Running Docker in Production - The Good, the Bad and The Ugly
45
Docker in Production The Good, The Bad and The Ugly Jari Kolehmainen, CTO & Co-founder
-
Upload
kontena-inc -
Category
Technology
-
view
267 -
download
2
Transcript of Running Docker in Production - The Good, the Bad and The Ugly
Docker in ProductionThe Good, The Bad and The Ugly
Jari Kolehmainen, CTO & Co-founder
© 2016 Kontena, Inc.
Pick the Right Path
Options
DIY?Rent?
Platform?
DIY?
Do-It-YourselfSounds like fun?
DON’TDO IT
(unless you are forced)
Rent?
AWS ECSAzure Container Service
Google Container Engine
Rent
”I don’t want to maintain anything”
Works for some use cases
Platform?
Docker Swarm (the new one)Kubernetes
KontenaDCOS
Platform
Most features built-inLess maintenance
Battle tested
Docker Engine
Docker Engine
Tweak defaultsNeeds “janitors”
Prefer container “native” hosts
Docker Engine
Graphdriver of the day: overlay2Engine plugins: run outside
Keep engine & kernel up-to-date
Docker Engine
3rd parties might cause side-effects
Systemd <> Overlay networksCadvisor <> Docker mounts
CI/CD Pipeline
Pipeline
BuildTest
Deploy
Pipeline
Script everythingVersion control everything
Yes, everything
Everything but secrets.
Tools for pipeline
DroneJenkins
Gitlab CI
Pipeline Example
1. Git Push2. Trigger Build 3. Push Docker Image
4. Trigger Deploy
5a. Deploy to Staging 5b. Deploy to Production
Pull Docker Image
Security
Security
Security patchingNetwork access
Secret managementAudit
Patching
Container “native” OSConfiguration management
Image scanning
Network Security
Overlay (SDN) networksNetwork segments/policies
Firewalls
Secret Management
Keep secrets outUse platform provider solutionIntegrate 3rd party solution to
pipeline
Audit
Audit logsContainer logs
Alerts
Prepare for Chaos
But why?
Hosts failEngines fail
Containers failYour app crashes
Ok, is all hope lost?
Rules for chaos
Allow hosts to dieTrust the scheduler
Use clustered databasesOutsource state if possible
Summary
Summary
Prepare properlyTweak defaults
Automate everythingUse battle tested solutions
QAAsk and get a shirt!!!
@kontenainc
slack.kontena.io
github.com/kontena/kontena
meetup.com/pro/kontena
www.kontena.io
Stay up to date!
Thank You!www.kontena.io
We are hiring!kontena.io/jobs
