Kubernetes News, Entwicklungen, Updates, HowTos - Seite 160 von 181

Every year at #DockerCon, we expand the bounds of what Docker can do with new features and products. And every day, we see great new apps that are built on top of Docker. And yet, there’s always a few that stand out not just for being cool apps, but for pushing the bounds of what you can do with Docker.
This year we had two great apps that we featured in the Docker Cool Hacks closing keynote. Both hacks came from members of our Docker Captains program, a group of people from the Docker community who are recognized by Docker as very knowledgeable about Docker, and contribute quite a bit to the community.
Play with Docker
The first Cool Hack was Play with Docker by Marcos Nils and Jonathan Leibiusky. Marcos and Jonathan actually were featured in the Cool Hacks session at DockerCon EU in 2015 for their work on a Container Migration Tool.
Play with Docker is a Docker playground that you can run in your browser.

Play with Docker’s architecture is a Swarm of Swarms, running Docker in Docker instances.

Running on pretty beefy hosts r3.4xlarge on AWS – Play with Docker is able to run about 3500 containers per host, only running containers as needed for a session. Play with Docker is completely open source, so you can run it on your own infrastructure. And they welcome contributions on their GitHub repo.
FaaS (Function as a Service)
The second Cool Hack was Functions as a Service (FaaS) by Alex Ellis. FaaS is a framework for building serverless functions on Docker Swarm with first class support for metrics. Any UNIX process can be packaged as a function enabling you to consume a range of web events without repetitive boilerplate coding. Each function runs as a container that only runs as long as it takes to run the function.

FaaS also comes with a convenient gateway tester that allows you to try out each of your functions directly in the browser.

FaaS is actively seeking contributions, so feel free to send issues and PRs on the GitHub repo.
Check out the video recording of the cool hack sessions below:

Congratulations to DockerCon Cool Hacks winners @marcosnils, @xetorthio, and @alexellisuk for Play…Click To Tweet

Learn more about our DockerCon 2017 cool hacks:

Check out Play with Docker
Check out and contribute to FaaS
Contribute to Play with Docker

The post DockerCon 2017: Moby’s Cool Hack sessions appeared first on Docker Blog.
Quelle: https://blog.docker.com/feed/

19. April 201719. April 2017

da Agency

The Agility and Flexibility of Docker including Oracle Database and Development Tools

A company’s important applications often are subjected to random and capricious changes due to forces well beyond the control of IT or management. Events like a corporate merger or even a top programmer on an extended vacation can have an adverse impact on the performance and reliability of critical company infrastructure.
During the second day keynote at DockerCon 2017 in Austin TX, Lily Guo and Vivek Saraswat showed a simulation of how to use #Docker Enterprise Edition and its application transformation tools to respond to random events that threaten to undermine the stability of their company critical service.
The demo begins as two developers are returning to work after an extended vacation. They discover that, during their absence, their CEO has unexpectedly hired an outside contract programmer to rapidly code and introduce an entire application service that they know nothing about. As they try to build the new service, however, Docker Security Scan detects that a deprecated library has been incorporated by the contractor. This library is found to have a security vulnerability which violates the company’s best practice standards. As part of Docker Enterprise Edition Advanced, Docker Security Scan automatically keeps track of code contributions and acts as a gatekeeper to flag issues and protect company standards.   In this case, they are able to find a newer version of the library and build the service successfully.
The next step is to deploy the service.   Docker Compose is the way to describe the application dependencies and secrets access.   It is tempting to simply insert the passwords into the Compose file using plain text. However, the best choice is to let Docker Secrets manage sensitive application configuration data and take advantage of Docker EE with its ability to manage and enforce RBAC (Role Based Access Control).
It is interesting that the service consists of a Microsoft SQL Server database container that is interacting with other containers that are running Linux. Docker Enterprise Edition features this ability to run a cluster of microservices in a hybrid Windows and Linux environment. “It just works.”
All of the problems from the beginning of the demo now seem to be resolved, but the CEO rushes in to announce that they have just purchased a company that uses a traditional on premise application. The merger press announcement will be tomorrow and there is concern about the scope and cost of updating and moving the application to a modern infrastructure. However, they know that can use the Docker transformation tool, image2docker, to do the hard work of taking the traditional application and moving it to a modern Docker Enterprise Edition containers which can be deployed on any infrastructure, including Cloud.
One final step step is needed to complete the move from the traditional architecture.   As the traditional application relies on the popular and powerful Oracle Database, it will need to be acquired and adapted. Time to go out to the Docker Store.    Lily finds the Oracle DB on Docker Store and integrates it directly into the transformed application – and “it just works”
The Docker Store is the place where developers can find trusted and scanned commercial content with collaborative support from Docker and the application container image provider.   Oracle today announced that its flagship databases and developer tools will be immediately available as Docker containers through the Docker Store marketplace. The first set of certified images include: Oracle Database, Oracle MySQL, Oracle WebLogic Server, Oracle Coherence, Oracle Instant Client, and Oracle Java 8 SE (Server JRE).
The demo ends and it’s been shown how developers can use Docker Enterprise Edition to quickly resolve a library incompatibility issues and how easy it is to take traditional applications and accomplish the first steps towards adapting them to a modern container infrastructure.

Agility and Flexibility of Docker including @Oracle Database and Development ToolsClick To Tweet

The post The Agility and Flexibility of Docker including Oracle Database and Development Tools appeared first on Docker Blog.
Quelle: https://blog.docker.com/feed/

19. April 201719. April 2017

da Agency

Introducing the Modernize Traditional Apps Program

Today at DockerCon, we announced the Modernize Traditional Applications (MTA) Program to help enterprises make their existing legacy apps more secure, more efficient and portable to hybrid cloud infrastructure. Collaboratively developed and brought to market with partners Avanade, Cisco, HPE, and Microsoft, the MTA Program consists of consulting services, Docker Enterprise Edition, and hybrid cloud infrastructure from partners to modernize existing .NET Windows or Java Linux applications in five days or less. Designed for IT operations teams, the MTA Program modernizes existing legacy applications without modifying source code or re-architecting the application.

The First Step In The Microservices Journey
In working with hundreds of our enterprise IT customers the last couple years, when we sit down with them one of the first questions they inevitably ask is, “What is the first step we should take toward microservices?”
Through experience we have found that, for the vast majority of them, the best answer is, “Start with what you have today – with your existing applications.” Why is this the right place for them to start? Because it recognizes two realities facing enterprise IT organizations today: existing applications consume 80% of IT budgets, and most IT organizations responsible for existing apps are also tasked with hybrid cloud initiatives.
Seeing this pattern repeatedly, we developed this program as a solution for IT operations teams to rapidly address both realities.
Bringing Portability, Security, and Efficiency to Legacy Applications
The heart of the program is methodology and automation tooling to containerize existing .NET Windows or Java Linux applications without modifying source code or re-architecting the app. Then, using Docker’s Containers-as-a-Service (CaaS) offering, Docker Enterprise Edition (Docker EE), IT operations teams deploy and manage the newly-containerized applications onto partners’ hybrid cloud infrastructure.
The result? Customers participating in the private beta of the Modernize Traditional Apps Program during the last six months report the following benefits:

Portability. Customers share that previous attempts to move legacy applications to hybrid cloud infrastructure took months and suffered from high failure rates. In contrast, thanks to the ability of containers to package together an application and its dependencies, MTA’d legacy applications can be moved in weeks.
Security. Docker Enterprise Edition (Docker EE) improves the security profile of existing legacy applications through container-based isolation, automated scanning and alerting for vulnerabilities, and integrity verification through digital signatures.

Efficiency. Customers realize significant improvements in the total cost of ownership (TCO) in both CapEx and OpEx of their existing legacy applications.

To give specific examples, today at DockerCon private beta program participants Northern Trust and Microsoft IT both shared their experiences and results:

Northern Trust, a leading international financial services company, experienced deployment times that were 4X faster and noted a 2X improvement in infrastructure utilization;
Microsoft is not only a partner in this program; their IT organization is also a beta customer. Microsoft IT increased app density 4X with zero impact to performance and were able to reduce their infrastructure costs by a third.

Program Powered By Partners
The goal of the program is to accelerate the time-to-value for customers. To achieve this, we worked closely with our partners to define tightly-scoped, turnkey solutions consisting of consulting services, Docker Enterprise Edition (Docker EE) software, and hybrid cloud infrastructure.

Avanade and Microsoft Azure. Avanade’s consulting services provides a structured approach for evaluating the customer’s existing legacy applications, containerizing, and deploying and managing the containerized apps on Microsoft Azure hybrid cloud using Docker EE.
Cisco. Cisco offers consulting services and their UCS converged infrastructure products for MTA Program customers. Used together with Docker EE, the solution helps customers take advantage of Cisco’s policy-based container networking technology, Contiv, in deploying containerized apps to hybrid cloud environments.
HPE. For hybrid cloud solutions employing composable infrastructure, HPE offers MTA Program customers consulting services and converged infrastructure products together with Docker EE to deploy and manage containerized legacy apps.

Docker Enterprise Edition Empower Customers to Control the Journey
These turnkey bundles make the MTA Program a quick, efficient solution for IT operations taking the first step toward microservices. And with the modernized applications being managed by the Docker CaaS offering, Docker Enterprise Edition (Docker EE), customers have control over the journey’s pace and direction &8211; how fast or slow as well as which application functionality to re-factor into microservices versus which to leave as-is. This flexibility stems from Docker EE’s ability to manage the lifecycle of any containerized app, from 10-years-old legacy to just-released new microservices-based and anything in between.

We are excited to announce the Modernize Traditional Apps Program today at DockerCon with partners Avanade, Cisco, HPE, and Microsoft and share the stories from IT organizations who are making their existing legacy applications portable, secure, and efficient. Use the links below to learn more about how the MTA Program from Docker and its partners can help breathe new life into your existing legacy applications.
More Resources:

Learn more about modernizing traditional apps with Docker EE
Read the press release
Read more about the program from Microsoft
Read more about the program with Cisco

Introducing the Modernize Traditional Apps w/ @Docker program #dockerconClick To Tweet

The post Introducing the Modernize Traditional Apps Program appeared first on Docker Blog.
Quelle: https://blog.docker.com/feed/

18. April 201718. April 2017

da Agency

Introducing Moby Project: a new open-source project to advance the software containerization movement

Since Docker democratized software #containers four years ago, a whole ecosystem grew around containerization and in this compressed time period it has gone through two distinct phases of growth. In each of these two phases, the model for producing container systems evolved to adapt to the size and needs of the user community as well as the project and the growing contributor ecosystem.
The #Moby Project is a new open-source project to advance the software containerization movement and help the ecosystem take containers mainstream. It provides a library of components, a framework for assembling them into custom container-based systems and a place for all container enthusiasts to experiment and exchange ideas.
Let’s review how we got where we are today. In 2013-2014 pioneers started to use containers and collaborate in a monolithic open source codebase, Docker and few other projects, to help tools mature.

Then in 2015-2016, containers were massively adopted in production for cloud-native applications. In this phase, the user community grew to support tens of thousands of deployments that were backed by hundreds of ecosystem projects and thousands of contributors. It is during this phase, that Docker evolved its production model to an open component based approach. In this way, it allowed us to increase both the surface area of innovation and collaboration.
What sprung up were new independent Docker component projects that helped spur growth in the partner ecosystem and the user community. During that period, we extracted and rapidly innovated on components out of the Docker codebase so that systems makers could reuse them independently as they were building their own container systems: runc, HyperKit, VPNKit, SwarmKit, InfraKit, containerd etc..

Being at the forefront of the container wave, one trend we see emerging in 2017 is containers going mainstream, spreading to every category of computing, server, data center, cloud, desktop, Internet of Things and mobile. Every industry and vertical market, finance, healthcare, government, travel, manufacturing. And every use case, modern web applications, traditional server applications, machine learning, industrial control systems, robotics. What many new entrants in the container ecosystem have in common is that they build specialized systems, targeted at a particular infrastructure, industry or use case.
As a company Docker uses open source as our innovation lab, in collaboration with a whole ecosystem. Docker’s success is tied to the success of the container ecosystem: if the ecosystem succeeds, we succeed. Hence we have been planning for the next phase of the container ecosystem growth: what production model will help us scale the container ecosystem to fulfill the promise of making containers mainstream?
Last year, our customers started to ask for Docker on many platforms beyond Linux: Mac and Windows desktop, Windows Server, cloud platforms like Amazon Web Services (AWS), Microsoft Azure or Google Cloud Platform, and we created a dozen Docker editions specialized for these platforms. In order to be able to build and ship these specialized editions is a relatively short time, with small teams, in a scalable way, without having to reinvent the wheel; it was clear we needed a new approach. We needed our teams to collaborate not only on components, but also on assemblies of components, borrowing an idea from the car industry where assemblies of components are reused to build completely different cars.

We think the best way to scale the container ecosystem to the next level to get containers mainstream is to collaborate on assemblies at the ecosystem level.

In order to enable this new level of collaboration, today we are announcing the Moby Project, a new open-source project to advance the software containerization movement. It provides a “Lego set” of dozens of components, a framework for assembling them into custom container-based systems, and a place for all container enthusiasts to experiment and exchange ideas. Think of Moby as the “Lego Club” of container systems.
Moby is comprised of:

A library of containerized backend components (e.g., a low-level builder, logging facility, volume management, networking, image management, containerd, SwarmKit, …)
A framework for assembling the components into a standalone container platform, and tooling to build, test and deploy artifacts for these assemblies.
A reference assembly, called Moby Origin, which is the open base for the Docker container platform, as well as examples of container systems using various components from the Moby library or from other projects.

Moby is designed for system builders, who want to build their own container based systems, not for application developers, who can use Docker or other container platforms. Participants in the Moby project can choose from the library of components derived from Docker or they can elect to “bring your own components” (BYOC) packaged as containers with the option to mix and match among all of the components to create a customized container system.
Docker uses the Moby Project as an open R&D lab, to experiment, develop new components, and collaborate with the ecosystem on the future of container technology. All our open source collaboration will move to the Moby project.
Please join us in helping take software containers mainstream, and grow our ecosystem and our user community to the next level by collaborating on components and assemblies.

Let’s take containers mainstream with moby https://mobyproject.org/ #mobyprojectClick To Tweet

Learn more about the Moby Project:

https://mobyproject.org/

Join us for the DockerCon 2017 Online Meetup Recap
Read the Announcement

The post Introducing Moby Project: a new open-source project to advance the software containerization movement appeared first on Docker Blog.
Quelle: https://blog.docker.com/feed/

18. April 201718. April 2017

da Agency

Announcing LinuxKit: A Toolkit for building Secure, Lean and Portable Linux Subsystems

Last year, one of the most common requests we heard from our users was to bring a Docker-native experience to their platforms. These platforms were many and varied: from cloud platforms such as AWS, Azure, Google Cloud, to server platforms such as Windows Server, desktop platforms that their developers used such as OSX and Windows 10, to mainframes and IoT platforms – the list went on.
We started working on support for these platforms, and we initially shipped Docker for Mac and Docker for Windows, followed by Docker for AWS and Docker for Azure. Most recently, we announced the beta of Docker for GCP. The customizations we applied to make Docker native for each platform have furthered the adoption of the Docker editions.
One of the issues we encountered was that for many of these platforms, the users wanted Linuxcontainer support but the platform itself did not ship with Linux included. Mac OS and Windows are two obvious examples, but cloud platforms do not ship with a standard Linux either. So it made sense for us to bundle Linux into the Docker platform to run in these places.
What we needed to bundle was a secure, lean and portable Linux subsystem that can provide Linux container functionality as a component of a container platform. As it turned out, this is what many other people working with containers wanted as well; secure, lean and portable Linux subsystem for the container movement, So, we partnered with several companies and the Linux Foundation to build this component. These companies include HPE, Intel, ARM, IBM and Microsoft &8211; all of whom are interested in bringing Linux container functionality to new and varied platforms, from IoT to mainframes.
#LinuxKit includes the tooling to allow building custom Linux subsystems that only include exactly the components the runtime platform requires. All system services are containers that can be replaced, and everything that is not required can be removed. All components can be substituted with ones that match specific needs. It is a kit, very much in the Docker philosophy of batteries included but swappable. Today, onstage at Dockercon 2017 we opensourced LinuxKit at https://github.com/linuxkit/linuxkit.
To achieve our goals of a secure, lean and portable OS,we built it from containers, for containers. Security is a top-level objective and aligns with NIST stating, in their draft Application Container Security Guide: “Use container-specific OSes instead of general-purpose ones to reduce attack surfaces. When using a container-specific OS, attack surfaces are typically much smaller than they would be with a general-purpose OS, so there are fewer opportunities to attack and compromise a container-specific OS.”
The leanness directly helps with security by removing parts not needed if the OS is designed around the single use case of running containers. Because LinuxKit is container-native, it has a very minimal size &8211; 35MB with a very minimal boot time. All system services are containers, which means that everything can be removed or replaced.
System services are sandboxed in containers, with only the privileges they need. The configuration is designed for the container use case. The whole system is built to be used as immutable infrastructure, so it can be built and tested in your CI pipeline, deployed, and new versions are redeployed when you wish to upgrade.
The kernel comes from our collaboration with the Linux kernel community, participating in the process and work with groups such as the Kernel Self Protection Project (KSPP), while shipping recent kernels with only the minimal patches needed to fix issues with the platforms LinuxKit supports. The kernel security process is too big for a single company to try to develop on their own therefore a broad industry collaboration is necessary.
In addition LinuxKit provides a space to incubate security projects that show promise for improving Linux security. We are working with external open source projects such as Wireguard, Landlock, Mirage, oKernel, Clear Containers and more to provide a testbed and focus for innovation in the container space, and a route to production.
LinuxKit is portable, as it was built for the many platforms Docker runs on now, and with a view to making it run on far more.. Whether they are large or small machines, bare metal or virtualized, mainframes or the kind of devices that are used in Internet of Things scenarios as containers reach into every area of computing.
For the launch we invited John Gossman from Microsoft onto the stage. We have a long history of collaboration with Microsoft, on Docker for Windows Server, Docker for Windows and Docker for Azure. Part of that collaboration has been work on the Linux subsystem in Docker for Windows and Docker for Azure, and working on Hyper-V integration with LinuxKit on those platforms. The next step in that collaboration announced today is that all Windows Server and Windows 10 customers will get access to Linux containers and we will be working together on how to integrate linuxKit with Hyper-V isolation.
Today we open up LinuxKit to partners and open source enthusiasts to build new things with Linux and to expand the container platform. We look forward to seeing what you make from it and contribute back to the community.

Announcing LinuxKit: A Toolkit for building Secure, Lean and Portable Linux SubsystemsClick To Tweet

Learn More about Linuxkit:

Check out the LinuxKit repository on GitHub
Join us for the DockerCon 2017 Online Meetup Recap
Read the Announcement

The post Announcing LinuxKit: A Toolkit for building Secure, Lean and Portable Linux Subsystems appeared first on Docker Blog.
Quelle: https://blog.docker.com/feed/

12. April 201712. April 2017

da Agency

WEBINAR Q&A: Modernizing Traditional Applications with Docker

This webinar covers the importance of “WHY NOW and HOW” to start modernizing traditional applications with Docker Enterprise Edition. Legacy applications often serve critical business needs and have to be maintained for a long time. The maintenance of these applications can become expensive and very time consuming. Some applications may have been written decades ago, grown to millions of lines of code and the team that built and deployed the app may no longer be at your company. That can pose a challenge for app maintenance, security and support. Docker Enterprise Edition and the Image2Docker Tool presents a unique opportunity to #modernize these apps into containers to make them portable, more secure and cost efficient to operate.
View the recorded session below and read through some of the most popular questions
.

Q: Do I need to follow all the steps in the exact sequential manner or do all of them to qualify as modernizing traditional applications?
A: Outside of the first step of taking the existing app and converting it to a container with Image2Docker, the decision to refactor, automate or deploy to new infrastructure is up to you. You can strictly lift and shift some apps, while others are candidates for refactoring or to be completely re-written. Modernization can also include migrating to a more modern infrastructure or adding modern services to an existing app. With Docker, managing and deploying apps are straightforward whether it is a microservice or monolith.
Q: What kind of apps does image2Docker tool support and how do I get it?
A: Image2Docker is a free tool for use by Windows and Linux teams to convert apps to dockerfiles. Whether it’s a .NET application running on Windows or a Java or LAMP stack application running on Linux, Image2Docker will help taking an existing, deployed application and convert it to a dockerfile. Of course, not all apps are equal when it comes to converting to images.
For Windows: 2-3 tier IIS and ASP.NET applications ,limited external dependencies. For Linux: 2-3 tier Java apps running frameworks suited for isolation within container , LAMP stack apps,limited external dependencies.
Q: Is image2Docker a part of Docker Enterprise Edition?
A: No, image2Docker is a free open source tool available for download. Anyone interested in this use case can download the Linux or Windows version. A Linux and Windows Server version is available.
Q: How do I manage and deploy my apps securely at scale?
A: Docker Enterprise Edition (EE) is the platform for enterprise container management and security. It is an application-centric platform that can orchestrate, accelerate and secure applications across the entire software supply chain, from development to production running on any infrastructure. Docker EE is a single pane of glass to manage and deploy your apps at scale, securely and efficiently.
Q: How is Docker EE licensed and where can I see key features included in Docker EE tiers?
A: Docker EE is licensed per node. A node is an instance running on a bare metal or virtual server. Docker EE is available in three tiers: Basic, Standard and Advanced to address a wide range of requirements. For more details visit www.docker.com/pricing.
Q: Can Docker EE run within my enterprise or is it only run externally?
A: Docker EE can be deployed on-premises or in your VPC.
Q: How do I modernize from monolith to microservices?
A: There is a lot of interest in microservices apps which are discrete, distributed and independently maintainable blocks of functionality. Many organizations have this as a goal and the reality is that the first step is to modernize that app into a single container. The next step is to start refactoring the app and overtime one container can become hundreds. A recommended best practice is to start with functionality that changes most frequently, target that for refactoring and most importantly test, test, test.
Continue your Docker journey with these helpful links:

Learn More about Docker Enterprise Edition
Try Docker Enterprise Edition for free
Learn more about image2Docker for Linux and Windows Server
Build your own images

Modernize Traditional Applications without rewriting code with Docker #MTAClick To Tweet

The post WEBINAR Q&A: Modernizing Traditional Applications with Docker appeared first on Docker Blog.
Quelle: https://blog.docker.com/feed/

12. April 201712. April 2017

da Agency

DockerCon Agenda, Mobile App and DockerCon Slack

From Docker use cases at large corporations, to advanced technical talks and hands-on lab tutorials, the #DockerCon Agenda includes sessions adapted to every attendee profile, expertise level and domain of interest.
If you’re a registered attendee, login on the DockerCon portal using the information you set up during the registration process. You can use the keyword search bar or filter by topics, days, tracks, experience level or target audience.

Once logged in, you can “star” your interests and create your DockerCon schedule. Your saved interests and schedule will be available on the DockerCon mobile app you can download here.
Below are some useful tips and tricks for getting the most out of the DockerCon App.
Add More Sessions in the App
If you have not started already, we encourage you to review DockerCon sessions and build your agenda for next week. The process is very simple and will help you organize sessions and activities by the topics that you are interested in. Just click the “Schedule” widget and explore sessions by day or track. When you add to “My Agenda”, you’ll be able to it find later in “My Event”.
You can use the DockerCon App to take notes and rate both speakers and sessions. You can also access your Moby Mingle account to submit offers or join requests allowing you to connect with other attendees. Just log in once using your registration credentials and then it will be saved for the week.
The Mapping section includes a map of the Ecosystem Expo Hall giving you the details of where you can find sponsor’s booths.
#DockerSelfie
Don’t forget to post your DockerSelfie photos to the Photo Feed! What’s a DockerSelfie? It’s just a selfie-style picture that features something Docker-related. Share pics with your Docker swag, at DockerCon or from other Docker events. Let us know how excited you are for DockerCon.
Introducing a DockerCon Slack
We’ve set up a DockerCon slack so that it’s easier for attendees to participate in topic-based conversations in specific channels. This is a great way to interact with attendees online and ask questions to the Docker team who will be looking after the different channels. As always, please remember that this is a professional event and it’s important to adhere to the Code of Conduct.

Time to build your @dockercon agenda and download the dockercon App Click To Tweet

The post DockerCon Agenda, Mobile App and DockerCon Slack appeared first on Docker Blog.
Quelle: https://blog.docker.com/feed/

12. April 201712. April 2017

da Agency

Docker Docs Hackathon: April 17-21, 2017

During DockerCon 2017, #Docker’s #docs team will be running the first-ever Docker Docs hackathon, and you’re invited to participate and win prizes – whether you attend DockerCon or are just watching the proceedings online.
Essentially, it’s a bug-bash! We have a number of bugs filed against our docs up on GitHub for you to grab.
You can participate in one of two ways:

With the docs team’s help in the fourth floor hack room at DockerCon on Tuesday, April 18th and Wednesday, April 19th, from 1-6pm.
Online! Right here! During the whole week of DockerCon (April 17th – 21st).

Or, both – if you want to have the best shot. After all, we won’t be in the hack room 24/7 that whole week.
All participants who show up in the 4th floor hack room at DockerCon will get this way-cool magnet just for stopping by.

Quick links

Official hackathon page on Docs site
Event page on DockerCon website
View hackathon bugs on GitHub
Report your hackathon work
Browse prizes
docs on Slack, if you have questions

How it works
We have a number of bugs that have built up in our docs queue on GitHub, and we have labeled a whole slew of them with the tag hackathon, which you can see here.
Submit fixes for these bugs, or close them if you do a bit of research it turns out they aren’t actually valid. Every action you take gets you more points, and the points are redeemable for dollars in our hackathon store. These points also qualify you for valuable prizes like an Amazon gift card and a personally engraved trophy!
Prizes

All participants: Points are redeemable for t-shirts, hoodies, sweatshirts, mugs, beer steins, pint glasses, flasks, hoodies, stickers, buttons, magnets, wall clocks, post-cards, and even doggie t-shirts.
3rd place: A small trophy with a personal engraving, plus store credit
2nd place: A small trophy with a personal engraving, plus store credit, plus a $150 Amazon Gift Card
1st place: A large trophy with a personal engraving, plus store credit, plus a $300 Amazon Gift Card

Bonuses
A select few will get bonuses for being extra special contributors:

Largest single change introduced in a fix (files changed/lines of delta): 1000 points
Most bugs closed (resolved as no-op or handled): 1000 points
Most participation (attended all days): 1000 points

Choosing a prize
You can see the point values for the bugs in the GitHub queue. Those are worth cash in our rewards store at http://www.cafepress.com/dockerdocshackathon.
Our points-to-cash conversion rate will be figured out at the end of the hackathon, and will essentially be a function of the number of points that hackathon participants logged, and the number of dollars we have to spend on prizes.

View available rewards

When?
The docs hackathon is going on from April 17th thru April 21st, 2017. This is the time when it’s possible to claim and resolve bugs.
Where?
In-person
Attending DockerCon? Come to the fourth floor hack room on Tuesday and Wednesday from 1pm to 6pm. We’ll be there to answer questions and help you.
Note: While the hackathon is officially ongoing all week online, working in the hack room with us for these two days is by far the best way to participate; the docs team will be on-hand to get you started, get you unstuck, and guide you.
Online
Drop into the community Slack channel for the docs and ask any questions you have. Otherwise, just go to GitHub and look at our hackathon label and come here to claim your points when you’re done.
Claiming a bug
Whether attending in-person or online, to claim a bug as one that you are working on (so nobody else grabs it out from under you) you must type a comment saying you claim it. Respect it when you see other comments claiming a bug.

View available bugs

Claiming your points
Simply fill out this form when you’re done participating. We’ll take it from there.
Conversion rate
The points-to-cash ratio will be posted on the official page for the hackathon no later than Friday the 21st. We need to figure out how many points’ worth of fixes come in first.
Sorry but we can not send you cash for these points under any circumstances, even if you don’t spend them.
Questions?
Ask us anything at docs@docker.com or in the docs channel on Slack.
Thank you for participating in the 2017 Docs Hackathon!

Join us for the Docker Docs Hackathon: April 17-21, 2017Click To Tweet

The post Docker Docs Hackathon: April 17-21, 2017 appeared first on Docker Blog.
Quelle: https://blog.docker.com/feed/

7. April 20177. April 2017

da Agency

RBAC Support in Kubernetes

Editor’s note: this post is part of a series of in-depth articles on what’s new in Kubernetes 1.6One of the highlights of the Kubernetes 1.6 release is the RBAC authorizer feature moving to beta. RBAC, Role-based access control, is an an authorization mechanism for managing permissions around Kubernetes resources. RBAC allows configuration of flexible authorization policies that can be updated without cluster restarts.The focus of this post is to highlight some of the interesting new capabilities and best practices.RBAC vs ABACCurrently there are several authorization mechanisms available for use with Kubernetes. Authorizers are the mechanisms that decide who is permitted to make what changes to the cluster using the Kubernetes API. This affects things like kubectl, system components, and also certain applications that run in the cluster and manipulate the state of the cluster, like Jenkins with the Kubernetes plugin, or Helm that runs in the cluster and uses the Kubernetes API to install applications in the cluster. Out of the available authorization mechanisms, ABAC and RBAC are the mechanisms local to a Kubernetes cluster that allow configurable permissions policies.ABAC, Attribute Based Access Control, is a powerful concept. However, as implemented in Kubernetes, ABAC is difficult to manage and understand. It requires ssh and root filesystem access on the master VM of the cluster to make authorization policy changes. For permission changes to take effect the cluster API server must be restarted.RBAC permission policies are configured using kubectl or the Kubernetes API directly. Users can be authorized to make authorization policy changes using RBAC itself, making it possible to delegate resource management without giving away ssh access to the cluster master. RBAC policies map easily to the resources and operations used in the Kubernetes API.Based on where the Kubernetes community is focusing their development efforts, going forward RBAC should be preferred over ABAC.Basic ConceptsThe are a few basic ideas behind RBAC that are foundational in understanding it. At its core, RBAC is a way of granting users granular access to Kubernetes API resources.The connection between user and resources is defined in RBAC using two objects.RolesA Role is a collection of permissions. For example, a role could be defined to include read permission on pods and list permission for pods. A ClusterRole is just like a Role, but can be used anywhere in the cluster.Role BindingsA RoleBinding maps a Role to a user or set of users, granting that Role’s permissions to those users for resources in that namespace. A ClusterRoleBinding allows users to be granted a ClusterRole for authorization across the entire cluster.Additionally there are cluster roles and cluster role bindings to consider. Cluster roles and cluster role bindings function like roles and role bindings except they have wider scope. The exact differences and how cluster roles and cluster role bindings interact with roles and role bindings are covered in the Kubernetes documentation.RBAC in KubernetesRBAC is now deeply integrated into Kubernetes and used by the system components to grant the permissions necessary for them to function. System roles are typically prefixed with system: so they can be easily recognized.➜ kubectl get clusterroles –namespace=kube-systemNAME KINDadmin ClusterRole.v1beta1.rbac.authorization.k8s.iocluster-admin ClusterRole.v1beta1.rbac.authorization.k8s.ioedit ClusterRole.v1beta1.rbac.authorization.k8s.iokubelet-api-admin ClusterRole.v1beta1.rbac.authorization.k8s.iosystem:auth-delegator ClusterRole.v1beta1.rbac.authorization.k8s.iosystem:basic-user ClusterRole.v1beta1.rbac.authorization.k8s.iosystem:controller:attachdetach-controller ClusterRole.v1beta1.rbac.authorization.k8s.iosystem:controller:certificate-controller ClusterRole.v1beta1.rbac.authorization.k8s.io…The RBAC system roles have been expanded to cover the necessary permissions for running a Kubernetes cluster with RBAC only.During the permission translation from ABAC to RBAC, some of the permissions that were enabled by default in many deployments of ABAC authorized clusters were identified as unnecessarily broad and were scoped down in RBAC. The area most likely to impact workloads on a cluster is the permissions available to service accounts. With the permissive ABAC configuration, requests from a pod using the pod mounted token to authenticate to the API server have broad authorization. As a concrete example, the curl command at the end of this sequence will return a JSON formatted result when ABAC is enabled and an error when only RBAC is enabled.➜ kubectl run nginx –image=nginx:latest➜ kubectl exec -it $(kubectl get pods -o jsonpath='{.items[0].metadata.name}’) bash➜ apt-get update && apt-get install -y curl➜ curl -ik -H “Authorization: Bearer $(cat /var/run/secrets/kubernetes.io/serviceaccount/token)” https://kubernetes/api/v1/namespaces/default/podsAny applications you run in your Kubernetes cluster that interact with the Kubernetes API have the potential to be affected by the permissions changes when transitioning from ABAC to RBAC.To smooth the transition from ABAC to RBAC, you can create Kubernetes 1.6 clusters with both ABAC and RBAC authorizers enabled. When both ABAC and RBAC are enabled, authorization for a resource is granted if either authorization policy grants access. However, under that configuration the most permissive authorizer is used and it will not be possible to use RBAC to fully control permissions.At this point, RBAC is complete enough that ABAC support should be considered deprecated going forward. It will still remain in Kubernetes for the foreseeable future but development attention is focused on RBAC.Two different talks at the at the Google Cloud Next conference touched on RBAC related changes in Kubernetes 1.6, jump to the relevant parts here and here. For more detailed information about using RBAC in Kubernetes 1.6 read the full RBAC documentation.Get InvolvedIf you’d like to contribute or simply help provide feedback and drive the roadmap, join our community. Specifically interested in security and RBAC related conversation, participate through one of these channels:Chat with us on the Kubernetes Slack sig-auth channelJoin the biweekly SIG-Auth meetings on Wednesday at 11:00 AM PTThanks for your support and contributions. Read more in-depth posts on what’s new in Kubernetes 1.6 here.– Jacob Simpson, Greg Castle & CJ Cullen, Software Engineers at GooglePost questions (or answer questions) on Stack Overflow Join the community portal for advocates on K8sPortGet involved with the Kubernetes project on GitHub Follow us on Twitter @Kubernetesio for latest updatesConnect with the community on SlackDownload Kubernetes
Quelle: kubernetes