker daemon --label com.example.storage="ssd" docker daemon --label com.example.storage="ssd"
- 16. $ docker service create --replicas 3 --name frontend --network mynet --publish 80:80/tcp --constraint com.example.storage="ssd" frontend_image:latest $ docker service scale frontend=10 docker daemon --label com.example.storage="ssd" docker daemon --label com.example.storage="ssd"
- 17. Services
- 18. Services are grouped into stacks
- 19. Distributed Application Bundle (.dab) declares a stack
- 20. Swarm mode orchestration is optional ● You don’t have to use it ● 1.12 is fully backwards compatible ● Will not break existing deployments and scripts
- 21. Routing Mesh • Operator reserves a swarm- wide ingress port (80) for myapp • Every node listens on 80 • Container-aware routing mesh can transparently reroute traffic from Worker3 to a node that is running container • Built in load balancing into the Engine • DNS-based service discovery :80 :80 :80 :80 frontend frontend $ docker service create --replicas 3 --name frontend --network mynet --publish 80:80/tcp frontend_image:latest frontend
- 22. Routing Mesh: Published Ports • Operator reserves a swarm- wide ingress port (80) for myapp • Every node listens on 80 • Container-aware routing mesh can transparently reroute traffic from Worker3 to a node that is running container • Built in load balancing into the Engine • DNS-based service discovery :80 :80 :80 :80 frontend frontend $ docker service create --replicas 3 --name frontend --network mynet --publish 80:80/tcp frontend_image:latest frontend
- 23. Security out of the box ● Cryptographic Node Identity ○ Workload segregation (think PCI) ● There is no “insecure mode”: ○ TLS mutual auth ○ TLS encryption ○ Certificate rotation
- 24. HEALTHCHECK --interval=5m --timeout=3s --retries 3 CMD curl -f http://localhost/ || exit 1 Checks every 5 minutes that web server can return index page within 3 seconds. Three consecutive failures puts container in an unhealthy state. Container Health Check in Dockerfile
- 25. docker plugin install tiborvass/no-remove docker plugin enable no-remove docker plugin disable no-remove New Plugin Subcommands
- 26. $ docker plugin install tiborvass/no-remove Plugin "mikegoelzer/myplugin:latest" requested the following privileges: - Networking: host - Mounting host path: /data Do you grant the above permissions? [y/N] Plugin Permissions Model
- 27. Orchestration Deep Dive Andrea Luzzardi DockerCon 2016
- 29. Manager Worker
- 30. Manager Worker ● Each Node has a role ● Roles are dynamic ● Programmable Topology
- 32. ● Strongly consistent: Holds desired state ● Simple to operate ● Blazing fast (in-memory reads, domain specific indexing, ...) ● Secure
- 33. ● Eventually consistent: Routing mesh, load balancing rules, ... ● High volume, p2p network between workers ● Secure: Symmetric encryption with key rotation in Raft
- 37. Secure by default with end to end encryption • Cryptographic node identity • Automatic encryption and mutual auth (TLS) • Automatic cert rotation • External CA integration Certificate Authority TLS Certificate Authority TLS Certificate Authority TLS TLS TLSTLS
- 38. Learn more about 1.12 Monday 5:20 pm @ Ballroom 6E • Docker Security Deep Dive Tuesday 3:55 pm @ Ballroom 6E • Docker for Ops: Networking Deep Dive, Considerations and Troubleshooting
- 39. Mike Goelzer mgoelzer@docker.com / @mgoelzer Andrea Luzzardi al@docker.com / @aluzzardi Questions?
- 40. Thank You Mike Goelzer mgoelzer@docker.com / @mgoelzer Andrea Luzzardi al@docker.com / @aluzzardi