© 2015 Mesosphere, Inc. All Rights Reserved.

WHAT YOU ALWAYS WANTED TO KNOW ABOUT CONTAINER ORCHESTRATION AND NEVER DARED TO ASK

1

Michael Hausenblas | All Things Open | Raleigh, NC | 2015-10-20

© 2015 Mesosphere, Inc. All Rights Reserved.

CONTAINERS ARE LIKE VMS, RIGHT?

2

© 2015 Mesosphere, Inc. All Rights Reserved.

CONTAINERS ARE LIKE VMS, RIGHT?

3

© 2015 Mesosphere, Inc. All Rights Reserved.

CONTAINERS ARE LIKE VMS, RIGHT?

4

No!

• dependency management for apps

• lightweight: startup time, avg. runtime, footprint

• pets vs cattle

© 2015 Mesosphere, Inc. All Rights Reserved.

CONTAINERS ARE LIKE VMS, RIGHT?

5

Pets are individuals that you give names and when they get ill you nurse them back to health.

Cattle are anonymous, identical to other cattle you assign numbers and when they get ill → next one.

http://www.theregister.co.uk/2013/03/18/servers_pets_or_cattle_cern/

© 2015 Mesosphere, Inc. All Rights Reserved.

ARE CONTAINERS SECURE?

6

© 2015 Mesosphere, Inc. All Rights Reserved.

ARE CONTAINERS SECURE?

7

© 2015 Mesosphere, Inc. All Rights Reserved.

ARE CONTAINERS SECURE?

8

• containers share same kernel (!)

• namespaces ('user' almost there)

• lock down networking (e.g. Docker's --icc=false)

© 2015 Mesosphere, Inc. All Rights Reserved.

ARE CONTAINERS SECURE?

9

Don't bake credentials into Docker images!

Rather do …

$ docker run -d -e API_TOKEN=SECRET somedatabase

$ docker run -d -v $(pwd):/fsecret:/fsecret:ro somedatabase

Ideally, use a key-value (in-memory) store such as

Square's KeyWhiz, HashiCorp's Vault, or Crypt

© 2015 Mesosphere, Inc. All Rights Reserved.

SHOULD I REALLY BE USING A CONTAINER ORCHESTRATION TOOL?

10

© 2015 Mesosphere, Inc. All Rights Reserved.

SHOULD I REALLY BE USING A CONTAINER ORCHESTRATION TOOL?

11

© 2015 Mesosphere, Inc. All Rights Reserved.

SHOULD I REALLY BE USING A CONTAINER ORCHESTRATION TOOL?

12

Yes!

• No getting up at 3am to replace a HDD or deploy

an app onto a new server

• Elasticity (traffic, business needs, etc.)

© 2015 Mesosphere, Inc. All Rights Reserved.

HOW DO I LAUNCH 100,000 CONTAINERS?

13

© 2015 Mesosphere, Inc. All Rights Reserved.

HOW DO I LAUNCH 100,000 CONTAINERS?

14

© 2015 Mesosphere, Inc. All Rights Reserved.

HOW DO I LAUNCH 100,000 CONTAINERS?

15

• Are you Google? Facebook? Twitter?• Small is beautiful and containers at scale is hard

• But, what should I use?• For a handful of nodes:

Nomad, Kubernetes, Docker Swarm, Apache Mesos• For ~100 nodes:

Kubernetes, Apache Mesos• For 100s to 1000s nodes:

Apache Mesos

© 2015 Mesosphere, Inc. All Rights Reserved.

I ALREADY USE CHEF, PUPPET, ANSIBLE, SALTSTACK, ETC.—DO I REALLY NEED A CONTAINER ORCHESTRATION SYSTEM?

16

© 2015 Mesosphere, Inc. All Rights Reserved.

I ALREADY USE CHEF, PUPPET, ANSIBLE, SALTSTACK, ETC.—DO I REALLY NEED A CONTAINER ORCHESTRATION SYSTEM?

17

© 2015 Mesosphere, Inc. All Rights Reserved.

I ALREADY USE CHEF, PUPPET, ANSIBLE, SALTSTACK, ETC.—DO I REALLY NEED A CONTAINER ORCHESTRATION SYSTEM?

18

• It's really horses for courses• Base provisioning: CM tool of your choice• Container orchestration: Apache Mesos,

Kubernetes, Nomad, Docker Swarm

© 2015 Mesosphere, Inc. All Rights Reserved.

CONTAINER ORCHESTRATION, THAT'S FOR MICROSERVICES, OR?

19

© 2015 Mesosphere, Inc. All Rights Reserved.

CONTAINER ORCHESTRATION, THAT'S FOR MICROSERVICES, OR?

20

© 2015 Mesosphere, Inc. All Rights Reserved. 21

• Orthogonal issues …• … however, many (successful) microservices

architectures I've seen are containerized• Worry first about the basics:

• Are you using Git?• Have you got your CI/CD pipeline set up?• How do you deploy your (container) images?

CONTAINER ORCHESTRATION, THAT'S FOR MICROSERVICES, OR?

© 2015 Mesosphere, Inc. All Rights Reserved.

THAT CONTAINER ORCHESTRATION THING THAT'S FOR ON-PREMISES, RIGHT?

22

© 2015 Mesosphere, Inc. All Rights Reserved.

THAT CONTAINER ORCHESTRATION THING THAT'S FOR ON-PREMISES, RIGHT?

23

© 2015 Mesosphere, Inc. All Rights Reserved. 24

• Nope, just different things are important• Think: provisioning (putting a box into a rack vs.

pressing a button)• Actually, many do hybrid cloud (on-premises +

cloud or inter-cloud)

THAT CONTAINER ORCHESTRATION THING THAT'S FOR ON-PREMISES, RIGHT?

© 2015 Mesosphere, Inc. All Rights Reserved.

BUT THERE ARE CERTAINLY SOME DOWNSIDES TO IT, I'M SURE!

25

© 2015 Mesosphere, Inc. All Rights Reserved.

BUT THERE ARE CERTAINLY SOME DOWNSIDES TO IT, I'M SURE!

26

© 2015 Mesosphere, Inc. All Rights Reserved. 27

• Mostly challenges of social nature (less people can

take of more stuff)

• Convince your colleagues and boss with:

The Phoenix Project

BUT THERE ARE CERTAINLY SOME DOWNSIDES TO IT, I'M SURE!

© 2015 Mesosphere, Inc. All Rights Reserved. 28

BUT THERE ARE CERTAINLY SOME DOWNSIDES TO IT, I'M SURE!

http://shop.oreilly.com/product/9781939902184.do

http://p24e.io

http://shop.oreilly.com/product/0636920039952.do https://manning.com/books/mesos-in-action

28

http://shop.oreilly.com/product/0636920043874.do

© 2015 Mesosphere, Inc. All Rights Reserved.

AND NOW IT IS YOUR TURN …

29