Running Docker in Production - The Good, the Bad and The Ugly
•Télécharger en tant que PPTX, PDF•
2 j'aime•1,623 vues
When beginning to run Docker in production choosing the right path is critical. This presentation gives you some tips and suggestions on how to make this process easier.
Recommandé
Recommandé
Contenu connexe
Tendances
Tendances (20)
En vedette
En vedette (20)
Similaire à Running Docker in Production - The Good, the Bad and The Ugly
Similaire à Running Docker in Production - The Good, the Bad and The Ugly (20)
Dernier
Dernier (20)
Running Docker in Production - The Good, the Bad and The Ugly
- 1. Docker in Production The Good, The Bad and The Ugly Jari Kolehmainen, CTO & Co-founder
- 2. © 2016 Kontena, Inc.
- 3. Pick the Right Path
- 9. DON’T DO IT (unless you are forced)
- 10. Rent? AWS ECS Azure Container Service Google Container Engine
- 12. Rent ”I don’t want to maintain anything” Works for some use cases
- 13. Platform? Docker Swarm (the new one) Kubernetes Kontena DCOS
- 15. Platform Most features built-in Less maintenance Battle tested
- 16. Docker Engine
- 17. Docker Engine Tweak defaults Needs “janitors” Prefer container “native” hosts
- 18. Docker Engine Graphdriver of the day: overlay2 Engine plugins: run outside Keep engine & kernel up-to-date
- 19. Docker Engine 3rd parties might cause side-effects Systemd <> Overlay networks Cadvisor <> Docker mounts
- 20. CI/CD Pipeline
- 23. Pipeline Script everything Version control everything Yes, everything
- 26. Pipeline Example
- 27. 1. Git Push 2. Trigger Build 3. Push Docker Image 4. Trigger Deploy 5a. Deploy to Staging 5b. Deploy to Production Pull Docker Image
- 28. Security
- 30. Security Security patching Network access Secret management Audit
- 31. Patching Container “native” OS Configuration management Image scanning
- 32. Network Security Overlay (SDN) networks Network segments/policies Firewalls
- 33. Secret Management Keep secrets out Use platform provider solution Integrate 3rd party solution to pipeline
- 37. But why? Hosts fail Engines fail Containers fail Your app crashes
- 38. Ok, is all hope lost?
- 39. Rules for chaos Allow hosts to die Trust the scheduler Use clustered databases Outsource state if possible
- 40. Summary
- 41. Summary Prepare properly Tweak defaults Automate everything Use battle tested solutions
- 42. QA Ask and get a shirt!!!
Notes de l'éditeur
- For many newcomers production feels a bit scary I have seen & experienced many production deploys .. And heard many things from other users First production deploy: Docker 0.6 There is no ”one true way”, but I’ll tell my tips anyway
- One of the most critical things Sometimes this path has been already chosen, bad luck
- Docker engine, Rkt Many smaller parts
- Put everything together with duct tape First weeks are fun & you learn a lot Everyone should try this, once
- After few weeks/months system looks like this, a perfectly working system You have every feature that you need, and still some duct tape for the future What if that generator dies?
- - too often afterthought
- Patch host AND your images How to detect security issues?
- Overlay can provide transparent network level security
- - platforms: Kontena Vault, Kubernetes secrets, Swarm mode upcoming secrets -> check that secrets implementation matches your requirements - 3rd party: Hashicorp Vault, Square Keywhiz
- Audit logs: some platforms provide this out-of-the-box Container logs: some platforms provide support, otherwise DIY Container logs: ELK, Splunk etc…
- Mix bleeding edge components to cluster