Making DevOps Secure with Docker on Solaris (Oracle Open World, with Jesse Butler)

Copyright © 2015, Oracle and/or its affiliates. All rights reserved. |
Making DevOps Secure with Docker
[CON8724]
Bringing Native Docker to Oracle Solaris
Jérôme Petazzoni – Docker, Inc
Jesse Butler – Oracle Solaris
October 28, 2015
Presented with

Copyright © 2015, Oracle and/or its affiliates. All rights reserved.
Safe Harbor Statement
The following is intended to outline our general product direction. It is intended for
information purposes only, and may not be incorporated into any contract. It is not a
commitment to deliver any material, code, or functionality, and should not be relied upon
in making purchasing decisions. The development, release, and timing of any features or
functionality described for Oracle’s products remains at the sole discretion of Oracle.

Who am I?
● Jérôme Petazzoni (@jpetazzo)
● Before 2010: 50% developer, 50% sysadmin
● After 2010: 100% DevOps at dotCloud
– polyglot PAAS
– microservices
– provisioning, metrics, scaling ...
– massive deployment of LXC and ØMQ
● 2013: dotCloud becomes Docker

Why Docker ?

Why Docker ?
● Faster application development cycle
● Multiplication of environments
● Scaling requirements

Yesterday: slow cycles (months/years)
● Specification
● Implementation
● Validation
● Release
● Maintenance

Today: fast cycles (weeks/days)
● Minimum Viable Product
● Short iterations (sprints)
● Continuous Deployment
● A project is never "done" or "over"
● Agile methods

Yesterday: single environment
● One language
● One framework
● One database
● One server
● (+ sometimes a dev environment)

Today: many environments
● Many languages
● Polyglot platforms
● Simultaneous use of SQL, NoSQL ...
● The right tool for the right job
● Many servers
(everybody has their local dev env
there are many envs for testing, CI, QA, etc.)

Yesterday: slow, vertical deployment
● New versions once in a while
● Installed to few servers
(sometimes just one)
● Scaling = scaling up
(buy bigger servers)
● Scaling must be planned far ahead

Today: rapid, horizontal deployment
● New versions all the time
● (every week / day / hour)
● Installed to many servers
● Scaling = scaling out
(add more servers)
● Need to be able to scale quickly

What is Docker?

What is Docker?
● Container execution engine
● Container build system
● Container image distribution
● Huge ecosystem

Container execution engine
● ~Hypervisor for containers
● Container =~ lightweight virtual machine
What is a container???

DEMO

Container
● It looks and feels like a VM
● Standard UNIX processes, isolated by kernel mechanisms:
– namespaces
– cgroups (control groups)
– copy-on-write
● Insanely fast boot times
● Insanely low resource usage

Build system
● Dockerfile = recipe describing the build process
● Easy to learn (similar to shell scripting)
● Fast (caching system)
● Reliable, reproducible
● Best of both worlds:
– Shell scripts (easy to write, easy to understand)
– Config management (reliability, repeatability)

Image format
● Problem: VM images are big
● Solution 1: container images are smaller
– doesn't need hardware support, kernel, drivers ...
– separate handling of logs, metrics, backups ...
● Solution 2: images broken down into layers
– 1 layer = 1 build step
– example: base system, packages, code, config
– only transfer updated layers

Distribution protocol
● Download containers images easily:
“docker pull maven”
● Build on top of those images with Dockerfiles:
“docker build -t jpetazzo/springapp .”
● Make that build available to others:
“docker push jpetazzo/springapp”
● Use that build on any Docker host:
“docker pull jpetazzo/springapp”

Docker Registry
● Service to host Docker images
● Multiple options available:
– Docker Hub
(SAAS model, free for public images)
– Docker Trusted Registry
(on-prem or on-cloud)
– Self-hosted open source edition

Ecosystem: images
● ~100 official images
– Linux distros
– (Debian, Ubuntu, CentOS, Fedora, ...)
– components
– (MySQL, Redis, PostgreSQL, MongoDB, NGINX...)
– languages
– (Python, Ruby, Java, Go, Node...)
– applications
– (Wordpress...)
● ~150,000 contributed images

Ecosystem: code
● ~100,000 GitHub repositories have a Dockerfile
● ~1000 contributors to Docker code
● Thousands of projects integrating with Docker
● Some official tools:
– Machine (deploy Docker hosts)
– Compose (manage multi-container applications)
– Swarm (cluster multiple Docker hosts together)

More resources

If you like reading
● docs.docker.com
● Start with "get started" (duh!)
● Written in good old "howto" style
● Reference documentations

If you like looking at / listening to
● training.docker.com
● Free, official training videos
– Intro to Docker
(general concepts)
– Docker Fundamentals
(first steps with Docker)
– Docker Operations
(using Machine, Swarm, Compose)

If you're in a hurry
● OS X, Windows: Docker Toolbox + boot2docker
– tiny VM image (less than 30 MB)
– works on (most) physical and virtual machines
● Linux: get.docker.com
– official packages for most distros
– get.docker.com (Cloud Init-ready)
● Solaris:
– boot2docker VM in Oracle VirtualBox
– soon: Docker Engine native on Solaris

Linux? OSX? Windows? Solaris?
● Docker on Linux runs Linux images
● Docker on Windows will run Windows images
● Docker on Solaris will run Solaris images
● Docker on OS X is really Docker on Linux,
within a boot2docker VM in VirtualBox
● Docker on Windwos is (for now) the same

One API to rule them all
● All ports of Docker expose the same API
● Docker client is available on all platforms
● Docker client can talk to any other platform
● Docker allows to control all workloads:
– Linux
– Solaris (soon)
– Windows (soon)
● … using uniform APIs, dashboards, tools.

Native Docker on Oracle Solaris
Providing a dev/ops toolkit in the OS

A Brief History
• Oracle Solaris Zones first delivered in 2005 with Oracle Solaris 10
– Lightweight OS virtualization, combined with resource management
– Originally intended to be application-specific single-purpose instances
– Sparse root deployment option was ideal for application deployment, but
most users were running general compute environments
• Oracle Solaris 11 streamlined for the OS container
– Majority of user feedback steered us toward a default ‘solaris’ non-global zone
brand which provides a general compute environment
– Full package image, full host of services booted from init and managed by SMF
Oracle Solaris Zones

Oracle Solaris Zones Today
• Oracle Solaris 11 FCS Native Zones
– ‘solaris’ brand: non-global zone OS containers
– Fully integrated with IPS packaging system, making atomic update and rollback
with the host automatic
• Oracle Solaris 11.2 Kernel Zones
– ‘solaris-kz’ brand: VM global zones, each with independent kernel and image
– Same tooling as native zones, applications run seamlessly between two brands
Native Zones & Kernel Zones

Native Zones Wishlist
• Faster deployment and boot
• Improved lifecycle management
• Application-specific zone instances
• Streamlined repetitive configuration tasks
• Application containers
User Feedback Continues to Guide Feature Enhancements

Docker on Oracle Solaris
• A native Docker on Oracle Solaris, with similar runtime characteristics
as experienced on Linux, would check all of the boxes
• Planning for work to improve in these areas coincided with our
noticing a considerable uptick in Docker adoption
• As with OpenStack, participate rather than reinvent
• Integration with other container technologies
already a goal for the Docker project
Good timing and well-aligned

Oracle Solaris OS Features: What We Already Have
Observability & Reporting
Configuration Management
& Auditing
Fault Management
Service Monitoring &
Predictive Self Healing

Oracle Solaris OS Features: Built for Containers
Container Security Network Virtualization
Storage Virtualization
Robust and Proven
Container Technology

Docker and Oracle Solaris Zones
• Docker deploys ideally minimal containers, in both size and intent
– Smaller images means less surface for administration, maintenance and attack
– The more express the intent of an instance, the less complex the configuration
• Oracle Solaris Native Zones are rock solid OS containers
– OS containers run a general compute environment, not ideal for Docker
– Full package image deployment, even cloning takes longer than ideal for Docker
– Oracle Solaris Native Zones do exactly what they are designed to do, very well
What’s missing? Mostly, it’s by design.

Docker and Solaris Zones
• Image Content
– Even when cloning the root fs, we still need smaller base images
– Ideally a Docker container runs as a service, not another instance to admin
• Instance Boot Configuration
– Ideally, we run a single intent: one application, maybe only one process
– Integration with SMF and other core technologies is required
Two main requirement scopes

Integrating Docker and Solaris Zones
• Docker instances on Oracle Solaris are native non-global zones
– Applications which run in Solaris Zones can run in Docker on Oracle Solaris
• Docker leverages robust, mature Solaris Zones technology
– Resource management, scheduling, networking, storage and security
• Docker instances are not created nor managed via zones toolchain
– Instances are created via docker(1), not zonecfg(1) / zoneadm(1)
• Docker instances can be monitored via zones-related utilities
– zonestat, ps –z, prstat –Z, etc
Oracle Solaris Zones and Resource Management

• A smaller base image, constructed from IPS, used for all Docker
instances on Oracle Solaris
• A working IPS image in the instance allows for modification via pkg(1)
• ‘pkg verify’ lends added confidence in the assembled Docker image
• Transformation to and from Unified Archives to allow for migration
between Docker instances and other Oracle Solaris platforms
Image Management and Deployment

• SMF configuration is quickly injected during instance deployment
• We boot to a very sparse environment, with a small handful of
processes providing a basic runtime and SMF support
• Having an init isn’t so bad, after all
Boot and runtime configuration

• Networking
– Crossbow: World-class virtual networking stack in the OS
– Each instance has an exclusive IP stack and is well-integrated
• Storage
– As with all Zones, rootfs is based upon ZFS, rapidly deployed via ZFS cloning
– All the benefits of the native zones storage support
• delegated datasets, volumes, mounts, etc
Networking and storage

Oracle Solaris and the Open Containers Initiative
• Earlier this year, Docker, Inc. announced the donation of a core
piece of their software to seed a new Open Container Initiative
• Many system vendors and service providers joined early,
including Oracle
• As we’ve been working as part of OCI, we have adopted the
new container format for Docker on Oracle Solaris
• Docker integrates with Oracle Solaris Zones through our internal
implementation of the OCI specification
Collaborating on an open container and runtime specification

Docker &
Zones
Security
ZFS
BEs
IPS
RAD
SMF
Dtrace
Audit
The Docker Ecosystem on Oracle Solaris
• Oracle Solaris Zones in Docker
• Secure virtual storage & network
• Atomic update and seamless rollback
via IPS & Boot Environments
• Secure remote administration &
Role-based access control
• Observability, configuration
management & audit

Initial Best Practices
• Docker as a toolkit
– Typically positioned as an application packaging and deployment automation
framework that maps very well to core dev/ops principals
– Integrates very well with CI/CD workflows
• When to consider Docker on Oracle Solaris
– Workloads running in single intent instances or that can be decomposed into
single intent instances are good candidates for migration to Docker on Oracle
Solaris
– New projects which can be architected as cooperative distributed services are
good candidates for new development in Docker on Oracle Solaris
Docker is a dev/ops jumpstart

Initial Best Practices
• Docker host selection: metal or VM
– If performance and scaleout is the main concern deploy on metal
– If migration and flexibility is the main concern, or potentially a future concern,
deploy in a kernel zone
• Don’t over-rotate on decomposition
– If application components and dependencies can be mapped to individual
Docker images and instances, pursue that course
– If they cannot, use an Oracle Solaris Zone or Kernel Zone, depending upon
platform requirements
Docker is a dev/ops jumpstart

Q&A

Don’t Miss These Sessions
What When Topic Location
CON8468 Wed, 12:15 p.m. DevOps Done Right: Secure Virtualization with Oracle Solaris Intercon B
CON8605 Wed, 1:45 p.m Developing the Platform of the Future: Oracle Solaris Engineering Intercon B
CON8604 Wed, 3:00 p.m. Customer Panel: Customer Insights into Deploying Oracle Solaris Intercon B
CON8337 Thu, 9:30 a.m. Developer Cloud Made Simple: How to Build an OpenStack Developer Cloud Intercon B
CON8726 Thu, 10:45 a.m. Keeping your Compliance/Security Auditor Happy Intercon B
CON9757 Thu, 12:00 p.m. Oracle Solaris: Building a Secure Platform-as-a-Service Hybrid Cloud Intercon B
CON8354 Thu, 1:15 p.m. The DBaaS You’ve Been Waiting for—Oracle Database, Oracle Solaris, SPARC, and
OpenStack
Intercon B
48
48

Safe Harbor Statement
The preceding is intended to outline our general product direction. It is intended for
information purposes only, and may not be incorporated into any contract. It is not a
commitment to deliver any material, code, or functionality, and should not be relied upon
in making purchasing decisions. The development, release, and timing of any features or
functionality described for Oracle’s products remains at the sole discretion of Oracle.

Making DevOps Secure with Docker on Solaris (Oracle Open World, with Jesse Butler)

Recommended

More Related Content

What's hot (20)

Viewers also liked (12)

Similar to Making DevOps Secure with Docker on Solaris (Oracle Open World, with Jesse Butler) (20)

More from Jérôme Petazzoni (20)

Recently uploaded (20)

Making DevOps Secure with Docker on Solaris (Oracle Open World, with Jesse Butler)