DockerCon 2017 - General Session Day 1 by Solomon Hykes

1. Solomon Hykes
Founder, Docker
@solomonstre

2. The world needs
tools of mass
innovation

3. The
best
tools…

4. 1.Get out of the way
The best
tools…

5. 1.Get out of the way
2.Adapt to you
The best
tools…

6. 1.Get out of the way
2.Adapt to you
3.Make the
powerful simple
The best
tools…

7. enterprise edition
Ubuntu
Fedora
Mac
Azure
CentOS
Windows 10
AWS
Debian
community edition
Ubuntu
Windows Server
Azure
CentOS
Suse
Red Hat
AWS
Oracle Linux

8. Better
tools for
developers

9. Docker
removes
friction
in the
development
cycle

10. How to remove
developer
friction in 3
easy steps

11. Step 1.
Developer
complains
about detail

12. Step 2.
Fix Detail

13. Step 3.
Repeat
FOREVER

14. In the developer experience,
details add up...

15. Example #1
My container images are too big!
“My container images are too big!”

16. Introducing
multi-stage
builds
Example #1
“My container images are too big!”

17. Build smaller images with
multi-stage builds
First stage:
complete build
environment
Second stage:
minimal runtime
environment
One Dockerfile, one build

18. FROM big-buildbase
…
…
FROM tiny-runbase
…
COPY --from=0
/artifact /run/app
…
One Dockerfile,
one build
Stage 0: large build
environment
Stage 1: minimal run
environment
Copy artifacts from one
stage to the next
Only copy what you need!
Build smaller images with
multi-stage builds

19. MAC AWS
“I wish it was easier to
take my app from
desktop to cloud”
Example #2

20. Introducing
DESKTOP-TO-
CLOUD
“I wish it was easier to
take my app from
desktop to cloud”
Example #2

21. Desktop
integration
21

22. Built-in collaboration with
Docker Cloud & Docker ID

24. Ryan Abrams
Software Engineer, Docker
Software Engineer, Docker
Kristie Howard

28. docker.com/getdocker
edge channel
Available in an
Edge release
near you

29. Docker for
operators

30. Going to Production is Hard

31. Going to Production SECURELY is
EXTREMELY Hard

32. Challenges to a
secure production:
Distributed Systems1

33. Challenges to a
secure production:
Distributed Systems1
Solutions:
Distributed systems are
just more systems.
Use the same tools.

34. Solutions:
Challenges to a
secure production:
Distributed Systems1 Secure orchestration

35. Orchestration
Container Runtime
OS
Infrastructure Management
Let’s talk about secure orchestration
Application Services

36. Raft Store
Node
Identity
Secrets
Routing
Mesh
Encrypted Networking
Application Services
Core Orchestration Engine
Secure Orchestration with SwarmKit

37. Technical Lead Security, Docker
Diogo Monica

38. Secure
Node
Introduction
SwarmKit
SWMTKN-1-mx8suomaom825bet6-cm6zts22rl4hly2
Known
Prefix
Token
Version
Hash
of Root CA
Random
Secret

39. Cryptographic
Node Identity
SwarmKit

40. MTLS
Between All
Nodes
SwarmKit

41. Cluster
Segmentation
SwarmKit

42. Encrypted
Networks
SwarmKit

43. Secure
Secret
Distribution
SwarmKit

44. Challenges to a
secure production:
Distributed Systems1
Solutions:
Diverse
Infrastructure
& OS
2

45. Challenges to a
secure production:
Distributed Systems1
Solutions:
Diverse
Infrastructure
& OS
2
Restrict choice of
infrastructure & OS.

46. Secure
AND PORTABLE
orchestration
Challenges to a
secure production:
Distributed Systems1
Solutions:
Diverse
Infrastructure
& OS
2

47. Challenges to a
secure production:
Distributed Systems1
Solutions:
Diverse Infrastructure
& OS
2
Developer Choice3

48. Challenges to a
secure production:
Distributed Systems1
Solutions:
Diverse Infrastructure
& OS
2
Developer Choice3
Give developers LESS
choice.

49. Secure,
portable
AND USABLE
orchestration
Challenges to a
secure production:
Distributed Systems1
Solutions:
Diverse Infrastructure
& OS
2
Developer Choice3

50. Docker delivers
SECURE, PORTABLE
and USABLE
orchestration,
powered by SwarmKit.

52. Nathan LeClaire
Technical Lead Security, Docker
Open Source Engineer, Docker
Diogo Monica

54. A platform is
only as secure
as its weakest
component

55. Taking Docker
multi-platform
“I want Docker for X”

56. Desktop Server Cloud
I want Docker for…

57. Not every
platform
provides a
Linux
subsystem

58. Not every platform provides a Linux subsystem
Orchestration
Container Runtime
Linux Subsystem
Infrastructure Management
Application Services

59. The container
movement needs
a secure, lean,
portable
subsystem

60. The container movement needs
a secure, lean, portable Linux subsystem.

61. The container movement needs
a secure, lean, portable Linux subsystem.
introducing

62. Introducing LinuxKit
A secure, lean, portable Linux subsystem for the container movement
OrchestrationOrchestration
Container Runtime
Linux Subsystem
Infrastructure Management
Application Services

63. Only works with
containers
- Smaller attack surface
- Immutable
infrastructure
- Sandboxed system
services
- Specialized patches
and configuration
Incubator for
security innovations
- Wireguard,
Landlock, KSPP
- MirageOS type safe
system daemons
Community-first
security process
- Linux is too big for
any one company
to secure it
- Participate in
existing Linux
security efforts
1. LinuxKit: a SECURE Linux subsystem

64. - Minimal size, minimal boot time
- All system services are containers
- Everything can be removed or
replaced
2. LinuxKit: a LEAN Linux subsystem

65. - Desktop, server, IoT, mainframe
- Intel & ARM
- Bare metal & virtualized
3. LinuxKit: a PORTABLE Linux subsystem

67. John Gossman
Architect at Microsoft

68. Docker and Microsoft collaborate to bring
Linux containers to Windows
+ +

69. Introducing LinuxKit
A secure, lean, portable Linux subsystem for the container movement
Orchestration
Container Runtime
Infrastructure Management
Application Services

70. https://github.com/linuxkit/linuxkit
Let’s open source LinuxKit

72. If the container
ecosystem
succeeds
Docker succeeds

73. What’s next
for the
container
ecosystem?

74. Pioneers 2013 - 2014

75. Ecosystem
10s projects
100s contributors
1000s deployments
0-100M Hub pulls

76. Production Model: open-source!

77. Use case: cloud native apps on Linux server
Early Adopters 2015 - 2016

78. Ecosystem
100s of projects
1,000s of contributors
10,000s of deployments
100M-6B Hub pulls

79. Production Model: OPEN COMPONENTS

80. Docker is a platform made of components
Raft Store
Node
Identity
Secrets
Routing
Mesh
Overlay
Networking
Swarm Orchestration
Engine
Application Services

81. 12,000,000,000
11,000,000,000
10,000,000,000
9,000,000,000
8,000,000,000
7,000,000,000
6,000,000,000
5,000,000,000
4,000,000,000
3,000,000,000
2,000,000,000
1,000,000,000
Notary
runC
containerd
HyperKit , VPNKit, DataKit
SwarmKit
libcontainer
libnetwork
InfraKit
2013 2014 2015 2016 2017
1M
2014
PULLS
1B
2015
PULLS
6B
2016
PULLS
12B
2017
PULLS
linuxKit

82. Mainstream 2017 - 2018
Containers are spreading to every category of computing:
server, datacenter, cloud, IoT, desktop, mobile…

83. 1,000s of projects
10,000s of contributors
Millions of deployments
Highly specialized participants
The Container Ecosystem goes Mainstream
How do we scale?

84. Case study:
Specializing Docker for the mainstream
Desktop Server Cloud

85. The open component model shows its limits…

86. The auto industry has solved this problem:
COMMON ASSEMBLIES.

87. Scaling the Docker production model: share components
AND ASSEMBLIES.

88. It’s time to take our ecosystem to the next level…
By collaborating on components AND COMMON ASSEMBLIES.

91. – Library of 80+ components
– Package your own
components as containers
– Reference assemblies
deployed on millions of
nodes
– Create your own assemblies
or start from an existing one
A framework to assemble
specialized container
systems without
reinventing the wheel.

92. Docker uses Moby for its
open-source
– Thousands of contributors,
hundreds of patches/week
– Component development
– Specialized assembly
development
– Integration tests
– Architecture design
– Integration with other projects
– Experimentation and bleeding
edge features

93. Docker uses Moby for its
open-source...
and so can you!
– Community-run
– Open governance inspired
by the Fedora project
– Plays well with existing
projects - no donation
necessary!

94. What it means for you
Moby helps you
innovate without tying
you to Docker
System BuildersDocker Users
Docker will better
leverage the ecosystem
to innovate faster for you

95. Moby transforms multi-month R&D
projects into weekend projects.

96. locked-down
Linux with
remote
attestation
Weekend
project #1:
Notary

97. custom CI/CD
stack
Weekend
project #2:
Notary Registry Docker Builder
+

98. custom CI/CD
stack
+ Debian
+ Terraform
Weekend
project #3:
Notary Docker Builder
+
Registry

100. Rolf Neugebauer
Software Engineer, Docker

101. “RedisOS”
Weekend
project #4:

102. "RedisOS"
for Windows
"RedisOS"
for Mac
"RedisOS"
for bare metal
HyperKit
bare metal

103. Etcd clustering
on Google
Cloud
Weekend
project #5:

104. Weekend
project #6

105. Weekend
project #6

106. Weekend
project #6
HyperKit

107. Weekend
project #6
HyperKit

108. Weekend
project #6
HyperKit

109. Weekend
project #6
SSHD
HyperKit

110. Weekend
project #6
SSHD
HyperKit

111. SSHD
Kubernetes on
the Mac
Weekend
project #6:
HyperKit

112. Let’s take containers mainstream!

113. Thank
You!
@docker #dockercon