Docker EE Deep Dive
2 likesā¢1,269 views
The document provides a comprehensive overview of Docker Enterprise Edition (EE), detailing its features, architecture, and components. It highlights the difference between Docker EE and Community Edition, emphasizing the enterprise-grade capabilities such as integrated orchestration, security, and management. Additionally, it describes functionalities like image scanning, signing, caching, promotion, and mirroring for efficient container management within the software supply chain.
![$ docker history pdevine/partyparrot:1.0
IMAGE CREATED CREATED BY
4e21821ad0d9 5 minutes ago /bin/sh -c #(nop) ENTRYPOINT [ā/parrotā]
880254b79668 5 minutes ago /bin/sh -c #(nop) ADD file:6e64234...
6aa638b57d74 5 minutes ago /bin/sh -c apk update && apk add pcre
4a415e366388 6 weeks ago /bin/sh -c #(nop) ADD file:730030a...](https://image.slidesharecdn.com/at7iuux5rvgpx3bb4fqj-signature-489da668bf3c61b23eb03fb423ab2ad7c1229ab1d093aedca05b1c3ce037544b-poli-171025011646/85/Docker-EE-Deep-Dive-13-320.jpg)
![{...
ālayer_detailsā: [
ācomponentsā: [
{
ācomponentā: ācoreutilsā,
āversionā: ā8.22ā,
ā¦
},
ā¦
],
],
}](https://image.slidesharecdn.com/at7iuux5rvgpx3bb4fqj-signature-489da668bf3c61b23eb03fb423ab2ad7c1229ab1d093aedca05b1c3ce037544b-poli-171025011646/85/Docker-EE-Deep-Dive-16-320.jpg)
![{...
ālayer_detailsā: [
ācomponentsā: [
{
ācomponentā: ācoreutilsā,
āversionā: ā8.22ā,
āvulnsā: [
{
āvulnā: {
ācveā: āCVE-2014-3639ā,
ācvssā: 2.1,
ā¦
}
}, ā¦
],
},
ā¦
],
],
}](https://image.slidesharecdn.com/at7iuux5rvgpx3bb4fqj-signature-489da668bf3c61b23eb03fb423ab2ad7c1229ab1d093aedca05b1c3ce037544b-poli-171025011646/85/Docker-EE-Deep-Dive-17-320.jpg)
Docker EE Deep Dive
- 1. Product Deep Dive Docker Enterprise Edition Patrick Devine Product Manager, Docker @pdev110
- 2. A little about me...
- 3. Enterprise Edition (EE) ā¢ Paid Docker subscription ā¢ Includes support from Docker ā¢ Predictable biannual releases ā¢ Certified partner ecosystem ā¢ Enterprise-grade features (security, management, automation) Recommended for production use Enterprise & Community Editions ā¢ Free for ādo it yourselfā dev & ops ā¢ Does not include support ā¢ Quarterly Stable release for ops ā¢ Monthly Edge release for developers Community Edition (CE)
- 4. Docker Enterprise Edition (EE) CaaS enabled platform for the modern software supply chain ā¢ Integrated orchestration, security and management ā¢ Stable releases with 1 year of support and maintenance ā¢ Security patches and hotfixes backported to all supported versions ā¢ Enterprise class support (9am-6pm or 24x7x365) ā¢ Certified Infrastructure, Containers and Plugins docker enterprise edition
- 5. Docker EE Components Public Cloud Virtual Physical docker enterprise edition ADVANCED INTEGRATED SECURITY docker trusted registry image management docker universal control plane app & cluster management docker engine container runtime, orchestration, networking, volumes, plugins CI/CD Images Operating Systems Volumes Monitoring Logging more...
- 6. Docker EE Architecture Node UCP manager Raft consensus group Internal distributed store Node UCP manager Node UCP manager
- 7. Docker EE Architecture Node UCP manager Raft consensus group Internal distributed store Node UCP manager Node UCP manager Node UCP worker Node UCP worker Node UCP worker Node UCP workerAdmin / User Deploy / Manage
- 8. Docker EE Architecture Node UCP manager Raft consensus group Internal distributed store Node UCP manager Node UCP manager Node UCP worker Node UCP worker Node UCP worker Node UCP workerAdmin / User Deploy / Manage Pull / Push Image registry BYO TCP load balancer Node DTR replica Logging Monitoring Image storage External CALDAP/AD Add-ons Node DTR replica Node DTR replica
- 9. Image Security: ā Image Scanning ā Image Signing Letās dive into the features!
- 10. ā¢ Scans at a binary level ā Not just looking at package versions ā¢ Works both online and offline ā New vulnerability database released daily ā Great for air gapped scenarios (sneaker net!) ā¢ Scans both Linux (x86_64) and Windows ā¢ Coming soon for IBM z Series Image Scanning available now
- 13. $ docker history pdevine/partyparrot:1.0 IMAGE CREATED CREATED BY 4e21821ad0d9 5 minutes ago /bin/sh -c #(nop) ENTRYPOINT [ā/parrotā] 880254b79668 5 minutes ago /bin/sh -c #(nop) ADD file:6e64234... 6aa638b57d74 5 minutes ago /bin/sh -c apk update && apk add pcre 4a415e366388 6 weeks ago /bin/sh -c #(nop) ADD file:730030a...
- 16. {... ālayer_detailsā: [ ācomponentsā: [ { ācomponentā: ācoreutilsā, āversionā: ā8.22ā, ā¦ }, ā¦ ], ], }
- 17. {... ālayer_detailsā: [ ācomponentsā: [ { ācomponentā: ācoreutilsā, āversionā: ā8.22ā, āvulnsā: [ { āvulnā: { ācveā: āCVE-2014-3639ā, ācvssā: 2.1, ā¦ } }, ā¦ ], }, ā¦ ], ], }
- 19. Image Signing ā Docker Content Trust built in to DTR ā Enforcement can be done in UCP ā Only valid signers can deploy containers ā docker trust makes things easier than ever ā More to come at Ashwini and Andyās talk at 13h30 coming soon
- 20. Image Distribution: ā Image Caching ā Image Promotion ā Image Mirroring Letās dive into the features! coming soon
- 21. Phase 1: image content cache Phase 2: image promotion Phase 3: image mirroring Image Caching, Promotion, & Mirroring docker dtr docker dtr slow fast dtr dev / qa / staging / prod / repo / dtr dev repo / dtr stage
- 22. Image Caching ā Caches image layers closer to where itās being consumed for faster pulls (CDN for docker images) ā Works globally for all repositories in DTR ā Preserves access permission for each individual repository of the DTR available now docker dt r docker dt r slow fast
- 23. Use Case: Without Content Cache... slow... San Francisco, USA Copenhagen, Denmark dtr dev/hello-world:latest build layer A layer B 1 2
- 24. Use Case: With Content Cache! fast San Francisco, USA Copenhagen, Denmark Content Cache dtr dev/hello-world:latest build layer A layer B 1 2 3 4 layer A layer B
- 25. Image Promotion ā Promotes āblessedā images from one repository to a different repository in the same DTR ā Repositories each have their own access control ā Images can be re-tagged automatically to a new tag ā Can be done āmanuallyā or automatically by a āpolicyā available now dev / qa / staging / prod /
- 26. Use Case: Promotion Flow
- 27. Promotion Policy Criteria ā Tagged with a certain tag ā Doesnāt contain any vulnerabilities above a threshold (critical, major, minor) ā Package exists or is greater or less than a certain version ā Is greater than (or less than) a certain size ā Doesnāt contain a certain type of license (e.g. GPLv3)
- 28. Advanced Use Case: Promotion Chaining
- 29. Advanced Use Case: Promotion Branching
- 30. Image Mirroring ā Promotes āblessedā images from one repository to a different one in a different DTR ā Registries each have their own access control ā Mirroring is bi-directional. Can be done via āpushā or āpullā ā Policies can be used to automatically push to remote DTRs com ing soon repo / docker dtr dev repo / docker dtr stage
- 31. Image Mirroring (push based) ā Image is pushed to DTR 1 ā If the policy is met (e.g. no vulnerabilities) image is pushed to DTR 2 ā AuthN and AuthZ managed by each individual DTR ā Signing / Scan data not (yet) preserved dtr 2dtr 1 1 2 Build
- 32. Image Mirroring (pull based) ā Image is pushed to DTR 1 ā DTR 2 polls DTR 1 at specified intervals to check for updates ā If new images are found, image is pulled to DTR 2 dtr 2dtr 1 1 2 3 Build
- 33. Image Mirroring (pull based w/ webhook) ā Image is pushed to DTR 1 ā DTR 1 notifies DTR 2 that a new image exists ā DTR 2 contacts DTR 1 and pulls the image dtr 2dtr 1 Build 1 2 3 4
- 35. San Francisco, USA build dev/hello-world dtr us-west qa/hello-world Push1
- 36. San Francisco, USA build dev/hello-world dtr us-west qa/hello-world Promote after clean scan 2 Push1
- 37. San Francisco, USA build dev/hello-world dtr us-west qa/hello-world Copenhagen, Denmark Content Cache Push1 Cache3 Promote after clean scan 2
- 38. San Francisco, USA build dev/hello-world dtr us-west qa/hello-world Copenhagen, Denmark Content Cache Push1 Cache3 New York, USA stage/hello-world dtr us-east prod/hello-world Mirror4 Promote after clean scan 2
- 39. San Francisco, USA build dev/hello-world dtr us-west qa/hello-world Copenhagen, Denmark Content Cache Push1 Cache3 New York, USA stage/hello-world dtr us-east prod/hello-world Mirror4 Promote5 Promote after clean scan 2
- 40. Docker EE Hosted Demo ā Free 4 Hour Demo ā No Servers Required ā Full Docker EE Cluster Access docker.com/trial