Download as PDF, PPTX
![$ docker plugin install tiborvass/no-remove
Plugin "mikegoelzer/myplugin:latest"
requested the following privileges:
- Networking: host
- Mounting host path: /data
Do you grant the above permissions? [y/N]
Plugin Permissions Model](https://image.slidesharecdn.com/whatsnewindocker1-160621030446/75/What-s-New-in-Docker-1-12-June-20-2016-by-Mike-Goelzer-Andrea-Luzzardi-26-2048.jpg)
More Related Content
Similar to What's New in Docker 1.12 (June 20, 2016) by Mike Goelzer & Andrea Luzzardi
What's New in Docker 1.12 (June 20, 2016) by Mike Goelzer & Andrea Luzzardi
- 1. What’s New inDocker 1.12 Mike Goelzer (Spoiler alert: a lot!)
- 2. $ docker swarminit
- 3. $ docker swarminit $ docker swarm join <IP of manager>:2377
- 4. $ docker swarminit $ docker swarm join <IP of manager>:2377
- 5. $ docker servicecreate --replicas 3 --name frontend --network mynet --publish 80:80/tcp frontend_image:latest mynet
- 6. $ docker servicecreate --replicas 3 --name frontend --network mynet --publish 80:80/tcp frontend_image:latest $ docker service create --name redis --network mynet redis:latest mynet
- 7. $ docker servicecreate --replicas 3 --name frontend --network mynet --publish 80:80/tcp frontend_image:latest $ docker service create --name redis --network mynet redis:latest mynet
- 8. $ docker servicecreate --replicas 3 --name frontend --network mynet --publish 80:80/tcp frontend_image:latest $ docker service create --name redis --network mynet redis:latest mynet
- 9. ≠ $ docker servicecreate --replicas 3 --name frontend --network mynet --publish 80:80/tcp frontend_image:latest $ docker service create --name redis --network mynet redis:latest mynet
- 10. $ docker servicecreate --replicas 3 --name frontend --network mynet --publish 80:80/tcp frontend_image:latest $ docker service create --name redis --network mynet redis:latest mynet
- 11. $ docker servicescale frontend=6 mynet
- 12. $ docker servicescale frontend=10 mynet
- 13. $ docker servicecreate --mode=global --name prometheus prom/prometheus mynet
- 14. docker daemon --label com.example.storage="ssd" dockerdaemon --label com.example.storage="ssd"
- 15. $ docker servicecreate --replicas 3 --name frontend --network mynet --publish 80:80/tcp --constraint com.example.storage="ssd" frontend_image:latest docker daemon --label com.example.storage="ssd" docker daemon --label com.example.storage="ssd"
- 16. $ docker servicecreate --replicas 3 --name frontend --network mynet --publish 80:80/tcp --constraint com.example.storage="ssd" frontend_image:latest $ docker service scale frontend=10 docker daemon --label com.example.storage="ssd" docker daemon --label com.example.storage="ssd"
- 17.
- 18. Services are groupedinto stacks
- 19. Distributed Application Bundle(.dab) declares a stack
- 20. Swarm mode orchestrationis optional ● You don’t have to use it ● 1.12 is fully backwards compatible ● Will not break existing deployments and scripts
- 21. Routing Mesh • Operatorreserves a swarm- wide ingress port (80) for myapp • Every node listens on 80 • Container-aware routing mesh can transparently reroute traffic from Worker3 to a node that is running container • Built in load balancing into the Engine • DNS-based service discovery :80 :80 :80 :80 frontend frontend $ docker service create --replicas 3 --name frontend --network mynet --publish 80:80/tcp frontend_image:latest frontend
- 22. Routing Mesh: PublishedPorts • Operator reserves a swarm- wide ingress port (80) for myapp • Every node listens on 80 • Container-aware routing mesh can transparently reroute traffic from Worker3 to a node that is running container • Built in load balancing into the Engine • DNS-based service discovery :80 :80 :80 :80 frontend frontend $ docker service create --replicas 3 --name frontend --network mynet --publish 80:80/tcp frontend_image:latest frontend
- 23. Security out ofthe box ● Cryptographic Node Identity ○ Workload segregation (think PCI) ● There is no “insecure mode”: ○ TLS mutual auth ○ TLS encryption ○ Certificate rotation
- 24. HEALTHCHECK --interval=5m --timeout=3s --retries3 CMD curl -f http://localhost/ || exit 1 Checks every 5 minutes that web server can return index page within 3 seconds. Three consecutive failures puts container in an unhealthy state. Container Health Check in Dockerfile
- 25. docker plugin installtiborvass/no-remove docker plugin enable no-remove docker plugin disable no-remove New Plugin Subcommands
- 26. $ docker plugininstall tiborvass/no-remove Plugin "mikegoelzer/myplugin:latest" requested the following privileges: - Networking: host - Mounting host path: /data Do you grant the above permissions? [y/N] Plugin Permissions Model
- 27. Orchestration Deep Dive AndreaLuzzardi DockerCon 2016
- 29.
- 30. Manager Worker ● Each Nodehas a role ● Roles are dynamic ● Programmable Topology
- 32. ● Strongly consistent:Holds desired state ● Simple to operate ● Blazing fast (in-memory reads, domain specific indexing, ...) ● Secure
- 33. ● Eventually consistent:Routing mesh, load balancing rules, ... ● High volume, p2p network between workers ● Secure: Symmetric encryption with key rotation in Raft
- 37. Secure by defaultwith end to end encryption • Cryptographic node identity • Automatic encryption and mutual auth (TLS) • Automatic cert rotation • External CA integration Certificate Authority TLS Certificate Authority TLS Certificate Authority TLS TLS TLSTLS
- 38. Learn more about1.12 Monday 5:20 pm @ Ballroom 6E • Docker Security Deep Dive Tuesday 3:55 pm @ Ballroom 6E • Docker for Ops: Networking Deep Dive, Considerations and Troubleshooting
- 39. Mike Goelzer [email protected] /@mgoelzer Andrea Luzzardi [email protected] / @aluzzardi Questions?
- 40. Thank You Mike Goelzer [email protected]/ @mgoelzer Andrea Luzzardi [email protected] / @aluzzardi