What's New in Docker
0 likes519 views
The document outlines updates and features for Docker Enterprise Edition (EE) 17.06 and Community Edition (CE) 17.09, emphasizing enterprise-grade security, management, and Kubernetes integrations. It highlights support for mixed Windows and Linux environments, automated image promotion, and enhanced access control with roles and resource isolation. Upcoming support for Kubernetes is noted, which will allow for production-ready operations with Docker EE, and new capabilities for local testing with Docker for Mac/Windows.
![In Summary...
● Docker EE 17.06 and Docker CE 17.09 (Available Now)
● Kubernetes Support (Coming Soon) ← docker.com/kubernetes
○ Production-grade Kube for Ops with Docker EE
○ Test Kube apps on D4Mac/Win for Devs
○ Compose stack deploy for Kube workloads
● Other Sessions to Attend
○ “Linuxkit Deep Dive” [D4Mac/Win] (Tues 2:00pm)
○ “Advanced Access Control” (EE) (Tues 5:10pm)](https://image.slidesharecdn.com/fkg1ie5mq0eyz20xgi2i-signature-489da668bf3c61b23eb03fb423ab2ad7c1229ab1d093aedca05b1c3ce037544b-poli-171025011646/85/What-s-New-in-Docker-23-320.jpg)
What's New in Docker
- 1. What’s New in Docker Vivek Saraswat Product Manager, Docker @theVSaraswat
- 2. Agenda 1. Docker Enterprise Edition 17.06 2. Docker Community Edition 17.09 3. Kubernetes Integrations (Coming Soon!) a. Docker EE b. Docker CE
- 3. Enterprise Edition (EE) • Paid Docker subscription • Includes support from Docker • Stable releases for production use • Enterprise-grade features (security, management, automation) • Certified partner ecosystem Recommended for production use Enterprise & Community Editions • Free for “do it yourself” dev & ops • Does not include support • Stable releases for ops • Edge releases for developers Community Edition (CE)
- 4. Docker Enterprise Edition (EE) CONTAINERIZED PLATFORM FOR THE MODERN APPLICATION SUPPLY CHAIN • Integrated orchestration, security and management • Stable releases with minimum 1 year of support and maintenance • Security patches and hotfixes backported to all supported versions • Enterprise class support (9am-6pm or 24x7x365) • Certified Infrastructure, Containers and Plugins docker enterprise edition
- 5. Docker EE Components Public Cloud Virtual Physical docker enterprise edition ADVANCED INTEGRATED SECURITY docker trusted registry image management docker universal control plane app & cluster management docker engine container runtime, orchestration, networking, volumes, plugins CI/CD Images Operating Systems Volumes Monitoring Logging more...
- 7. UNIFORMLY OPERATE, MANAGE, AND SECURE WINDOWS AND LINUX CONTAINERS Node Manager Node Worker Node Manager Node Manager Node Worker Node Worker Node Worker Worker Nodes docker universal control plane trusted registry • Manage both your Linux and Windows applications from a single cluster console • Linux managers, mixed Windows/Linux worker nodes • EE features (e.g. RBAC, LDAP/AD, signing, scanning, secrets) work on both Windows and Linux • Support for IBM Z mainframes running as Linux workers Mixed Windows and Linux Clusters
- 8. Create Custom Roles for Access Control CUSTOMIZED SECURITY MAKES COMPLEX DESIGN EASY • Roles: Set of permissions on what a user can do to a resource • Default roles built into Docker EE • Create custom roles to meet the needs of your organization • Can select permissions from entire set of Docker API
- 9. RBAC for Nodes SECURE MULTI-TENANCY ACROSS TEAMS THROUGH NODE-BASED ISOLATION • Allow certain users/teams/orgs to deploy within a subset of nodes • Support multiple teams within the same cluster while providing physical separation and isolation • Prevent “noisy neighbors” by limiting a team’s resources to specific nodes • Meet compliance and regulatory requirements by isolating sensitive workloads to certain nodes Node Worker Node Worker Node Worker Node Worker ProdDev Dev Team ADev Team B SecOpsOps Team Docker 2017 - Confidential
- 10. Automatic Image Promotion SCALE WITH AUTOMATED POLICIES FOR IMAGE MANAGEMENT Docker Trusted Registry tag = “latest” personal/hello-world dev/hello-world No ‘critical’ or ‘major’ vulnerabilities qa/hello-world Docker 2017 - Confidential ● Promote “blessed” images from one repository to a different one in the same DTR ● Level of access control increases from dev → prod ● Can be done manually or by a policy (e.g. scanning vulnerabilities)
- 11. Docker CE 17.09
- 12. Docker CE 17.09 New Features ● Support for Compose format v3.4 ● `docker service rollback` ● Overlay2 over aufs as preferred filesystem ● `--chown` added to Add/Copy in Dockerfile ● Experimental support for docker trust` (view, revoke, sign) IMPORTANT: Starting with this release, docker service create, update, scale, and rollback use non-detached mode as default. Use --detach to keep the old behaviour.
- 14. Docker EE to include Kubernetes support Docker Enterprise Edition Production Ready Windows and IBM Z Support Pods, batch jobs, blue-green deployments, horizontal auto-scaling “Classic” Swarm Swarmkit Kubernetes Private Image Registry Secure Access and User Management App and Cluster Management Image Security Scanning Content Trust and Verification Policy Management
- 15. Docker EE will Integrate a Kubernetes Distribution Swarmkit“Classic” Swarm Docker EE API Classic API Swarm API Kube API Kubernetes CA AuthN AuthZ DCT Metrics Description ● Today’s UCP with additional orchestrator ○ Multi-orchestrator configuration ○ Allocate nodes to each orchestrator ○ “Vanilla” CNCF kube, no wrapping ○ Opinionated stack with “batteries included” networking and storage Feature/Benefits ● Support for Docker and Swarm APIs ● Support for Kubernetes API ● EE features including LDAP/AD, RBAC, Scanning, Signing Enforcement, Security Policies, etc.
- 16. Single Platform, Shared By Many Teams Node Worker Node Worker Node Worker Node Worker swarm mode cluster docker universal control plane trusted registry Node Worker Node Worker .NET Dev Team Using Swarm Java Dev Team using K8s Java Dev Team Using Swarm Ops Team
- 17. Add Kubernetes to an EE Cluster with a Simple Upgrade Easy upgrade from existing EE cluster to add Kubernetes ● Beyond engine restart, no additional workload downtime required during upgrade ● No cluster configuration migrations required Add Kubernetes workloads at your own pace ● No impact on existing Docker Swarm services or containers ● New workloads can immediately leverage Kubernetes features
- 18. Docker EE Kubernetes Integration Demo
- 19. Docker CE Kubernetes Integrations David Gageot Engineering Lead, Docker @dgageot
- 20. Kubernetes in Docker for Mac/Windows ● Automatically installs single-node vanilla Kubernetes cluster on your desktop ● Test your apps locally before pushing to a production cluster ● Docker CLI and Kubernetes CLI bundled and work in parallel in your client ● Kubernetes NodePort Services exposed on Mac/Windows host Docker for Mac Docker for Windows Any App, Any Format
- 21. Stacks for Kubernetes ● Use the same CLI to run Stacks on Swarm or Kubernetes ● Supports all Docker Compose versions ● Stack is a 1st class citizen to Kubernetes thanks to API Aggregation and Custom Resource Definitions (CRD) ● Support updates, rollbacks, logs, scaling...
- 23. In Summary... ● Docker EE 17.06 and Docker CE 17.09 (Available Now) ● Kubernetes Support (Coming Soon) ← docker.com/kubernetes ○ Production-grade Kube for Ops with Docker EE ○ Test Kube apps on D4Mac/Win for Devs ○ Compose stack deploy for Kube workloads ● Other Sessions to Attend ○ “Linuxkit Deep Dive” [D4Mac/Win] (Tues 2:00pm) ○ “Advanced Access Control” (EE) (Tues 5:10pm)
- 24. Docker EE Hosted Demo ● Free 4 Hour Demo ● No Servers Required ● Full Docker EE Cluster Access (GA Version) docker.com/trial
- 25. Interested in MTA ● Stop by the booth (MTA pod) ● Download the kit www.docker.com/mta ● Look for a MTA Roadshow near you ● Contact your Account Team