Docker is hot. However, as Docker container use spreads into more mature production pipelines, there can be issues about control of Docker images to ensure they are production-ready. Is a promotion-based model appropriate to control and track the flow of Docker images from development to production? We will demonstrate how to implement a promotion model for docker images, and then show how to distribute them to any kind of consumer, being it a customer or a data center.

1. Docker Container Lifecycles -
Problem or Opportunity?
Baruch
Sadogursky
Dev Advocate @JFrog

2. What Frog?

3. What Frog?

4. What Frog?

5. What Frog?

6. JFrog Xray

7. Poll Time!

8. Poll Time!
Heard about Docker
Can do the tutorial
PoCing, playing etc.
Production, baby!

12. JFrog Artifactory + Docker

13. Who’s using Docker and nothing else?

14. The Promotion Pyramid
Development builds
Dev Integration tests
Integr. tests
Staging
Pre-Prod
Prod
Amount of builds
Build/Deploytime
Amount of
binaries

15. Pipeline: Quality Gates and Visibility
Source: Agile ALM, Michael Hüttermann, Manning Publications Co.

17. $docker build

19. Too easy!

21. That’s why.

22. Let’s fix it!

23. Let’s fix it (again)!

24. Let’s fix it (again)!

25. What you code is (not) what you get

27. The stronger the quality gates,
more trust you have.

29. Not so fast…

30. Trumped-up limitations

31. The Anatomy of Docker Tag

32. Wait a second, how can I
have more than one
repository per host now?!

33. How can we support this?
https://host:8081/artifactory/docker-dev/busybox
https://host:8081/artifactory/docker-staging/busybox
https://host:8081/artifactory/docker-qa/busybox
https://host:8081/artifactory/docker-prod/busybox

34. Panic!

35. Virtual hosts/ports to the rescue
https://host:8081/artifactory/docker-dev/busybox
docker tag host:port/busybox
Context name
Virtual repository name
Tag name

36. server {
listen 5001;
server_name 192.168.99.100;
if ($http_x_forwarded_proto = '') {
set $http_x_forwarded_proto $scheme;
}
rewrite ^/(v1|v2)/(.*) /artifactory/api/docker/docker-dev/$1/$2;
…
}
}

38. But then you realize…
Wait a second, now I need
to pull, retag and push for
every step?!

40. Virtual Repositories FTW

41. What we did?

42. What we did?
- Minimize number of repositories docker
interact with

43. What we did?
- Minimize number of repositories docker
interact with
- deploy to virtual (backed by dev repository)

44. What we did?
- Minimize number of repositories docker
interact with
- deploy to virtual (backed by dev repository)
- promote within artifactory

45. What we did?
- Minimize number of repositories docker
interact with
- deploy to virtual (backed by dev repository)
- promote within artifactory
- Resolve from virtual (production-ready
images)

46. Why?

47. Finding the needle in haystack of
binaries

48. Finding the needle in haystack of
binaries
- What deployed where
- Tracing binaries to sources

49. Finding the needle in haystack of
binaries
- What deployed where
- Tracing binaries to sources
- Cherry pick the one to prod

50. Adding Metadata

52. Consuming Metadata

53. Let’s talk security

54. Access Control

55. r/w on repo level
is not enough

56. r/w on repo level
is not enough
- read, write, delete, annotate
- on any level – registry, repo, image or
tag

57. Content Control – Don’t Lose It

60. Thank you!