da Agency

Dynamic Provisioning and Storage Classes in Kubernetes

Editor’s note: this post is part of a series of in-depth articles on what’s new in Kubernetes 1.6Storage is a critical part of running stateful containers, and Kubernetes offers powerful primitives for managing it. Dynamic volume provisioning, a feature unique to Kubernetes, allows storage volumes to be created on-demand. Before dynamic provisioning, cluster administrators had to manually make calls to their cloud or storage provider to provision new storage volumes, and then create PersistentVolume objects to represent them in Kubernetes. With dynamic provisioning, these two steps are automated, eliminating the need for cluster administrators to pre-provision storage. Instead, the storage resources can be dynamically provisioned using the provisioner specified by the StorageClass object (see user-guide). StorageClasses are essentially blueprints that abstract away the underlying storage provider, as well as other parameters, like disk-type (e.g.; solid-state vs standard disks).StorageClasses use provisioners that are specific to the storage platform or cloud provider to give Kubernetes access to the physical media being used. Several storage provisioners are provided in-tree (see user-guide), but additionally out-of-tree provisioners are now supported (see kubernetes-incubator).In the Kubernetes 1.6 release, dynamic provisioning has been promoted to stable (having entered beta in 1.4). This is a big step forward in completing the Kubernetes storage automation vision, allowing cluster administrators to control how resources are provisioned and giving users the ability to focus more on their application. With all of these benefits, there are a few important user-facing changes (discussed below) that are important to understand before using Kubernetes 1.6.Storage Classes and How to Use themStorageClasses are the foundation of dynamic provisioning, allowing cluster administrators to define abstractions for the underlying storage platform. Users simply refer to a StorageClass by name in the PersistentVolumeClaim (PVC) using the “storageClassName” parameter.In the following example, a PVC refers to a specific storage class named “gold”.apiVersion: v1kind: PersistentVolumeClaimmetadata:  name: mypvc  namespace: testnsspec:  accessModes:  – ReadWriteOnce  resources:    requests:      storage: 100Gi  storageClassName: goldIn order to promote the usage of dynamic provisioning this feature permits the cluster administrator to specify a default StorageClass. When present, the user can create a PVC without having specifying a storageClassName, further reducing the user’s responsibility to be aware of the underlying storage provider. When using default StorageClasses, there are some operational subtleties to be aware of when creating PersistentVolumeClaims (PVCs). This is particularly important if you already have existing PersistentVolumes (PVs) that you want to re-use:PVs that are already “Bound” to PVCs will remain bound with the move to 1.6They will not have a StorageClass associated with them unless the user manually adds itIf PVs become “Available” (i.e.; if you delete a PVC and the corresponding PV is recycled), then they are subject to the followingIf storageClassName is not specified in the PVC, the default storage class will be used for provisioning.Existing, “Available”, PVs that do not have the default storage class label will not be considered for binding to the PVCIf storageClassName is set to an empty string (‘’) in the PVC, no storage class will be used (i.e.; dynamic provisioning is disabled for this PVC)Existing, “Available”, PVs (that do not have a specified storageClassName) will be considered for binding to the PVCIf storageClassName is set to a specific value, then the matching storage class will be usedExisting, “Available”, PVs that have a matching storageClassName will be considered for binding to the PVCIf no corresponding storage class exists, the PVC will fail.To reduce the burden of setting up default StorageClasses in a cluster, beginning with 1.6, Kubernetes installs (via the add-on manager) default storage classes for several cloud providers. To use these default StorageClasses, users do not need refer to them by name – that is, storageClassName need not be specified in the PVC.The following table provides more detail on default storage classes pre-installed by cloud provider as well as the specific parameters used by these defaults.Cloud ProviderDefault StorageClass NameDefault ProvisionerAmazon Web Servicesgp2aws-ebsMicrosoft Azurestandardazure-diskGoogle Cloud Platformstandardgce-pdOpenStackstandardcinderVMware vSpherethinvsphere-volumeWhile these pre-installed default storage classes are chosen to be “reasonable” for most storage users, this guide provides instructions on how to specify your own default.Dynamically Provisioned Volumes and the Reclaim PolicyAll PVs have a reclaim policy associated with them that dictates what happens to a PV once it becomes released from a claim (see user-guide). Since the goal of dynamic provisioning is to completely automate the lifecycle of storage resources, the default reclaim policy for dynamically provisioned volumes is “delete”. This means that when a PersistentVolumeClaim (PVC) is released, the dynamically provisioned volume is de-provisioned (deleted) on the storage provider and the data is likely irretrievable. If this is not the desired behavior, the user must change the reclaim policy on the corresponding PersistentVolume (PV) object after the volume is provisioned.How do I change the reclaim policy on a dynamically provisioned volume?You can change the reclaim policy by editing the PV object and changing the “persistentVolumeReclaimPolicy” field to the desired value. For more information on various reclaim policies see user-guide.FAQsHow do I use a default StorageClass?If your cluster has a default StorageClass that meets your needs, then all you need to do is create a PersistentVolumeClaim (PVC) and the default provisioner will take care of the rest – there is no need to specify the storageClassName:apiVersion: v1kind: PersistentVolumeClaimmetadata:  name: mypvc  namespace: testnsspec:  accessModes:  – ReadWriteOnce  resources:    requests:      storage: 100GiCan I add my own storage classes?Yes. To add your own storage class, first determine which provisioners will work in your cluster. Then, create a StorageClass object with parameters customized to meet your needs (see user-guide for more detail). For many users, the easiest way to create the object is to write a yaml file and apply it with “kubectl create -f”. The following is an example of a StorageClass for Google Cloud Platform named “gold” that creates a “pd-ssd”. Since multiple classes can exist within a cluster, the administrator may leave the default enabled for most workloads (since it uses a “pd-standard”), with the “gold” class reserved for workloads that need extra performance. kind: StorageClassapiVersion: storage.k8s.io/v1metadata:  name: goldprovisioner: kubernetes.io/gce-pdparameters:  type: pd-ssdHow do I check if I have a default StorageClass Installed?You can use kubectl to check for StorageClass objects. In the example below there are two storage classes: “gold” and “standard”. The “gold” class is user-defined, and the “standard” class is installed by Kubernetes and is the default.$ kubectl get scNAME                 TYPEgold                 kubernetes.io/gce-pd   standard (default)   kubernetes.io/gce-pd$ kubectl describe storageclass standardName:     standardIsDefaultClass: YesAnnotations: storageclass.beta.kubernetes.io/is-default-class=trueProvisioner: kubernetes.io/gce-pdParameters: type=pd-standardEvents:         <none>Can I delete/turn off the default StorageClasses?You cannot delete the default storage class objects provided. Since they are installed as cluster addons, they will be recreated if they are deleted.You can, however, disable the defaulting behavior by removing (or setting to false) the following annotation: storageclass.beta.kubernetes.io/is-default-class.If there are no StorageClass objects marked with the default annotation, then PersistentVolumeClaim objects (without a StorageClass specified) will not trigger dynamic provisioning. They will, instead, fall back to the legacy behavior of binding to an available PersistentVolume object.Can I assign my existing PVs to a particular StorageClass?Yes, you can assign a StorageClass to an existing PV by editing the appropriate PV object and adding (or setting) the desired storageClassName field to it.What happens if I delete a PersistentVolumeClaim (PVC)?If the volume was dynamically provisioned, then the default reclaim policy is set to “delete”. This means that, by default, when the PVC is deleted, the underlying PV and storage asset will also be deleted. If you want to retain the data stored on the volume, then you must change the reclaim policy from “delete” to “retain” after the PV is provisioned.–Saad Ali & Michelle Au, Software Engineers, and Matthew De Lio, Product Manager, GooglePost questions (or answer questions) on Stack Overflow Join the community portal for advocates on K8sPortGet involved with the Kubernetes project on GitHub Follow us on Twitter @Kubernetesio for latest updatesConnect with the community on SlackDownload Kubernetes
Quelle: kubernetes

da Agency

containerd joins the Cloud Native Computing Foundation

Today, we’re excited to announce that #containerd – Docker’s core container runtime – has been accepted by the Technical Oversight Committee (TOC) as an incubating project in the Cloud Native Computing Foundation (CNCF). containerd’s acceptance into the CNCF alongside projects such as Kubernetes, gRPC and Prometheus comes three months after Docker, with support from the five largest cloud providers, announced its intent to contribute the project to a neutral foundation in the first quarter of this year.
In the process of spinning containerd out of Docker and contributing it to CNCF there are a few changes that come along with it.  For starters, containerd now has a logo; see below. In addition, we have a new @containerd twitter handle. In the next few days, we’ll be moving the containerd GitHub repository to a separate GitHub organization. Similarly, the containerd slack channel will be moved to separate slack team which will soon available at containerd.slack.com

containerd has been extracted from Docker’s container platform and includes methods for transferring container images, container execution and supervision and low-level local storage, across both Linux and Windows. containerd is an essential upstream component of the Docker platform used by millions of end users that  also provides the industry with an open, stable and extensible base for building non-Docker products and container solutions.

“Our decision to contribute containerd to the CNCF closely follows months of collaboration and input from thought leaders in the Docker community,” said Solomon Hykes, founder, CTO and Chief Product Officer at Docker. “Since our announcement in December, we have been progressing the design of the project with the goal of making it easily embedded into higher level systems to provide core container capabilities. Our focus has always been on solving users’ problems. By donating containerd to an open foundation, we can accelerate the rate of innovation through cross-project collaboration – making the end user the ultimate benefactor of our joint efforts.”

The donation of containerd aligns with Docker’s history of making key open source plumbing projects available to the community. This effort began in 2014 when the company open sourced libcontainer. Over the past two years, Docker has continued along this path by making libnetwork, notary, runC (contributed to the Open Container Initiative, which like CNCF, is part of The Linux Foundation), HyperKit, VPNKit, DataKit, SwarmKit and InfraKit available as open source projects as well.
containerd is already a key foundation for Kubernetes, as Kubernetes 1.5 runs with Docker 1.10.3 to 1.12.3. There is also strong alignment with other CNCF projects: containerd exposes an API using gRPC and exposes metrics in the Prometheus format. containerd also fully leverages the Open Container Initiative’s (OCI) runtime, image format specifications and OCI reference implementation (runC), and will pursue OCI certification when it is available. A proof of concept for integrating containerd directly into Kubernetes CRI is currently being worked on. Check out the pull request on github for more technical details.

Figure 1: containerd’s role in the Container Ecosystem
Community consensus leads to technical progress
In the past few months, the containerd team has been active implementing Phase 1 and Phase 2 of the containerd roadmap. Details about the project can be charted in the containerd weekly development reports posted in the Github project.
At the end of February, Docker hosted the containerd Summit with more than 50 members of the community from companies including Alibaba, AWS, Google, IBM, Microsoft, Red Hat and VMware. The group gathered to learn more about containerd, get more information on containerd’s progress and discuss its design. To view the presentations, check out the containerd summit recap blog post.
The target date to finish implementing the containerd 1.0 roadmap is June 2017. To contribute to containerd, or embed it into a container system, check out the project on GitHub. If you want to learn more about containerd progress, or discuss its design, join the team in Berlin tomorrow at KubeCon 2017 for the containerd Salon, or Austin for DockerCon Day 4 Thursday April 20th, as the Docker Internals Summit morning session will be a containerd summit.
Additional containerd Resources:

Roadmap
Scope table
Architecture document
Draft APIs

Docker’s core container runtime: containerd joins the @CloudNativeFdnClick To Tweet

The post containerd joins the Cloud Native Computing Foundation appeared first on Docker Blog.
Quelle: https://blog.docker.com/feed/

da Agency

Kubernetes 1.6: Multi-user, Multi-workloads at Scale

Today we’re announcing the release of Kubernetes 1.6.In this release the community’s focus is on scale and automation, to help you deploy multiple workloads to multiple users on a cluster. We are announcing that 5,000 node clusters are supported. We moved dynamic storage provisioning to stable. Role-based access control (RBAC), kubefed, kubeadm, and several scheduling features are moving to beta. We have also added intelligent defaults throughout to enable greater automation out of the box.What’s NewScale and Federation: Large enterprise users looking for proof of at-scale performance will be pleased to know that Kubernetes’ stringent scalability SLO now supports 5,000 node (150,000 pod) clusters. This 150% increase in total cluster size, powered by a new version of etcd v3 by CoreOS, is great news if you are deploying applications such as search or games which can grow to consume larger clusters.For users who want to scale beyond 5,000 nodes or spread across multiple regions or clouds, federation lets you combine multiple Kubernetes clusters and address them through a single API endpoint. In this release, the kubefed command line utility graduated to beta – with improved support for on-premise clusters. kubefed now automatically configures kube-dns on joining clusters and can pass arguments to federated components.Security and Setup: Users concerned with security will find that RBAC, now beta adds a significant security benefit through more tightly scoped default roles for system components. The default RBAC policies in 1.6 grant scoped permissions to control-plane components, nodes, and controllers. RBAC allows cluster administrators to selectively grant particular users or service accounts fine-grained access to specific resources on a per-namespace basis. RBAC users upgrading from 1.5 to 1.6 should view the guidance here. Users looking for an easy way to provision a secure cluster on physical or cloud servers can use kubeadm, which is now beta. kubeadm has been enhanced with a set of command line flags and a base feature set that includes RBAC setup, use of the Bootstrap Token system and an enhanced Certificates API.Advanced Scheduling: This release adds a set of powerful and versatile scheduling constructs to give you greater control over how pods are scheduled, including rules to restrict pods to particular nodes in heterogeneous clusters, and rules to spread or pack pods across failure domains such as nodes, racks, and zones.Node affinity/anti-affinity, now in beta, allows you to restrict pods to schedule only on certain nodes based on node labels. Use built-in or custom node labels to select specific zones, hostnames, hardware architecture, operating system version, specialized hardware, etc. The scheduling rules can be required or preferred, depending on how strictly you want the scheduler to enforce them.A related feature, called taints and tolerations, makes it possible to compactly represent rules for excluding pods from particular nodes. The feature, also now in beta, makes it easy, for example, to dedicate sets of nodes to particular sets of users, or to keep nodes that have special hardware available for pods that need the special hardware by excluding pods that don’t need it.Sometimes you want to co-schedule services, or pods within a service, near each other topologically, for example to optimize North-South or East-West communication. Or you want to spread pods of a service for failure tolerance, or keep antagonistic pods separated, or ensure sole tenancy of nodes. Pod affinity and anti-affinity, now in beta, enables such use cases by letting you set hard or soft requirements for spreading and packing pods relative to one another within arbitrary topologies (node, zone, etc.).Lastly, for the ultimate in scheduling flexibility, you can run your own custom scheduler(s) alongside, or instead of, the default Kubernetes scheduler. Each scheduler is responsible for different sets of pods. Multiple schedulers is beta in this release. Dynamic Storage Provisioning: Users deploying stateful applications will benefit from the extensive storage automation capabilities in this release of Kubernetes.Since its early days, Kubernetes has been able to automatically attach and detach storage, format disk, mount and unmount volumes per the pod spec, and do so seamlessly as pods move between nodes. In addition, the PersistentVolumeClaim (PVC) and PersistentVolume (PV) objects decouple the request for storage from the specific storage implementation, making the pod spec portable across a range of cloud and on-premise environments. In this release StorageClass and dynamic volume provisioning are promoted to stable, completing the automation story by creating and deleting storage on demand, eliminating the need to pre-provision.The design allows cluster administrators to define and expose multiple flavors of storage within a cluster, each with a custom set of parameters. End users can stop worrying about the complexity and nuances of how storage is provisioned, while still selecting from multiple storage options.In 1.6 Kubernetes comes with a set of built-in defaults to completely automate the storage provisioning lifecycle, freeing you to work on your applications. Specifically, Kubernetes now pre-installs system-defined StorageClass objects for AWS, Azure, GCP, OpenStack and VMware vSphere by default. This gives Kubernetes users on these providers the benefits of dynamic storage provisioning without having to manually setup StorageClass objects. This is a change in the default behavior of PVC objects on these clouds. Note that default behavior is that dynamically provisioned volumes are created with the “delete” reclaim policy. That means once the PVC is deleted, the dynamically provisioned volume is automatically deleted so users do not have the extra step of ‘cleaning up’.In addition, we have expanded the range of storage supported overall including:ScaleIO Kubernetes Volume Plugin enabling pods to seamlessly access and use data stored on ScaleIO volumes.Portworx Kubernetes Volume Plugin adding the capability to use Portworx as a storage provider for Kubernetes clusters. Portworx pools your server capacity and turns your servers or cloud instances into converged, highly available compute and storage nodes.Support for NFSv3, NFSv4, and GlusterFS on clusters using the COS node image Support for user-written/run dynamic PV provisioners. A golang library and examples can be found here.Beta support for mount options in persistent volumesContainer Runtime Interface, etcd v3 and Daemon set updates: while users may not directly interact with the container runtime or the API server datastore, they are foundational components for user facing functionality in Kubernetes’. As such the community invests in expanding the capabilities of these and other system components.The Docker-CRI implementation is beta and is enabled by default in kubelet. Alpha support for other runtimes, cri-o, frakti, rkt, has also been implemented.The default backend storage for the API server has been upgraded to use etcd v3 by default for new clusters. If you are upgrading from a 1.5 cluster, care should be taken to ensure continuity by planning a data migration window. Node reliability is improved as Kubelet exposes an admin configurable Node Allocatable feature to reserve compute resources for system daemons.Daemon set updates lets you perform rolling updates on a daemon setAlpha features: this release was mostly focused on maturing functionality, however, a few alpha features were added to support the roadmapOut-of-tree cloud provider support adds a new cloud-controller-manager binary that may be used for testing the new out-of-core cloud provider flowPer-pod-eviction in case of node problems combined with tolerationSeconds, lets users tune the duration a pod stays bound to a node that is experiencing problemsPod Injection Policy adds a new API resource PodPreset to inject information such as secrets, volumes, volume mounts, and environment variables into pods at creation time.Custom metrics support in the Horizontal Pod Autoscaler changed to use Multiple Nvidia GPU support is introduced with the Docker runtime onlyThese are just some of the highlights in our first release for the year. For a complete list please visit the release notes.CommunityThis release is possible thanks to our vast and open community. Together, we’ve pushed nearly 5,000 commits by some 275 authors. To bring our many advocates together, the community has launched a new program called K8sPort, an online hub where the community can participate in gamified challenges and get credit for their contributions. Read more about the program here.Release ProcessA big thanks goes out to the release team for 1.6 (lead by Dan Gillespie of CoreOS) for their work bringing the 1.6 release to light. This release team is an exemplar of the Kubernetes community’s commitment to community governance. Dan is the first non-Google release manager and he, along with the rest of the team, worked throughout the release (building on the 1.5 release manager, Saad Ali’s, great work) to uncover and document tribal knowledge, shine light on tools and processes that still require special permissions, and prioritize work to improve the Kubernetes release process. Many thanks to the team.User AdoptionWe’re continuing to see rapid adoption of Kubernetes in all sectors and sizes of businesses. Furthermore, adoption is coming from across the globe, from a startup in Tennessee, USA to a Fortune 500 company in China. JD.com, one of China’s largest internet companies, uses Kubernetes in conjunction with their OpenStack deployment. They’ve move 20% of their applications thus far on Kubernetes and are already running 20,000 pods daily. Read more about their setup here. Spire, a startup based in Tennessee, witnessed their public cloud provider experience an outage, but suffered zero downtime because Kubernetes was able to move their workloads to different zones. Read their full experience here.“With Kubernetes, there was never a moment of panic, just a sense of awe watching the automatic mitigation as it happened.”Share your Kubernetes use case story with the community here.AvailabilityKubernetes 1.6 is available for download here on GitHub and via get.k8s.io. To get started with Kubernetes, try one of the these interactive tutorials. Get InvolvedCloudNativeCon + KubeCon in Berlin is this week March 29-30, 2017. We hope to get together with much of the community and share more there!Share your voice at our weekly community meeting: Post questions (or answer questions) on Stack Overflow Follow us on Twitter @Kubernetesio for latest updatesConnect with the community on SlackMany thanks for your contributions and advocacy!– Aparna Sinha, Senior Product Manager, Kubernetes, Google
Quelle: kubernetes

da Agency

Docker Birthday #4: Thank you Docker Community!

Pақмет сізге, tak, धन्यवाद, cảm ơn bạn, شكرا, mulțumesc, gracias, merci, danke, obrigado, ευχαριστώ, köszönöm, thank you #Docker community! From Des Moines to Santiago de Cuba, Budapest to Tel Aviv and Sydney to Cairo, it was so awesome to see the energy from the community coming together to celebrate and learn about Docker!

We originally planned for 50 Docker Birthday #4 celebrations worldwide with 2,500 attendees. But over 9,000 people registered to attend one of the 152 celebrations across 5 continents! A huge thank you to all the Docker meetup organizers who worked hard to make these celebrations happen and offered Docker beginners the  opportunity to participate in hands on Docker labs.
Join in on the fun!
In case you missed it last week, check out the pics from all of the #DockerBday celebrations including the awesome birthday cakes! Check out the Facebook photo album too! Up for a little more reading? Check out these blog posts from Docker Captains Jonas Rosland and Alex Ellis about their experience mentoring at their local event.
None of this would have been possible without the support (and expertise!) of the 500+ advanced Docker users who signed up as mentors to help attendees learn about Docker by working through the labs we have available.
Here are some of our favorite tweets from the meetups:
 

Huge turnout at @docker #Seattle dockerbday bash! Docker #DockerSeattle pic.twitter.com/cEgGcak2ZR
— Kaslin Fields (@kaslinfields) March 24, 2017

 

Learning and celebrating with @docker 4th Anniversary. We . dockerbday #NScommunity pic.twitter.com/tDoxGnEKCQ
— Nearsoft Jobs (@NearsoftJobs) March 18, 2017

Learn Docker
In case you weren’t able to attend a local event, all the labs are now available to everyone online here: http://birthday.play-with-docker.com/
About play-with-docker
Play-with-docker (PWD) is a site made by Docker captains Marcos Nils and Jonathan Leibiusky. PWD is a Docker playground which allows you to run Docker commands in a matter of seconds. It gives you the experience of having a free Alpine Linux Virtual Machine in your browser, where you can build and run Docker containers and even create clusters in Docker Swarm Mode. Under the hood DIND or Docker-in-Docker is used to give the effect of multiple VMs/PCs.
Share Your Experience
If you were able to attend a local event, please take a moment to let us know how it went. Here is the participant survey and the mentor survey.
Contribute to Docker Labs
The material used for the Bday 4 meetups was pulled from https://github.com/docker/labs and contains Docker labs and tutorials authored by Docker, and by members of the community. We welcome contributions and want that repo to grow. If you have a tutorial to submit, or contributions to existing tutorials, please check out the guide to submitting your own tutorial.
Get involved with the Docker Community:

Sign up for the Docker Community Directory and Slack
Join your local Docker Meetup group
Join the Docker Online Meetup group

The DockerBday labs are now available online! #learndockerClick To Tweet

The post Docker Birthday 4: Thank you Docker Community! appeared first on Docker Blog.
Quelle: https://blog.docker.com/feed/

da Agency

Webinar recap: Docker 101 for federal government

#Docker is driving a movement for IT teams across all industries to modernize their applications with container technology. Government agencies, like private sector companies face similar pressures to accelerate software development while reduce overall IT costs and adopting new technologies and practices like cloud, DevOps and more.
This webinar titled “Docker 101 for the Federal Government” features Andrew Weiss, Docker Federal Sales Engineer and breaks down the core concepts of Docker and how it applies to government IT environments and unique regulatory compliance requirements. The presentation highlights how Docker Enterprise Edition can help agencies build a secure cloud-first government.

Watch the on-demand webinar to learn how Docker is transforming the way government agencies deliver secure, reliable, and scalable services to organizations and citizens.

Here are the questions from the live session:
Q: Is Docker Datacenter available both hosted and as a cloud offering?
A: Docker Datacenter is now a part of Docker Enterprise Edition (EE) &#8211; providing integrated container management and security from development to production. Docker EE provides a unified software supply chain for all apps—commercial off the shelf, homegrown monoliths to modern microservices written for Windows or Linux environments on any server, VM or cloud. Docker EE can be deployed on-premises (bare metal or VMS) or on any cloud provider.
Q: Can you install regular Windows Server apps into Docker containers in Windows 2016?
A: YES. Docker running containers on Windows is the result of a two-year collaboration between Microsoft that involved the Windows kernel growing containerization primitives, Docker and Microsoft collaborating on porting the Docker Engine and CLI to Windows to take advantage of those new primitives and Docker adding multi-arch image support to Docker Hub.
Q: From an implementation perspective, do you recommend one container per virtual machine or multiple containers?
A: We see a mix. Depending on the use case you will get a range in density of containers per virtual or bare metal machine. In some science and research communities, we have seen a use case of a 1:1 container to machine  where developers are looking purely for portability of their existing workloads. However, typically containers are ephemeral, running on average for a few minutes so that number is always changing depending on how that service is scaled out or back.
Q: How do you phrase the argument that a Linux kernel is the same everywhere?
A: The kernel: This is the one piece of the whole that is actually called “Linux”. The kernel is the core of the system and manages the CPU, memory, and peripheral devices. The kernel is the “lowest” level of the OS.
Q: Is the AWS Quick Start of Docker EE available for Gov Cloud?
A: Docker Enterprise Edition (EE) Basic, Standard and Advanced are all available in the AWS Marketplace for easy deployment of a highly available Docker EE environment in about 20 minutes. Built in accordance with best practices from AWS and Docker, these templates include the latest Docker software in a variety of regions and directly integrated with AWS services.
Q: Will license pricing remain the same from DDC to Docker EE?
A: Docker Datacenter (DDC) is now part of Docker Enterprise Edition (EE) Standard tier. The subscription price has not changed. Customers who have previously purchased DDC are entitled to the latest version of Docker EE Standard. For more information, visit www.docker.com/pricing.
Continue your Docker journey with these helpful links:

Register for the next Federal Webinar on April 4th
Try Docker Enterprise Edition for free
Learn more about Docker in Government
Save your seat for the Docker Federal Summit on May 2nd

Webinar recap: Docker 101 for federal governmentClick To Tweet

The post Webinar recap: Docker 101 for federal government appeared first on Docker Blog.
Quelle: https://blog.docker.com/feed/

da Agency

The K8sPort: Engaging Kubernetes Community One Activity at a Time

Editor’s note: Today’s post is by Ryan Quackenbush, Advocacy Programs Manager at Apprenda, showing a new community portal for #Kubernetes advocates: the K8sPort. The K8sPort is a hub designed to help you, the Kubernetes community, earn credit for the hard work you’re putting forth in making this one of the most successful open source projects ever. Back at KubeCon Seattle in November, I presented a lightning talk of a preview of K8sPort. This hub, and our intentions in helping to drive this initiative in the community, grew out of a desire to help cultivate an engaged community of Kubernetes advocates. This is done through gamification in a community hub full of different activities called “challenges,” which are activities meant to help direct members of the community to attend various events and meetings, share and provide feedback on important content, answer questions posed on sites like Stack Overflow, and more. By completing these challenges, you collect points and can redeem them for different types of rewards and experiences, examples of which include charitable donations, gift certificates, conference tickets and more. As advocates complete challenges and gain points, they’ll earn performance-related badges, move up in community tiers and participate in a fun community leaderboard. My presentation at KubeCon, simply put, was a call for early signups. Those who’ve been piloting the program have, for the most part, had positive things to say about their experiences.I know I&#039;m the only one playing with @K8sPort but it may be the most important thing the Kubernetes community has.— Justin Garrison (@rothgar) November 22, 2016“Great way of improving the community and documentation. The gamification of Kubernetes gave me more insight into the stack as well.”     – Jonas Kint, Devops Engineer at Showpad“A great way to engage with the kubernetes project and also help the community. Fun stuff.”      – Kevin Duane, Systems Engineer at The Walt Disney Company“K8sPort seems like an awesome idea for incentivising giving back to the community in a way that will hopefully cause more valuable help from more people than might usually be helping.”     – William Stewart, Site Reliability Engineer at SuperbalistToday I am pleased to announce that the Cloud Native Computing Foundation (CNCF) is making the K8sPort generally available to the entire contributing community! We’ve simplified the signup process by allowing would-be advocates to authenticate and register through the use of their existing GitHub accounts.If you’re a contributing member of the Kubernetes community and you have an active GitHub account tied to the Kubernetes repository at GitHub, you can authenticate using your GitHub credentials and gain access to the K8sPort.Beyond the challenges that get posted regularly, community members will be recognized and compile points for things they’re already doing today. This will be accomplished through the K8sPort’s full integration with GitHub and the core Kubernetes repository. Once you authenticate, you’ll automatically begin earning points and recognition for various contributions — including logging issues, making pull requests, code commits & more.If you’re interested in joining the advocacy hub, please join us at k8sport.org! We hope you’re as excited about what you see as we are to continue to build it and present it to you.For a quick walkthrough on K8sPort authentication and the hub itself, see this quick demo, below.–Ryan Quackenbush, Advocacy Programs Manager, Apprenda
Quelle: kubernetes

da Agency

Webinar Q&A: Introducing Docker Enterprise Edition (EE)

A few weeks ago we announced Docker Enterprise Edition (EE), the trusted, certified and supported container platform. Docker EE enables IT teams to establish a Containers as a Service (CaaS) environment to converge legacy, ISV and microservices apps into a single software supply chain that is flexible, secure and infrastructure independent. With a built in orchestration architecture (swarm mode) Docker EE allows app teams to compose and schedule simple to complex apps to drive their digital transformation initiatives.

On March 14th we hosted a live webinar to provide an overview and demonstration of Docker EE. View the recorded session below and read through some of the most popular questions.

Frequently Asked Questions
Q: How is Docker EE licensed?
A: Docker EE is licensed per node. A node is an instance running on a bare metal or virtual server. For more details visit www.docker.com/pricing
Q: Is Google Cloud also one of your certified infrastructure partners?
A: Docker EE is available today for both Azure and AWS. Google Cloud is currently offered as a private beta with Docker Community Edition. Learn more in this blog post and sign up at https://beta.docker.com 
Q: What technology is used for the security scanning and vulnerability features of Docker EE? Does security scanning have a separate license?
A: Docker Security Scanning is the technology that conducts binary level scanning of Docker images and continuous vulnerability monitoring. This capability is included in the Docker EE Advanced subscription tier.  A free 30 day trial is available for you to try security scanning.
Q: Will signing and scanning images and the vulnerabilities for that image work on any image that is internally developed or only images that are downloaded from the Docker Store?
A: Yes, signing and scanning works for any image that is pushed to the on-premises registry (DTR) that is part of Docker EE.
Q: Where can I see the key features included in each of the different Docker EE tiers?
A: There are three tiers: Basic, Standard and Advanced. A comparison table is available at www.docker.com/pricing. 

Q: Can we use the container management layer (UCP) with Docker Community Edition?
A: No. The container management (UCP) and image registry (DTR) are tested, validated and supported for the Docker EE certified infrastructure only.
Q: Can you run Docker Certified Containers over Docker CE Engine?
A: No. Certified Containers and Plugins are tested, validated and supported to the Docker EE certified infrastructure only.
Q: How does the licensing work for Certified Containers and Plugins downloaded from Docker Store?
A: Similar to many other software marketplaces, Docker Store provides an interface for the publisher to provide a pay as you go or BYOL style of container for the Docker Store. Entitlement and upgrades are managed through the Docker Store by the publisher. The publisher can determine the subscription price for the end user.
Q: What is the difference between Docker CE and Docker EE?
A: The Docker product page provides a comparison between Docker CE and EE. https://www.docker.com/get-docker. Docker CE provides a free Docker platform available for many community infrastructure. Docker EE is an integrated container management and security platform with certification and capabilities like role based access control, LDAP/AD integration, deployment policies and more.
Q: Can Docker EE be run within my enterprise or is it only run externally?
A: Docker EE can be deployed on-premises or in your VPC.
Q 12: Does EE Basic use use normal swarm since UCP is with the other versions?
A: Both Docker CE and EE have built in orchestration capabilities of swarm mode. Each node is a fully functioning building block to be a manager or worker node in the cluster.  With Docker Enterprise Edition, the integrated management UI builds on top of the built in swarm mode orchestration and integrates with the private registry and Role Based Access Controls to provide a robust platform for end to end container application management.
Q 13: What is the migration path from Docker Community Edition to Enterprise Edition?
A: The apps built on Docker CE will also run on Docker EE. However there is no in place migration of the cluster itself.  To migrate apps to a Docker EE environment, a new cluster will need to be set up and the same Compose files and images can be deployed as services to the new Docker EE environment.
For More Information:

Learn more about Docker CE and EE
Try Docker EE for free
Register for DockerCon 2017 and Federal Summit

The post Webinar Q&#038;A: Introducing Docker Enterprise Edition (EE) appeared first on Docker Blog.
Quelle: https://blog.docker.com/feed/

da Agency

Meet the winners of the Holberton School and Docker hackathon

The last weekend in February, Holberton School and Docker held a joint Docker Hackathon where current students spent 24 hours making cool Docker hacks. Students were joined by Docker mentors who helped them along the way in addition to serving as judges for the final products. 

Here are some highlights from the hackathon.
Third place goes to… Julien, a personal assistant built with Docker and Alexa by Bobby and Larry
In their own words:

After discussing a few ideas, we settled on the idea of doing a Docker/Alexa integration that would abstract away repetitive command line interactions, allowing the user/developer to check the state of her Docker containers, and easily deploy them to production, only using voice commands. Hands free, we would prompt Alexa to interact with our Docker images and containers in various ways (ex1: “spin up image file x on server y”, “list all running containers on server z”, “deploy image a from server x to server y”) and Alexa would do it.
The main technical hurdle of the project was securely communicating between Alexa and our VMs running. To do this we used  the Java JSch library. This class gave us the ability to programmatically shell into our virtual machines, run commands and receive the output remotely from the VM.  Here is a basic diagram of our the data flow: voice command→ Alexa intent interpreter (running on AWS Lambda) selects a bash script executing Docker commands with variables passed in → jsh opens a ssh session into the selected VM and runs script →  outputs of script returns via jsh →  Alexa interprets returned output and gives audio message declaring success or other output as appropriate.

Second place goes to… Call Me Moby — An SMS Container Management App by Corbin Coleman and Jennie Chu
Call Me Moby works in the following ways:
1. Your docker command text is received by our web server as a HTTP POST request
2. Twilio API interprets this request and reads your message as text
3. This text is later parsed and then interacts with the Docker Engine API to perform your operation.
4. We then send back our response to the web server, often times including a text message reply with necessary return statements
5. Finally our message will be sent and received by our phone.
How Can You Use it? Grab the Call Me Moby image from Docker Hub.
In their own words:
Our app.py file contains the brute of the application, handling incoming HTTP requests, maintaining our web server, and utilizing both the Docker Engine and Twilio API. Try running the python3 app.py and go open your local host on your favorite web browser!
Unfortunately, the current app is only running in the local environment and in order for our server to receive the HTTP request, we has to use the ngrok tunneling service. Ngrok provides a localhost tunnel such that outside services can get access to our local development environment. After installation, run Ngrok locally using ./ngrok http 5000, to create your forwarding address. You can also copy and paste your forwarding address into your web browser and see that now any machine can have access to our local environment. Assuming you have a Twilio Account and phone number, just copy and paste your forwarding address to your Twilio phone number management console. From there, run your app.py and start texting and managing!

And the winner is … (drum roll please)&#8230; HMS (Honeypot Management System) by Holden Grissett by Tim Britton
In their own words:

HMS (Honeypot Management System, also a great naval pun) is a honeypot server custom-tailored to make use of the modularity of containers for extensibility and security. We adapted the honeypot server for use in swarm mode to demonstrate the use of container-based honeypots at scale in swarm mode. This system allows us to easily scale up data collection for security research.

HMS currently includes a server to mimic an insecure telnet service, made for the hackathon. Upon connection to the server, a container is spun up for each client. The client’s input is parsed and can either be sent directly to the container and the response sent directly to the client (to give the illusion that they’re directly inside the container), or commands can have pre-scripted responses, or blocked entirely for security. It’s currently set-up to mimic a Busybox installation, but with minor tweaking could easily emulate any image on Docker Store! At current it easily passes tests made by Mirai and Hajime botnets. When these bots seemingly successfully download their malware and exit the server, the container is checked for differences and any downloaded or created files are tar’d and saved for logging purposes.
Going forward, we are extending our functionality to make deploying honeypot images in swarm mode faster and easier. We would also like to extend functionality to existing honeypots and create more of our own container-based honeypots.

Get involved with the Docker Community:

Join the Docker Community Directory and Slack
Join your local Docker Meetup Group
Join our Docker Online meetup

The post Meet the winners of the Holberton School and Docker hackathon appeared first on Docker Blog.
Quelle: https://blog.docker.com/feed/

da Agency

Learn Docker with our DockerCon 2017 Hands-On Labs

We’re excited to announce that #DockerCon 2017 will feature a comprehensive set of hands-on labs. We first introduced hands-on labs at DockerCon EU in 2015, and they were also part of DockerCon 2016 last year in Seattle. This year we’re offering a broader range of topics that cover the interests of both developers and operations personnel on both Windows and Linux (see below for a full list)
These hands-on labs are designed to be self-paced, and are run on the attendee’s laptop. But, don’t worry, all the infrastructure will be hosted again this year on Microsoft Azure. So, all you will need is a laptop capable of instantiating a remote session over SSH (for Linux) or RDP (for Windows).

We’ll have a nice space set up in between the ecosystem expo and breakout rooms for you to work on the labs. There will be tables and stools along with power and wireless Internet access as well as lab proctors to answer questions. But, because of the way the labs are set up, you could also stop by, sign up, and take your laptop to a quiet spot and work on your own.
As you can tell, we’re pretty stoked on the labs, and we think you will be to.
See you in Austin!
DockerCon 2017 Hands-on Labs

Title

Abstract

#Docker Orchestration

In this lab you can play around with the container orchestration features of Docker. You will deploy a Dockerized application to a single host and test the application. You will then configure Docker Swarm Mode and deploy the same application across multiple hosts. You will then see how to scale the application and move the workload across different hosts easily.

Docker Networking

In this lab you will learn about key Docker Networking concepts. You will get your hands dirty by going through examples of a few basic concepts, learn about Bridge and Overlay networking, and finally learning about the Swarm Routing Mesh.

Modernize .NET Apps &#8211; for Devs.

A developer’s guide to app migration, showing how the Docker platform lets you update a monolithic application without doing a full rebuild. You’ll start with a sample app and see how to break components out into separate units, plumbing the units together with the Docker platform and the tried-and-trusted applications available on Docker Hub.

Modernize .NET Apps &8211; for Ops.

An admin guide to migrating .NET apps to Docker images, showing how the build, ship, run workflow makes application maintenance fast and risk-free. You’ll start by migrating a sample app to Docker, and then learn how to upgrade the application, patch the Windows version the app uses, and patch the Windows version on the host &8211; all with zero downtime.

Getting Started with Docker on Windows Server 2016

Get started with Docker on Windows, and learn why the world is moving to containers. You’ll start by exploring the Windows Docker images from Microsoft, then you’ll run some simple applications, and learn how to scale apps across multiple servers running Docker in swarm mode

Building a CI / CD Pipeline in Docker Cloud

In this lab you will construct a CI / CD pipeline using Docker Cloud. You&#8217;ll connect your GitHub account to Docker Cloud, and set up triggers so that when a change is pushed to GitHub, a new version of your Docker container is built.

Discovering and Deploying Certified Content with Docker Store

In this lab you will learn how to locate certified containers and plugins on docker store. You&8217;ll then deploy both a certified Docker image, as well as a certified Docker plugin.

Deploying Applications with Docker EE (Docker DataCenter)

In this lab you will deploy an application that takes advantage of some of the latest features of Docker EE (Docker Datacenter). The tutorial will lead you through building a compose file that can deploy a full application on UCP in one click. Capabilities that you will use in this application deployment include:

Docker services
Application scaling and failure mitigation
Layer 7 load balancing
Overlay networking
Application secrets
Application health checks
RBAC-based control and visibility with teams

Vulnerability Detection and Remediation with Docker EE (Docker Datacenter)

Application vulnerabilities are a continuous threat and must be continuously managed. In this tutorial we will show you how Docker Trusted Registry (DTR) can detect known vulnerabilities through image security scanning. You will detect a vulnerability in a running app, patch the app, and then apply a rolling update to gradually deploy the update across your cluster without causing any application downtime.

 
Learn More about DockerCon:

What’s new at DockerCon?
5 reasons to attend DockerCon
Convince your manager to send you to DockerCon
DockerCon for Windows containers practitioners 

Check out all the Docker Hands-on labs at DockerCon #learndockerClick To Tweet

The post Learn Docker with our DockerCon 2017 Hands-On Labs appeared first on Docker Blog.
Quelle: https://blog.docker.com/feed/

da Agency

Learn Docker with our DockerCon 2017 Hands-On Labs

We’re excited to announce that #DockerCon 2017 will feature a comprehensive set of hands-on labs. We first introduced hands-on labs at DockerCon EU in 2015, and they were also part of DockerCon 2016 last year in Seattle. This year we’re offering a broader range of topics that cover the interests of both developers and operations personnel on both Windows and Linux (see below for a full list)
These hands-on labs are designed to be self-paced, and are run on the attendee’s laptop. But, don’t worry, all the infrastructure will be hosted again this year on Microsoft Azure. So, all you will need is a laptop capable of instantiating a remote session over SSH (for Linux) or RDP (for Windows).

We’ll have a nice space set up in between the ecosystem expo and breakout rooms for you to work on the labs. There will be tables and stools along with power and wireless Internet access as well as lab proctors to answer questions. But, because of the way the labs are set up, you could also stop by, sign up, and take your laptop to a quiet spot and work on your own.
As you can tell, we’re pretty stoked on the labs, and we think you will be to.
See you in Austin!
DockerCon 2017 Hands-on Labs

Title

Abstract

#Docker Orchestration

In this lab you can play around with the container orchestration features of Docker. You will deploy a Dockerized application to a single host and test the application. You will then configure Docker Swarm Mode and deploy the same application across multiple hosts. You will then see how to scale the application and move the workload across different hosts easily.

Docker Networking

In this lab you will learn about key Docker Networking concepts. You will get your hands dirty by going through examples of a few basic concepts, learn about Bridge and Overlay networking, and finally learning about the Swarm Routing Mesh.

Modernize .NET Apps &#8211; for Devs.

A developer’s guide to app migration, showing how the Docker platform lets you update a monolithic application without doing a full rebuild. You’ll start with a sample app and see how to break components out into separate units, plumbing the units together with the Docker platform and the tried-and-trusted applications available on Docker Hub.

Modernize .NET Apps &8211; for Ops.

An admin guide to migrating .NET apps to Docker images, showing how the build, ship, run workflow makes application maintenance fast and risk-free. You’ll start by migrating a sample app to Docker, and then learn how to upgrade the application, patch the Windows version the app uses, and patch the Windows version on the host &8211; all with zero downtime.

Getting Started with Docker on Windows Server 2016

Get started with Docker on Windows, and learn why the world is moving to containers. You’ll start by exploring the Windows Docker images from Microsoft, then you’ll run some simple applications, and learn how to scale apps across multiple servers running Docker in swarm mode

Building a CI / CD Pipeline in Docker Cloud

In this lab you will construct a CI / CD pipeline using Docker Cloud. You&#8217;ll connect your GitHub account to Docker Cloud, and set up triggers so that when a change is pushed to GitHub, a new version of your Docker container is built.

Discovering and Deploying Certified Content with Docker Store

In this lab you will learn how to locate certified containers and plugins on docker store. You&8217;ll then deploy both a certified Docker image, as well as a certified Docker plugin.

Deploying Applications with Docker EE (Docker DataCenter)

In this lab you will deploy an application that takes advantage of some of the latest features of Docker EE (Docker Datacenter). The tutorial will lead you through building a compose file that can deploy a full application on UCP in one click. Capabilities that you will use in this application deployment include:
&8211; Docker services
&8211; Application scaling and failure mitigation
&8211; Layer 7 load balancing
&8211; Overlay networking
&8211; Application secrets
&8211; Application health checks
&8211; RBAC-based control and visibility with teams

Vulnerability Detection and Remediation with Docker EE (Docker Datacenter)

Application vulnerabilities are a continuous threat and must be continuously managed. In this tutorial we will show you how DTR can detect known vulnerabilities through image security scanning. You will detect a vulnerability in a running app, patch the app, and then apply a rolling update to gradually deploy the update across your cluster without causing any application downtime.

 
Learn More about DockerCon:

What’s new at DockerCon?
5 reasons to attend DockerCon
Convince your manager to send you to DockerCon
DockerCon for Windows containers practitioners 

Check out all the Docker Hands-on labs at DockerCon #learndockerClick To Tweet

The post Learn Docker with our DockerCon 2017 Hands-On Labs appeared first on Docker Blog.
Quelle: https://blog.docker.com/feed/