Docker 1.12: Now with Built-In Orchestration
blog.docker.com
blog.docker.com
That's bundling an CP application into seemingly AP infrastructure (from what I gleaned from their docs). Completely the wrong tool for the job. If the application was designed for that it would have recovered. In your defense, they have nothing to warn about that in their documentation.
Not saying that's a good idea, but it is getting closer.
You could, for example, have a node that's only for DBs that has volumes on it. You could then use DRBD on the host to clone that data to a secondary node. then in the event that node 1 dies swarm would bring the DB up on node2.
With the mesh network stuff they've added the endpoint would remain the same, so all your apps would need to do would be re-connect.
No, that isn't getting closer it's getting farther away. The whole point of containers is that they make the host machine completely fungible. If I can only schedule my DB containers on a specific machine then I might as well just run my DB on that machine and be done with it.
I'm saying that, if you want, you CAN make it guarantee that a container will be rescheduled to the same host. (or a controlled level of hosts).
I don't think it's docker's responsibility to solve database clustering.
And, as I said, I'm not advocating running a production DB in docker. But I can see a way that you may be able to.
> I don't think it's docker's responsibility to solve database clustering.
I don't know if I'd call it a responsibility. But Docker is obviously trying to expand their platform into more and more aspects of containerization. If they figured out persistence that would really set them apart, something that this product doesn't really do. It mostly just keeps them even with Kubernetes at best. And an imitation of it at worst.
100% agree with you there.
> It mostly just keeps them even with Kubernetes at best. And an imitation of it at worst.
Personally, when I looked at kubernetes, mesos, etc and saw the xml hell that i'd be living in and said "no way".
If i have to run something as complex as those to have docker then it's not worth it to me.
When I look at the new docker swarm stuff. For the first time I think that docker is a viable thing (assuming it all works). because I'm not adding additional complexity to get my docker simplicity.
Volumes are exactly what you should be using to have data that lives beyond the life of the container. Essentially, if you are writing to disk in your container, you should probably be writing it to a volume.
Volumes can be backed by any number of storage solutions, including from every cloud provider, various distributed block, gluster, ceph, etc...
Docker should _not_ be changing the way you run a database. If you need a highly available database, you don't use 1 database process and hope for the best, you use the built-in replication features available in just about every database product in existence today... database goes down, oh well you have a hot-standye ready.
That is, Docker is just a packaging system + a tool to spawn the deployed stuff in an isolated environment. Now, 3 years after, they've improved dependencies (previously done by docker-compose + hacks for using it in production).
That is, I use Docker only because its images are somewhat easier to build and deploy, compared to .deb packages or plain tarballs (and it's more OS-agnostic, since Docker Machine's available on Windows and OS X, so I can just build an image with dev. environment and don't care what OS is used). Doubt it's something more than this.
There is a technology for that already: it's called OS packaging. Docker does not maintain enough metadata to allow for in-place upgrades of individual components in an image (software and configuration lifecycle management). The best you can do with Docker is install lumps, you can forget upgrades. Docker is not a replacement for configuration management, and specifically, Docker is not a replacement for the operating system's software management subsystem.
Your missing the point of a container, you don't upgrade them in place
On SmartOS, when you provision a zone, you get a fully virtualized UNIX server, and you can apply a container to it by defining resource constraints, but that is both pointless and unnecessary there. Once you have a fully virtualized server provisioned from an image with the imgadm(1M) and vmadm(1M), it is only logical that you will want to service individual components via pkg_rm and pkg_add, rather than baking an entire image all over again, and redeploying it, all over again. It's the rule of modularity: "write simple parts connected by clean interfaces" [Kernighan-Plaguer], and it applies particularly well to lightweight virtualization.
Docker is just a quick-and-dirty way to have a full system image. It's somewhat simpler than building a proper .deb (.rpm, .tar.xz, whatever one distro eats) package, especially when there's a ton of dependencies from other packaging systems (PyPI, Ruby gems, npm packages, etc.)
Oh, and unlike with many popular OS packaging systems, with Docker can actually have multiple versions of the same "package" "installed" at the same time (that's my biggest issue with dpkg), but IIRC there are no built-in provision for the migration scripts (prerm, postinst - this sort of stuff).
Docker has support for a wide-array of storage solutions, everything from the various providers solutions (ebs, s3, gce storage, azure storage), to vsphere, netapp, scaleio, various distributed block solutions, nfs etc...
You should _not_ be changing the way you handle storage just because you are in a container. Use the tools you already have. If you need HA on a database, use the built-in replication service available on just about every database product in existence. If you really want distributed/shared storage, see the list above.
Containers are not black boxes.
There are often valid reasons to not do this. For example, MySQL does not guarantee consistency between a source and its destination. mysqlrplsync can do this as a bandage, but it's something extra you need to set up and configure.
Replication != backup
You mean exactly like zones handle it inside of SmartOS (;-))
The ZFS storage pool is abstracted away from the zone the virtual server runs on, and since it is persistent, it's completely out of the way, JustWorks(SM).
Back in my previous project using Cordova, I made the Docker workflow work adequately by offloading builds to web-based build services like PhoneGap Build and Ionic Package (building only a thin live-reloading wrapper app that points to a configurable IP:port for development). But my new project uses React Native, and I haven't found any similar build services for React Native apps (or even just regular native apps) yet. Anyone have any suggestions?
check out weave for managing networking, IMO it's much easier and I'm not even talking about the docker plugin. just use weave without the plugin and it works amazingly well.
for the configuration aspect, just use dockerfiles and a system like mesos and marathon for deploying production.
you can then write simple restful API commands to launch different environments with marathon.
build all your docker containers to act as single server instances, i.e., spark on one container, SQL on another.
tie in a default install of cadvisor on all mesos clients and you can have easy monitoring as well.
Yeah I see where you are coming from. First time I heard about Docker, I thought it did what NixOS does, but it doesn't really.
With that it is really weired to read all complains and issues about volumes management. It seems Docker just picked up wrong model for their storage. Then they try forever to fix impedance mismatch between that model and how people want to use Docker.
I think the biggest issue is around the `-v` syntax (and the corrosponding API). In the UX we call things a volume which are actually a mount (which happen to use a volume). I like the way we have implemented this in the new services API.... `docker run --mount type=volume,source=important_data,volume-driver=foo,volume-options=...`
For example, it is very useful to have a shell view of all volumes for the application to poke inside or debug issues. Surely I can do docker run ubuntu and mount all relevant volumes under /mnt there, but that is not user friendly.
Or consider that during development or debugging I want to transfer the state to another machine. Why it is not possible to tar all application volumes with single command and restore them in a new place again with single command? I.e, something similar for docker save/load, but for volumes?
All those issues are trivially solvable if I use some directory on a file system for the whole application state and use subdirectories there for individual volumes for the containers and then pass those with -v to relevant containers.
On the other side devs were asking for jenkins for that process. We run also Jenkins on Docker but it's cumbersome as it doesn't allow declarative configuration. There are dozen of plugins out there but it doesn't change the fact that the outcome is ressource hungry and slow. For now we are actually optimizing using Job-DSL plugin. We reached our target, but it was extremly time consuming and pain. For a new project I'm in, maybe we go to replace jenkins with concourseci or drone.
Imho a PaaS doesn't solve processual versioning and testing requirements. For that you still need further tools - with or without docker.
I love Concourse. Look me up if you have questions.
It doesn't really make sense to use Docker without some sort of distributed scheduling/orchestration system like Kubernetes, Docker Swarm or Mesos.
I think the first few years of Docker were just pointless but I genuinely feel that it is all starting to come together now.
Docker 1.12 looks promising on the orchestration front - Hopefully they will back all these new features with thorough documentation (which I found lacking in Swarm when compared to K8s).
It looks like Swarm is just following in K8s' footsteps and maybe even improving things along the way.
Based on what I just read, it looks like Docker Swarm might finally be a serious contender to K8s.
I guess this was to be expected, but it's also kind of sad. I think it would have been a more strategic move to embrace Kubernetes instead of trying to compete with it.
https://docs.google.com/document/d/1dYxInIUDTm4HEArQ9Hom_1Nh...
I should clarify: CoreOS + Kubernetes using rocket by default. From what I understand, CoreOS is driving the effort to get rocket supported by Kubernetes. K8S looks like it is going for agnostic implementation.
Disclaimer - I work on Kubernetes
Few companies are investing in making money by selling tools. Instead, you see Google/Amazon/Microsoft improving their cloud offerings and hoping you will your money there. They are giving away their tools (Kubernetes, Visual Studio, etc) hoping their environments become more attractive to you.
I hope we are not repeating history with the "DAB" the same way the container spec in the past. The industry is tired of these format fights and we need standardization to move things forward. I would put more faith in the "DAB" format if it was announced as something coming from the CNCF or similar. During the keynote the Atomic Nulecule [1] format came to mind... I don't know how it compares but it looks similar.
Here's my theory.
Kubernetes is a product given away to entice you to buy a service from Google. (Edit: a better way to put this is that Google have nothing to lose and everything to gain from giving away Kubernetes, insofar as GCP has the best hosted Kubernetes offering).
Docker can't make money from a service, so they need to sell a product.
Disclaimer: I work for Pivotal, we donate the majority of engineering to the Cloud Foundry project. Insofar as Docker are moving back into PaaSes, we're competitors.
If people start running their apps on Kubernetes, even on AWS- Google has a shot at getting them over to GCE/GKE. On the other hand, apps that are tied tightly to AWS services are very difficult to move.
Docker 1.12 does just what Docker does best: Making complex stuff simple to use and give control back to people.
The only GCE specific thing is Google's managed kubernetes offering, Google Container Engine (confusingly called GKE).
Doesn't seem that docker inc upstream takes stability seriously from my standpoint.
There are several people looking how we can resolve issues like this.
The way to solve this is not use the `--userland-proxy=false` function.
That being said the one giant omission from Docker is still seems to be management of volumes/data. Great, we can run 100 nodes on AWS in a matter of minutes, but if your system has data storage requirements (ex: Almost every database ever) ... You're kinda left up to your own still. How does Docker Orchestration migrate the data volumes?
They really tried to sell this as "You don't need to do anything but the AWS beta, the DAB and a few commands" which would be wonderful. However with the need for reliable data storage... you're still stuck doing everything "the old fashion way".
(Edit: No, I don't mean store data IN the container, I presume no one is that silly. I meant the attached volumes. No volume mgmt = less greatly less helpful).
You also should conside that docker might not be the best option as opposed to just some vms on openstack for your much needed databases.
I'm stuck trying convince my co-workers that docker is not the answer to everything.
What I actually meant was as "there is no way to deal with volumes". So spinning up 100 instances and hot failover doesn't help if it doesn't deal with the attached volumes. Without that functionality, the orchestration is less magic and more "eh".
If you are trying to store a MySQL database inside of a Docker container, you are missing the whole point.
This just means you need two systems to handle job creation, migration, replication, and load balancing. Everything you listed for docker containers is also needed for databases.
You need to remember: At scale, nothing is persistent. You need to notice a failure in your database systems,tear down the broken one, spin up a new instance, migrate the data from a replica, and keep on going.
Ultimately how do you manage data when it's not in a container? This is how you should be managing data inside the container as well, and docker provides an abstraction for doing this.
P.S. if you are at DockerCon, come to my talk on storage in Docker tomorrow @ 2:25
The answer to, "Ultimately how do you manage data when it's not in a container?" is, "Well, today, I spin up a new VPS and clone the database from the master (or a designated read-only slave) on first boot." Obviously that is not the pattern we want to pursue here.
It seems like the answer to the GP's question is that you have to build out the storage container cluster infrastructure in addition to your compute container cluster infrastructure, or move to a provider that offers both aaS. I don't know if that's GlusterFS or something else. This is where people like me need guidance, and on how to orchestrate storage containers with compute containers.
All someone can do is educate on the pros and cons of different solutions.
The big advantage having a built-in Docker orchestration is that Kubernetes is painful to install from scratch. (Yes, there are scripts to help mitigate this; yes, GKE is effectively hosted Kubernetes). I'm involved in another Dockerization projection, but we don't know if we want to invest the time into setting up Kubernetes (though GKE is an option). This would be a good time to check things out.
Just to show how quickly things change. In 2015, I tried the docker compose, AWS ECS, and Kubernetes for production deployment, and of all of them, Kubernetes addressed the pain points in a practical way. The Kubernetes project ended in late 2015, and now six months later, things changed again ...
It's mature, has been scaled to 10,000 real app containers in a single install with a 250,000-container milestone coming soon, belongs to an independent foundation instead of a single company, runs on AWS, Azure, GCP, OpenStack, vSphere with more coming.
It handles routing, service injection, logging, container orchestration and a whole bunch of other bits and bobs. You can get started by just pushing your sourcecode, or you can provide container images, whichever works better for you.
We even made a version you can test drive on your laptop[0] and we've been working on a "bootloader" for spinning up a full AWS version quickly[1].
Disclaimer: by "we" I mean Pivotal, my employer, which donates the majority of engineering effort to Cloud Foundry.
[1] https://github.com/pivotal-cf-experimental/bosh-bootloader
It doesn't appear this has changed: http://docs.pivotal.io/pivotalcf/1-7/customizing/openstack.h...
Even at a cheap provider like DigitalOcean, this is 16x10 + 6x160 = $1120/month in __overhead__, without even running any useful applications.
It's actually possible to consolidate it down to fewer machines if you want. But it requires BOSH knowledge and the willingness to surrender the HA guarantees.
If you only need to deploy a handful of apps, it'd be easier to start with a hosted service and go from there. We have one in Pivotal Web Services[0], pricing is based on RAM usage. IBM have BlueMix, there are also service installations managed by CenturyLink, AnyNines and Swisscom.
Look at a HA Kubernetes cluster. You've got kubelets and 2-3 masters and you're done. Look at CF and you need 22 servers total just to get started.
It may be easier/cheaper to use a hosted service compared to setting up your own CloudFoundry cluster but it's still extremely expensive and doesn't compete with alternatives like hosted Kubernetes. Say I want 32GB total of apps with 8 CPUs for a few development environments. For CF I pay ~$1600, for Pivotal I pay ~$700, for self hosted Kubernetes I pay ~$400 (4x8GB DigitalOcean instances + 3x2GB for masters) and for managed Kubernetes I pay ~$205 (4x n1-standard-2 Google Compute Engine instances + free cluster management since under 6 nodes).
When you say "so many foundational components", you're right: CF is featuresome and opinionated. That's the whole idea. With Kubernetes you can absolutely assemble all the other parts yourself and wire them together to taste, but that will chew up some of your 32Gb. And our calculations should expand to include engineering time, which is, last time I checked, quite expensive.
I'll definitely give Google due credit for competitive pricing though. For that price, and given their expertise, it'd be silly to self-host Kubernetes if you could use GCP.
The thing is though, Kubernetes is a set of lego blocks from which you can compose into CF, but you couldn't create Kubernetes from CF. That makes Kubernetes more interesting to me.
For those who really want a prebuilt Kubernete PaaS, Red Hat built OpenShift 3.
That said, Diego (our scheduler tech) was deliberately architected to be ignorant of Cloud Foundry. Right now it's pretty much serving the historical bias of Cloud Foundry's initial architecture -- applications -- but as the v3 API arrives we're breaking it down into finer grained concepts, some familiar to Kubernetes folk.
At one point, Diego was extracted out into a Kubernetes-like package with the Lattice project, which Pivotal supported for a while. But once we went and talked to developers, they said "well I don't really trust it because it's not a real Cloud Foundry". Hence we pivoted to PCFDev.
If Docker and Kubernetes or Mesos had emerged earlier, it's likely we'd have used them as our building blocks (as we've adopted other components). But when Cloud Foundry was born, none of these components really existed outside of private systems owned by Google or Facebook, or in some respects at Heroku.
Disclaimer: I was not responsible for any of these decisions, or even near to them, so take it all of the above with a grain of salt.
There is a bunch of infrastructure that becomes someone else's problem - letting CF focus on higher level PaaS primitives.
Just my 2 cents ;-)
Like I said, it's a twist of fate. Red Hat decided to abandon their own effort when Kubernetes first emerged and I think they've done Kubernetes a lot of good in bringing their inhouse systems integration know-how to it.
Diego has a lot of properties that we really like, though. And it's already been proved at larger production scale than Kubernetes. Our next milestone is 250,000 real app containers per install, which is not far off.
Edit: Also I'm not sure how much re-engineering would be required. I kind of expect we'd just teach Diego to drive Kubernetes.
Disclaimer - I work on OpenShift and Kubernetes
That's one of the reasons that the Diego effort was launched and it's why the v3 API is under development.
Red Hat has rebased on Kubernetes, but at the time we launched Diego, there was no alternative to building it ourselves.
I note that the workloads you mentioned are all supported or supportable by Diego and we're building out the missing ones very rapidly.
Disclaimer: I work for Pivotal, we donate the majority of engineering on Cloud Foundry. I am not near the Diego or core runtime teams, so my version of events may be hilariously inaccurate.
Disclaimer regarding the above, I work on the Flynn project.
We view the work of the Kubernetes (and Mesos, Docker Swarm, and other scheduler projects) team as incredibly valuable to Flynn.
We try to solve problems and create value at a the platform layer. Schedulers are one technology we use, but aren't at the core of the value that we (or most other platforms) deliver. We want to make development and management of production apps simple and invisible. For most users that should mean never needing to know about or interact with a scheduler directly.
We closely monitor progress on the major scheduler projects and look forward to a day when we can utilize one of them in Flynn instead of maintaining our own. As these technologies mature we'll be able to deliver even more value on top of them, while saving users from interacting with lower level components.
We've basically implemented the minimum viable system for our use case, and only add features as needed. The main thing that's missing right now is awareness of resource constraints and usage and then balancing based on that. There is a patch in progress that adds awareness of host-specific persistent volumes for our database appliances.
As an aside, when we started Flynn, the only open source scheduler that was available was Mesos and it didn't meet our criteria for integration so we ended up writing our own code. That code has since been rewritten approximately twice.
The biggest hurdle, ironically, is the official documentation, which seems to have been written by someone with no understanding of explaining things from first principles, or any talent for organizing ifnroamtion. You'd think the "setup from scratch" guide [2] would be the most detailed and useful for someone who wants to see how each piece fits into the next one, but it's actually terrible. It skips a lot of implicit information and makes some odd assumptions/suggestions. Almost every part of Kubernetes is multiple choice, which affects later steps. For example, if you use Flannel and you're not on GCloud, much of what Google's docs say about networking is moot.
Everything is also made harder by the fact that Kubernetes is changing awfully fast in non-backwards-compatible ways, and chances are that if you google some config problem, the answer is long out of date — the necessary kubectl option no longer exists or whatever. A lot of config recipes are useless now.
[1] https://github.com/kismatic/repo_server/find/master
[2] http://kubernetes.io/docs/getting-started-guides/scratch/
This was back in mid-2015, which meant figuring out things like how to get overlay networking with AWS's routing, fiddling with AWS's IAM settings, VPC settings, figuring out how to split the nodes across availability zones. This included integrating with AWS AutoScalingGroups to bring up new CoreOS/K8S nodes whenever something goes down. I never got EBS working as a Kubernetes volume type (at the time, you have to add hackish tools into CoreOS to detect unformatted EBS blocks and format them when they get mounted; forget it), but fortunately, used AWS RDS for persistent stores. Persistent storage is something I look forward to trying on GKE.
I could have tried creating CloudFormation scripts but I was making my way through documentation, blog posts, and Github issues to pull it all together. It was worth it when I was done.
I didn't say it was complicated. I said it was a pain in the ass, and it's something that Kubernetes developers have acknowledged and are working on it.
https://coreos.com/kubernetes/docs/latest/getting-started.ht...
Fair comment, and AFAIK, this is recognised and being addressed.
For example, minikube [https://github.com/kubernetes/minikube] to easily run Kubernetes on the desktop.
There are efforts underway to simplify cluster bring up, but this is not an easy problem because Kubernetes has to abstract away the underlying differences in O/S and cloud providers (example: load balancers on AWS vs. GCE).
I think they are getting there, but if you want dead simple "it just works", GKE is a great option.
But yes, I know it is not an easy problem. I had looked at the automation involved as well as deployed Kubernetes by hand to AWS, having to translate what works on AWS.
And as I have mentioned in my comment, GKE is an option.
Having said that, on the desktop, I think all I really care about would be the equivalent of a docker-machine setup for Mac and Windows. Something that brings up a single-node CoreOS running stable, with networking working, and kubelet running via Docker. (Back in 2015, I had to rely on kubelet being baked into the CoreOS release). Probably not a big deal on Mac if I put a vagrant script, or use the existing ones that CoreOS has. But my teammates that are using Windows will want something that works well.
I'm curious -- what's the underlying distro being used for minikube?
Take a gander at https://www.openshift.org/vm/ ? Kubernetes based.
The underlying distro is the same as what's used in boot2docker, but they want to provide support for CoreOS as well.
Rancher Labs definitely seems to be further along the path of a production-ready container hosting platform than any other one I've tried so far.
Not only can Rancher use k8s for scheduling, but mixing and matching environments with different scheduling technologies is extremely powerful instead of pigeon holing yourself on a one-size-fits all approach for you applications.
1. https://github.com/docker/swarmkit/blob/a78a157ef66adf0978f0...
The demo for `docker swarm` was great but as an infrastructure engineer, it worries me. First because of the blackbox effect I mentioned above and secondly because I'm not sure how much flexibility is compromised to achiveve that.
Sure, it's awesome to quickly have a cluster up for your app and the user experience is phenomenal... but what about storage, network, firewalls, integrating with my linux distro, etc. Things are never this simple when they reach a certain scale and/or number of requirements deviate from those of a simple app.
From a quick look at the docs and watching the demo, Kubernetes still feels like a safer option, today. That being said, it's nice to see competition in this space. I guess this will put pressure on Kubernetes and others to improve the user experience further.
Maybe they will make formal announcement when 1.12 for mac is released.
https://blog.docker.com/2016/06/docker-mac-windows-public-be...
No one sane will run docker on prod anyway.
For example, I'd never want to implement service discovery via DNS in Java, which ignores expiration times and caches queries according to its own settings. I've also seen some server configurations which result in every gethostbyname call to a fully recursive query against DNS.
Because I'll still end up supporting DNS if I try to run something else.
Only if you rely on the client's resolver caching implementation, which we don't. Docker networking guarantees that a given hostname lookup by a given container in a given service discovery scope will always return the same IP. In that configuration, using DNS is a robust fit for production.
Believe it or not, Docker is built by people who have actual operational experience :)
Did you mean this to cover the situation where N containers have registered the same name? I thought Docker DNS returned all such results in random order.
Given that, if one of those containers goes offline and Java has cached its address, you have the problem the parent was alluding to.
So when I said that Docker doesn't rely on the container's DNS resolver, I really meant it. We have seen in past lives the consequences of "DNS abuse" and have been careful to avoid it.
EDIT: calmer tone
I really wish there was more technical documentation on this "feature", which would make actual discussions about this much more productive, as opposed to what amounts to "trust me" with an appeal to authority.
As it stands now, there's not enough technical documentation about this feature available to make intelligent decisions about whether this really is a "robust fit for production".
> Believe it or not, Docker is built by people who have actual operational experience :)
I believe in track records, and Docker's hasn't been too great so far. From "not our problem" responses to issues like devicemapper version differences (on major OSes, no less), to the fact that I had to automate the cleanup of orphaned mounts after stopping containers, to non-backwards compatible releases with major core re-writes every other month, to containers which are quite literally unkillable without a host restart; Docker's track record is pretty poor.
I've used it in production, and the benefits barely outweighed the pain of attempting to manage it.
Disclaimer: I work on Compute Engine, and think of the Kubernetes folks as friends.
You are reading way too much into this. We're introducing orchestration in Docker because it solves a problem for our users. We haven't called your employer or anyone else "evil", and frankly this announcement is not about Google or any other company. It's about improving Docker for its users.
Speaking personally, I think GCE is a great product, Docker wouldn't exist without Go, and although grpc is not my personal favorite, it gets the job done and it's quite popular with Docker engineers. The libcontainer project (now runc/containerd) started with a very fruitful collaboration between Docker and Google engineers. The current Docker networking model is also heavily based on early feedback from the Kubernetes team (one IP per container, remove nat between containers, etc.)
Yes, some features of Docker overlap with other products. One of those products is Kubernetes but there are dozens of others. That kind of healthy competition is normal and good for users!
But this looks like it could be great progress. Orchestration was always the main pain that stopped me from using docker.