Learn how you bring secure, scalable, available and open software defined networking to Docker containers managed by OpenStack. This session will cover how Docker virtual networks function, how to plumb them into the virtual network fabric and reliably assign information such as IP addresses, virtual interfaces and more. In addition, this session will also cover how to securely wrap Docker containers using security policies and encryption.

1. Docker Networking In OpenStack
What you need to know now
Fawad Khaliq

2. • OpenStack Community Member
• Developer in Neutron
• Maintainer of PLUMgrid Neutron
Plugin (networking-plumgrid)
• How to contact and follow me
fawad@plumgrid.com
@fawadkhaliq
irc:fawadkhaliq
About Me
2

3. • Docker Background
– The Rapid Adoption
– Use Cases
– Nova-Docker
• Docker Networking
– Progress Report
– Unified VM and Docker Networking with Neutron
– Demo Time!
• Key Takeaways
3
Agenda

4. • A common packaging format for cloud
applications.
• A high-level API to provide lightweight
containers that run processes in isolation.
• 100+ million Docker Engine downloads
• 45,000+ applications in Docker Hub
Introduction to Docker
4

5. Why The Explosion? It’s Lightweight
5
Server Hardware
Host Operating System
Hypervisor
Guest OS Guest OS Guest OS
bins/libs bins/libs bins/libs
App A App A* App B
VMs
Server Hardware
Host Operating System
Docker Engine
bins/libs bins/libs
App A App A* App B
Containers

6. • Easy Application Deployment
• Continuous Integration
• Application Lifecycle
• Continuous Delivery
• Platform-as-a-Service (PaaS)
• Distributed Applications
Composition
Docker Use Cases
6
Server Hardware
Host Operating System
Docker Engine
Load
Balancer
Database
Application
Servers
https://www.docker.com/resources/usecases/

7. • Nova Compute
– driver for launching Docker containers as Nova instances
– Offers an overlap of features between Nova and Docker
– stackforge/nova-docker
• Heat
• Magnum
– Magnum design sessions; please attend and contribute!
7

8. Docker Networking Options – Circa 2013-14
8
container B
1
container A
Docker Proxy
iptables
Docker0
Linux Bridge
container A container B
Unix domain sockets2
container A
Host
network
3

9. Docker Networking Today – libnetwork
9
http://blog.docker.com/2015/04/docker-networking-takes-a-step-in-the-right-direction-2/
https://github.com/docker/libnetwork

10. OpenStack Networking Today - Neutron
10
PLUMgrid Neutron Plugin
Neutron API
PLUMgrid ONS Backend
PLUMgrid ONS
100% Software
On Demand NetworksPluggable and API Driven

11. Networking Must Be Unified!
11
Common Networking LayerPLUMgrid Open Networking Suite for OpenStack

12. Why? VMs and Containers Must Communicate With Each Other!
12
nova-compute
Docker Engine
nova-compute
Libvirt
VM1 VM2Container1 Container2
nova-api
network 1
network 2

13. How It Works
13
Initiate
Create Port
Bind VIF
PLUMgrid
Neutron Plugin
Neutron API
Nova API
Nova
Compute
Nova Docker
PLUMgrid ONS Backend
Launch
Docker

14. Is This Even Real?
14

15. Demo Time!

16. Demo Setup
16
Kilo DevStack
Neutron with PLUMgrid ONS Plugin
Compute
Nova Libvirt Driver
PLUMgrid Edge
Controller + Compute
Nova Docker Driver
PLUMgrid Director PLUMgrid Gateway
PLUMgrid Edge

17. What I Will Be Doing
17
1. Provision a network
2. Spawn a VM and a Docker container on the same network
3. Validate connectivity across hosts and Nova drivers
4. Create router and connect private network to external network and ping
openstack.org
5. Associate Floating IPs and check connectivity
6. Update Security Groups and see network topology disallow traffic.

18. What We Will End Up With
18
Server 1(Docker Compute) Server 2 (Libvirt Compute)
Physical Network
Docker VM
NAT
Virtual Network
Router

19. What I Just Did
19
1. Provisioned a network
2. Spawned a VM and a Docker container on two different hosts on same
network
3. Validated connectivity across hosts and Nova drivers
4. Created a router and connected private network to external network and
ping’ed openstack.org
5. Associated Floating IPs and checked connectivity
6. Updated Security Groups and saw network topology disallow traffic.

20. What’s next?
20
• Contribute to Magnum-Networking (Neutron)
• Provide with common Neutron API for Containers Networking
in Magnum

21. Key Takeaways
21
1. Docker Has Arrived In OpenStack
2. Docker Networking Has Evolved (For the Better)
3. PLUMgrid ONS Enables Unified Networking for
Docker and VMs in OpenStack
– Come visit us at Booth S14

22. 22
Join OpenStack
Networking
(Neutron)
Development
Group!

23. Q&A

24. Thank you!