Date post: | 06-Jan-2017 |
Category: |
Technology |
Upload: | sreenivas-makam |
View: | 833 times |
Download: | 2 times |
DOCKER 1.11 OVERVIEW
Presenter Name: Sreenivas MakamPresented at: Docker Meetup Bangalore
Presentation Date: June 4, 2016
About me• Senior Engineering Manager at Cisco
Systems Data Center group• Author of “Mastering CoreOS” https://
www.packtpub.com/networking-and-servers/mastering-coreos/ )
• Docker Captain(https://www.docker.com/community/docker-captains )
• Blog: https://sreeninet.wordpress.com/ • Code: https://github.com/smakam• Linkedin:
https://in.linkedin.com/in/sreenivasmakam
• Twitter: @srmakam
Docker family
Docker(Linux, Mac, Windows)
Core(Docker engine,
Network, Storage)
Security(Docker content
trust, Docker security scan)
Getting started(Toolbox, Kitematic)
Orchestration(Machine, Compose,
Swarm)
Registry(Docker hub, Docker trusted registry)
Deployment( Docker cloud, Docker data
center)
Docker release Timeline
0.1 - March 2013
1.0 - June 2014
1.1 - July 2014.dockerignore for DockerfileTail logsBind mounting full filesystem into a container
1.2 - Aug 2014 Docker restart policy for container Capability flag in docker run Devices can be bind mounted without using privilege option
1.3 - (Compose 1.0) - Oct 2014 Experimental digital signature for container images Docker exec introduced Security options for selinux, apparmor introduced in Docker run
1.4 - Dec 2014 Overlayfs as experimental storage driver Can add labels to Docker daemon Security vulnerabilities addressed
1.5 - (Compose 1.1) - Feb 2015 IPV6 support Docker container statistics using event driven model Dockerfile specifying file name
Note:Top 3 features were based on personal choice
Docker release Timeline (Contd)
1.6.0 (Compose 1.2, Swarm 0.2, Machine 0.2, Registry 2.0) - April 2015 Windows client Container and Image labels Logging drivers support
1.7.0 (Compose 1.3, Swarm 0.3, Machine 0.3, Registry 2.0) - June 2015 Docker networking and storage plugin as experimental libnetwork seperated out from Docker engine Swarm, Compose and multihost networking integrated
1.8.0 (Compose 1.4, Swarm 0.9, Machine 0.4, Registry 2.1) - August 2015 Docker content trust for image signingDocker toolbox for windows and mac Volume plugins going to production
1.9.0 (Compose 1.5, Swarm 1.0, Machine 0.5, Registry 2.2) - Nov 2015Multihost networking with libnetwork Swarm going to production Build-time arguments to Dockerfile
1.10.0 (Compose 1.6, Swarm 1.1, Machine 0.6, Registry 2.3) - Feb 2016 Compose file with networks and volumes Security enhancement - user namespace, seccomp, authorization plugin Swarm HA(reschedule containers when node fails)
1.11.0 (Compose 1.7, Swarm 1.2, Machine 0.7, Registry 2.4) - May 2016 Runc and Containerd DNS round robin load balancing ipv6 service discovery
Note:Top 3 features were based on personal choice
Docker 1.11 feature summary
• Runc and Containerd plumbing • Built-in load balancing using DNS roundrobin• Service discovery for ipv6• Experimental macvlan and ipvlan network plugins• Labels for networks and volumes• Yubikey based hardware signing of Container images
moves from experimental to stable• Container rescheduling in Swarm moves from
experimental to stable
Runc and Containerd• Docker Engine broken into base Docker engine,
Containerd and Runc.• Runc is the Container runtime based on OCI
specification. Containerd manages running Containers.
• This makes Docker modular from developers perspective.
• Future - Runc can be replaced by other Container runtime like runV, Clear Containers.
• Future - Docker engine and Containerd can be restarted or upgraded without affecting running Containers.
Process output running 2 busybox Containers:root 672 1 0 17:15 ? 00:00:11 /usr/bin/docker daemon --dns 8.8.8.8 --raw-logsroot 695 672 0 17:15 ? 00:00:01 docker-containerd -l /var/run/docker/libcontainerd/docker-containerd.sock --runtime docker-runcroot 3694 695 0 21:22 ? 00:00:00 docker-containerd-shim cf0fe4c12041bbf737abe597805f6ea81da8d65b6d30587211f24c85573d2ef1 /var/run/docker/libcontainerd/cf0fe4c12041bbf737abe597805f6ea81da8d65b6d30587211f24c85573d2ef1 docker-runcroot 3787 695 0 21:23 ? 00:00:00 docker-containerd-shim 009f939ef47f4a01f3e5fdcc18c0e7555f050c2ffea1e551c1171ee5bf110a59 /var/run/docker/libcontainerd/009f939ef47f4a01f3e5fdcc18c0e7555f050c2ffea1e551c1171ee5bf110a59 docker-runc
Docker daemon
Containerddaemon
2 Runc with Shim
Picture source: Docker blog
DNS load balancingCreate 3 Containers in “fe” network:docker run -d --name=nginx1 --net=fe --net-alias=nginxnet nginxdocker run -d --name=nginx2 --net=fe --net-alias=nginxnet nginxdocker run -ti --name=myubuntu --net=fe --link=nginx1:nginx1link --link=nginx2:nginx2link ubuntu bash
DNS by network alias:
root@4d2d6e34120d:/# ping -c1 nginxnetPING nginxnet (172.20.0.3) 56(84) bytes of data.64 bytes from nginx2.fe (172.20.0.3): icmp_seq=1 ttl=64 time=0.852 ms
root@4d2d6e34120d:/# ping -c1 nginxnetPING nginxnet (172.20.0.2) 56(84) bytes of data.64 bytes from nginx1.fe (172.20.0.2): icmp_seq=1 ttl=64 time=0.244 ms
DNS by Container name:
root@4d2d6e34120d:/# ping -c1 nginx1PING nginx1 (172.20.0.2) 56(84) bytes of data.64 bytes from nginx1.fe (172.20.0.2): icmp_seq=1 ttl=64 time=0.112 ms
root@4d2d6e34120d:/# ping -c1 nginx2PING nginx2 (172.20.0.3) 56(84) bytes of data.64 bytes from nginx2.fe (172.20.0.3): icmp_seq=1 ttl=64 time=0.090 ms
DNS by link name:
root@4d2d6e34120d:/# ping -c1 nginx1linkPING nginx1link (172.20.0.2) 56(84) bytes of data.64 bytes from nginx1.fe (172.20.0.2): icmp_seq=1 ttl=64 time=0.049 ms
root@4d2d6e34120d:/# ping -c1 nginx2linkPING nginx2link (172.20.0.3) 56(84) bytes of data.64 bytes from nginx2.fe (172.20.0.3): icmp_seq=1 ttl=64 time=0.253 ms
ubuntu
nginx1
nginx2
IPV6 Service Discovery• Create IPV6 network:docker network create --ipv6 --subnet=1111:2222:3333::/64 myipv6
• Create 2 Containers:docker run --rm -ti --net=myipv6 --name=u1 smakam/myubuntu:v4 bashdocker run --rm -ti --net=myipv6 --name=u2 smakam/myubuntu:v4 bash
Dig output from U2:# dig u1 AAAA
; <<>> DiG 9.9.5-3-Ubuntu <<>> u1 AAAA;; global options: +cmd;; Got answer:;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 62676;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:;u1.IN AAAA
;; ANSWER SECTION:u1. 600IN AAAA 1111:2222:3333::2
U1:eth0 Link encap:Ethernet HWaddr 02:42:ac:18:00:02 inet addr:172.24.0.2 Bcast:0.0.0.0 Mask:255.255.0.0 inet6 addr: 1111:2222:3333::2/64 Scope:GlobalU2:eth0 Link encap:Ethernet HWaddr 02:42:ac:18:00:03 inet addr:172.24.0.3 Bcast:0.0.0.0 Mask:255.255.0.0 inet6 addr: 1111:2222:3333::3/64 Scope:Global
Ping U2 from U1:# ping6 -c1 u2PING u2(u2.myipv6) 56 data bytes64 bytes from u2.myipv6: icmp_seq=1 ttl=64 time=0.136 ms
# ping -c1 u2PING u2 (172.24.0.3) 56(84) bytes of data.64 bytes from u2.myipv6 (172.24.0.3): icmp_seq=1 ttl=64 time=0.100 ms
Labels for Networks and Volumes• Labels allows tagging and filtering of Container
resources.• Before Docker 1.11, labels were supported for
Containers, images, daemons.• Docker 1.11 added labels for Networks and
Volumes. Compose will add this support soon.Create network with 2 labels:docker network create -d bridge --label tier=fe --label owner=dev mynetDisplay Docker network labels:docker network inspect mynet"Labels": { "owner": "dev", "tier": "fe" }Filter not working yet:docker network ls --filter "label=tier=fe"Error response from daemon: Invalid filter 'label'
Create Volume:docker volume create --label name=ssd --name myvolDisplay Docker volume labels:docker volume inspect myvol"Labels": { "name": "ssd" }Filter not working yet:docker volume ls --filter "label=name=ssd"Error response from daemon: Invalid filter 'label'
Macvlan, ipvlan • Macvlan and ipvlan are new Docker network plugins like bridge and
overlay.• Macvlan and ipvlan drivers are provided by Linux kernel.• Available in experimental Docker.• Allows Containers to use underlay networks natively. Useful for
customers who want to reach Containers from external network without using NAT.
• Macvlan interfaces have unique mac and IP address. Ipvlan interfaces have unique IP address, but share the same mac address as underlay interface.
Macvlan Example
Host 1:docker network create -d macvlan --subnet=192.168.0.0/16 --ip-range=192.168.2.0/24 -o macvlan_mode=bridge -o parent=eth2.70 macvlan70 docker run --net=macvlan70 -it --name macvlan70_1 --rm alpine /bin/sh docker run --net=macvlan70 -it --name macvlan70_2 --rm alpine /bin/sh docker network create -d macvlan --subnet=192.169.0.0/16 --ip-range=192.169.2.0/24 -o macvlan_mode=bridge -o parent=eth2.80 macvlan80 docker run --net=macvlan80 -it --name macvlan80_1 --rm alpine /bin/sh docker run --net=macvlan80 -it --name macvlan80_2 --rm alpine /bin/sh
Host 2:docker network create -d macvlan --subnet=192.168.0.0/16 --ip-range=192.168.3.0/24 -o macvlan_mode=bridge -o parent=eth2.70 macvlan70 docker run --net=macvlan70 -it --name macvlan70_3 --rm alpine /bin/sh docker run --net=macvlan70 -it --name macvlan70_4 --rm alpine /bin/sh docker network create -d macvlan --subnet=192.169.0.0/16 --ip-range=192.169.3.0/24 -o macvlan_mode=bridge -o parent=eth2.80 macvlan80 docker run --net=macvlan80 -it --name macvlan80_3 --rm alpine /bin/sh docker run --net=macvlan80 -it --name macvlan80_4 --rm alpine /bin/sh
References• Docker 1.11 release blog (https://blog.docker.com/2016/04/docker-engine-1-11-runc/ )• Docker 1.11 Online meetup (
https://blog.docker.com/2016/04/docker-online-meetup-37-docker-1-11/, https://blog.docker.com/2016/05/docker-sf-1-11-meetup/ )
• Runc (http://runc.io/)• Containerd(https://containerd.tools/)• Labels for non-Container resources(https://github.com/docker/docker/issues/20356) • Experimental Macvlan, ipvlan(https://
github.com/docker/docker/blob/master/experimental/vlan-networks.md) • Blog on macvlan, ipvlan(
https://sreeninet.wordpress.com/2016/05/29/docker-macvlan-and-ipvlan-network-plugins/, https://sreeninet.wordpress.com/2016/05/29/macvlan-and-ipvlan/)
• Swarm Container rescheduling(https://docs.docker.com/swarm/scheduler/rescheduling/) • Docker Yubikey hardware signing(
https://blog.docker.com/2015/11/docker-content-trust-yubikey/)