nats meetup oct 2016 docker 112

Docker 1.12.3+ and Getting Started with Docker Clustering

Nirmal Mehta / @normalfaults Adapted from presentation by Mike Goelzer / mgoelzer@docker.com / @mikegoelzer

The evolution of Docker orchestration

docker run nginx

Swarm mode clustering + Docker Services in EngineON-TRACK

2013-14

2014-present

2016

(Backed by docker/swarmkit)

Docker 1.12• Orchestration

• Swarm Mode• Docker Services• Security• Routing Mesh

• Docker for X• Mac/Windows• AWS• Azure

• Container Healthcheck• Docker Application Bundle

Swarm mode & Docker Services

Engine

Swarm Mode

$ docker swarm init

Engine

Swarm Mode

$ docker swarm init

$ docker swarm join <IP of manager>:2377

Engine

EngineEngine

Engine

EngineEngine Engine

Swarm Mode

$ docker swarm init

$ docker swarm join <IP of manager>:2377

EngineEngine

Engine

EngineEngine Engine

Services

$ docker service create --replicas 3 --name frontend --network mynet  -p 8080:80 frontend:latest

mynet

EngineEngine

Engine

EngineEngine Engine

Services

$ docker service create --replicas 3 --name frontend --network mynet  -p 8080:80 frontend:latest

$ docker service create --name redis --network mynet redis:latest

mynet

EngineEngine

Engine

EngineEngine Engine

Node Failure & Reconciliation

$ docker service create --replicas 3 --name frontend --network mynet  -p 8080:80 frontend:latest

$ docker service create --name redis --network mynet redis:latest

mynet

EngineEngine

Engine

EngineEngine Engine

Node Failure & Reconciliation

$ docker service create --replicas 3 --name frontend --network mynet  -p 8080:80 frontend:latest

$ docker service create --name redis --network mynet redis:latest

mynet

EngineEngine

Engine

EngineEngine

Desired State ≠ Actual State

$ docker service create --replicas 3 --name frontend --network mynet  -p 8080:80 frontend:latest

$ docker service create --name redis --network mynet redis:latest

mynet

EngineEngine

Engine

EngineEngine

Converge Back to Desired State

$ docker service create --replicas 3 --name frontend --network mynet  -p 8080:80 frontend:latest

$ docker service create --name redis --network mynet redis:latest

mynet

EngineEngine

Engine

EngineEngine

Scaling

$ docker service update --replicas 6 frontend

mynet

EngineEngine

Engine

EngineEngine

Scaling

$ docker service update --replicas 10 frontend

mynet

EngineEngine

Engine

EngineEngine

Global Services

$ docker service create --mode=global --name prometheus prom/prometheus

mynet

EngineEngine

Engine

EngineEngine

Constraints

Engine

docker daemon --label com.example.storage="ssd"

docker daemon --label com.example.storage="ssd"

EngineEngine

Engine

EngineEngine

Constraints

$ docker service create --replicas 3 --name frontend --network mynet  -p 8080:80 --constraint engine.labels.com.example.storage==ssd frontend:latest

Engine

docker daemon --label com.example.storage="ssd"

docker daemon --label com.example.storage="ssd"

EngineEngine

Engine

EngineEngine

Constraints

$ docker service create --replicas 3 --name frontend --network mynet  -p 8080:80 --constraint engine.labels.com.example.storage==ssd frontend:latest$ docker service update --replicas 10 frontend

Engine

docker daemon --label com.example.storage="ssd"

docker daemon --label com.example.storage="ssd"

Routing Mesh

:8080 :8080 :8080

frontend frontend

$ docker service create --replicas 3 --name frontend --network mynet  -p 8080:80 frontend:latest

frontend

External Load Balancer

:8080

User browses to http://myapp.com

Node 1 Node 2 Node 3 Node 4

Routing Mesh

:8080

User browses to http://myapp.com

:8080 :8080

frontend frontend

$ docker service create --replicas 3 --name frontend --network mynet  -p 8080:80 frontend:latest

frontend

External Load Balancer

:8080

Node 1 Node 2 Node 3 Node 4

Secure by default• Out-of-the-box TLS

encryption and mutual auth

• Automatic cert rotation• External or self-signed

root CA• Cryptographic node

identity

CertificateAuthority

TLS

CertificateAuthority

TLS

CertificateAuthority

TLS

TLS TLSTLS

Scale: 2,000 Nodes and Counting● For now: community testing, crowd-sourced nodes, not funded by

Docker● Credit to: Chanwit Kaewkasi, Suranaree University of

Technology (SUT), Thailand● Results:

• 2,384 nodes• 96,287 containers• Manager CPU/memory 15%≲• Test stopped because 3rd-party monitoring failed

● https://github.com/swarm2k/swarm2k

@chanwit

Deep Dive: Swarm Topology

Node

Node

Node

NodeNode

Node

Topology

Node

NodeNode

Node

Node

Node

Node

Node

Node

NodeNode

Node

Topology: roles

Node

NodeNode

Node

Node

Node

Manager

Worker

Node

Node

Node

NodeNode

Node

Topology: roles

Node

NodeNode

Node

Node

Node

Manager

Worker

● Each Node has a role● Roles are dynamic● Programmable Topology

Flat Topology

Manager Manager Manager

Worker Worker Worker Worker Worker Worker

Topology: Scaling model

Manager Manager Manager

Worker Worker Worker Worker Worker Worker

Topology: High Availability

Manager Manager Manager

Worker Worker Worker Worker Worker Worker

Leader FollowerFollower

Loss of Leader

Topology: High Availability

Manager Manager Manager

Worker Worker Worker Worker Worker Worker

Leader FollowerFollower

Loss of Leader

Topology: High Availability

Manager Manager Manager

Worker Worker Worker Worker Worker Worker

Follower FollowerLeader

Topology: High Availability

Manager Manager Manager

Worker Worker Worker Worker Worker Worker

Follower FollowerLeader

HEALTHCHECK --interval=5m --timeout=3s --retries 3 CMD curl -f http://localhost/ || exit 1

Check web server every 5 minutes, require < 3 sec latency.>= 3 consecutive failures sets unhealthy state

Coming soon: health checks in official images

Container Health Check in Dockerfile

Docker Stack and Distributed Application Bundle (experimental)docker.com/dab• Docker Stacks and Distributed Application Bundles are experimental

features introduced in Docker 1.12 and Docker Compose 1.8• A Dockerfile can be built into an image, and containers can be

created from that image. • Similarly, a docker-compose.yml can be built into a distributed

application bundle, and stacks can be created from that bundle. In that sense, the bundle is a multi-services distributable image format.

Example Bundle File Format.DBS file

Docker 1.13• Secrets Management• New “docker system” commands• Allows a new client to talk to an old engine• Improved new plugins system (Work from 1.12 experimental)

Thanks!Join Docker Raleigh Meetup GroupUpcoming events:• Docker Mentor Week Nov 14-20, 2016

• Handson online Labs and Mentoring• Place and Date TBD but join group to get update

• Docker Swarm 3k Event Tomorrow!• https://github.com/swarmzilla/swarm3k

https://blog.docker.com/2016/10/docker-global-mentor-week-2016/

You can find me at:Nirmal Mehta@normalfaults (Twitter, Github)