Going D/S/K Prod Like A Pro BRET FISHER Docker Captain, DevOps - - PowerPoint PPT Presentation

▶
going d s k prod like a pro
SMART_READER_LITE
LIVE PREVIEW

Going D/S/K Prod Like A Pro BRET FISHER Docker Captain, DevOps - - PowerPoint PPT Presentation

Jul 12, 2023 234 likes •1.51k views

Going D/S/K Prod Like A Pro BRET FISHER Docker Captain, DevOps Dude, Creator of Docker Mastery bretfisher.com/docker @bretfisher Going D/S/K Prod Like A Pro BRET FISHER Docker Captain, DevOps Dude, Creator of Docker Mastery

slide-1
SLIDE 1

BRET FISHER

Docker Captain, DevOps Dude, Creator of Docker Mastery

Going D/S/K Prod Like A Pro

bretfisher.com/docker @bretfisher

slide-2
SLIDE 2

BRET FISHER

Docker Captain, DevOps Dude, Creator of Docker Mastery

Going D/S/K Prod Like A Pro

bretfisher.com/docker

@bretfisher

slide-3
SLIDE 3

BRET FISHER

Docker Captain, DevOps Dude, Creator of Docker Mastery

Going D/S/K Prod Like A Pro

bretfisher.com/docker @bretfisher

slide-4
SLIDE 4

Session Name

Title & Company

Speaker Name

slide-5
SLIDE 5
slide-6
SLIDE 6

I've given 50+ Docker DevOps talks in the last 4 years! 😶

slide-7
SLIDE 7

I've given 50+ Docker DevOps talks in the last 4 years! 😶 How can I cram the "best

  • f" in 30 minutes to get you

in production faster?

slide-8
SLIDE 8

A Bit About Me

slide-9
SLIDE 9

A Bit About Me

  • Geek since 5th Grade
slide-10
SLIDE 10

A Bit About Me

  • Geek since 5th Grade
  • IT Sysadmin+Dev since 1994
slide-11
SLIDE 11

A Bit About Me

  • Geek since 5th Grade
  • IT Sysadmin+Dev since 1994
  • Maker of "Docker Mastery" 120k students
slide-12
SLIDE 12

A Bit About Me

  • Geek since 5th Grade
  • IT Sysadmin+Dev since 1994
  • Maker of "Docker Mastery" 120k students
  • Container Fanboy
slide-13
SLIDE 13

A Bit About Me

  • Geek since 5th Grade
  • IT Sysadmin+Dev since 1994
  • Maker of "Docker Mastery" 120k students
  • Container Fanboy
  • DevOps Trainer/Consultant
slide-14
SLIDE 14

Limit Your Simultaneous Innovation

slide-15
SLIDE 15

Limit Your Simultaneous Innovation

  • Many initial container projects are too big in scope
slide-16
SLIDE 16

Limit Your Simultaneous Innovation

  • Many initial container projects are too big in scope
  • Solutions you maybe don't need day one:
slide-17
SLIDE 17

Limit Your Simultaneous Innovation

  • Many initial container projects are too big in scope
  • Solutions you maybe don't need day one:

○ Fully automatic CI/CD

slide-18
SLIDE 18

Limit Your Simultaneous Innovation

  • Many initial container projects are too big in scope
  • Solutions you maybe don't need day one:

○ Fully automatic CI/CD ○ Dynamic performance autoscaling

slide-19
SLIDE 19

Limit Your Simultaneous Innovation

  • Many initial container projects are too big in scope
  • Solutions you maybe don't need day one:

○ Fully automatic CI/CD ○ Dynamic performance autoscaling ○ Containerizing all or nothing

slide-20
SLIDE 20

Limit Your Simultaneous Innovation

  • Many initial container projects are too big in scope
  • Solutions you maybe don't need day one:

○ Fully automatic CI/CD ○ Dynamic performance autoscaling ○ Containerizing all or nothing ○ Starting with persistent data

slide-21
SLIDE 21

Legacy Apps Work In Containers Too

slide-22
SLIDE 22

Legacy Apps Work In Containers Too

  • Microservice conversion isn't required
slide-23
SLIDE 23

Legacy Apps Work In Containers Too

  • Microservice conversion isn't required
  • 12 Factor is a horizon we're always chasing
slide-24
SLIDE 24

Legacy Apps Work In Containers Too

  • Microservice conversion isn't required
  • 12 Factor is a horizon we're always chasing
  • Don't let these ideals delay containerization
slide-25
SLIDE 25

What To Focus On First: Dockerfiles

slide-26
SLIDE 26

What To Focus On First: Dockerfiles

  • More important than fancy orchestration
slide-27
SLIDE 27

What To Focus On First: Dockerfiles

  • More important than fancy orchestration
  • It's your new build documentation
slide-28
SLIDE 28

What To Focus On First: Dockerfiles

  • More important than fancy orchestration
  • It's your new build documentation
  • Study Dockerfile/Entrypoint of Hub Officials
slide-29
SLIDE 29

What To Focus On First: Dockerfiles

  • More important than fancy orchestration
  • It's your new build documentation
  • Study Dockerfile/Entrypoint of Hub Officials
  • Use FROM Official distros that are most familiar
slide-30
SLIDE 30

Dockerfile Anti-pattern: Using Latest

slide-31
SLIDE 31

Dockerfile Anti-pattern: Using Latest

  • Latest = Image builds will be ¯\_(ツ)_/¯
slide-32
SLIDE 32

Dockerfile Anti-pattern: Using Latest

  • Latest = Image builds will be ¯\_(ツ)_/¯
  • Problem: Image builds pull FROM

latest

  • Solution: Use specific FROM tags
slide-33
SLIDE 33

Dockerfile Anti-pattern: Using Latest

  • Latest = Image builds will be ¯\_(ツ)_/¯
  • Problem: Image builds pull FROM

latest

  • Solution: Use specific FROM tags
  • Problem: Image builds install latest

packages

  • Solution: Specify version for critical

apt/yum/apk packages

slide-34
SLIDE 34

Dockerfile Anti-pattern: Leaving Default Config

slide-35
SLIDE 35

Dockerfile Anti-pattern: Leaving Default Config

  • Problem: Not changing app defaults, or blindly copying VM conf

○ e.g. php.ini, mysql.conf.d, java memory

slide-36
SLIDE 36

Dockerfile Anti-pattern: Leaving Default Config

  • Problem: Not changing app defaults, or blindly copying VM conf

○ e.g. php.ini, mysql.conf.d, java memory

  • Solution: Update default configs via ENV, RUN, and ENTRYPOINT
slide-37
SLIDE 37

Containers-on-VM or Container-on-Bare-Metal

slide-38
SLIDE 38

Containers-on-VM or Container-on-Bare-Metal

  • Do either, or both. Lots of pros/cons to either
slide-39
SLIDE 39

Containers-on-VM or Container-on-Bare-Metal

  • Do either, or both. Lots of pros/cons to either
  • Stick with what you know at first
slide-40
SLIDE 40

Containers-on-VM or Container-on-Bare-Metal

  • Do either, or both. Lots of pros/cons to either
  • Stick with what you know at first
  • Do some basic performance testing. You will learn lots!
slide-41
SLIDE 41

Containers-on-VM or Container-on-Bare-Metal

  • Do either, or both. Lots of pros/cons to either
  • Stick with what you know at first
  • Do some basic performance testing. You will learn lots!
  • 2017 Docker Inc. and HPE whitepaper on MySQL benchmark

○(authored by yours truly, and others) ○bretfisher.com/gotochgo18

slide-42
SLIDE 42

OS Linux Distribution/Kernel Matters

slide-43
SLIDE 43

OS Linux Distribution/Kernel Matters

  • Docker is very kernel and host storage driver dependent
slide-44
SLIDE 44

OS Linux Distribution/Kernel Matters

  • Docker is very kernel and host storage driver dependent
  • Innovations/fixes are still happening here
slide-45
SLIDE 45

OS Linux Distribution/Kernel Matters

  • Docker is very kernel and host storage driver dependent
  • Innovations/fixes are still happening here
  • "Minimum" version != "best" version
slide-46
SLIDE 46

OS Linux Distribution/Kernel Matters

  • Docker is very kernel and host storage driver dependent
  • Innovations/fixes are still happening here
  • "Minimum" version != "best" version
  • No pre-existing opinion? Ubuntu 18.04 L

TS ○ Popular, well-tested with Docker ○ 4.x Kernel and wide storage driver support (overlay2)

slide-47
SLIDE 47

OS Linux Distribution/Kernel Matters

  • Docker is very kernel and host storage driver dependent
  • Innovations/fixes are still happening here
  • "Minimum" version != "best" version
  • No pre-existing opinion? Ubuntu 18.04 L

TS ○ Popular, well-tested with Docker ○ 4.x Kernel and wide storage driver support (overlay2)

  • Container OS's aren't mainstream. Unclear TCO
slide-48
SLIDE 48

OS Linux Distribution/Kernel Matters

  • Docker is very kernel and host storage driver dependent
  • Innovations/fixes are still happening here
  • "Minimum" version != "best" version
  • No pre-existing opinion? Ubuntu 18.04 L

TS ○ Popular, well-tested with Docker ○ 4.x Kernel and wide storage driver support (overlay2)

  • Container OS's aren't mainstream. Unclear TCO
  • Get correct Docker for your distro from hub.docker.com
slide-49
SLIDE 49

Container Base Distribution: Which One?

slide-50
SLIDE 50

Container Base Distribution: Which One?

  • Which FROM image should you use?
slide-51
SLIDE 51

Container Base Distribution: Which One?

  • Which FROM image should you use?
  • Don't make a decision based on size (remember it's Single

Instance Storage)

slide-52
SLIDE 52

Container Base Distribution: Which One?

  • Which FROM image should you use?
  • Don't make a decision based on size (remember it's Single

Instance Storage)

  • At first: match your existing deployment process
slide-53
SLIDE 53

Container Base Distribution: Which One?

  • Which FROM image should you use?
  • Don't make a decision based on size (remember it's Single

Instance Storage)

  • At first: match your existing deployment process
  • Consider changing to Alpine later, maybe never
slide-54
SLIDE 54

When to use Alpine Images

slide-55
SLIDE 55

When to use Alpine Images

  • Alpine is "small" and "sec focused"
slide-56
SLIDE 56

When to use Alpine Images

  • Alpine is "small" and "sec focused"
  • But Debian/Ubuntu are smaller now too
slide-57
SLIDE 57

When to use Alpine Images

  • Alpine is "small" and "sec focused"
  • But Debian/Ubuntu are smaller now too
  • ~100MB space savings isn't significant
slide-58
SLIDE 58

When to use Alpine Images

  • Alpine is "small" and "sec focused"
  • But Debian/Ubuntu are smaller now too
  • ~100MB space savings isn't significant
  • Alpine has its own issues
slide-59
SLIDE 59

When to use Alpine Images

  • Alpine is "small" and "sec focused"
  • But Debian/Ubuntu are smaller now too
  • ~100MB space savings isn't significant
  • Alpine has its own issues
  • Alpine CVE scanning fails
slide-60
SLIDE 60

When to use Alpine Images

  • Alpine is "small" and "sec focused"
  • But Debian/Ubuntu are smaller now too
  • ~100MB space savings isn't significant
  • Alpine has its own issues
  • Alpine CVE scanning fails
  • Enterprises may require CentOS or

Ubuntu/Debian

slide-61
SLIDE 61

Image Sizes for node/slim/alpine

slide-62
SLIDE 62

Image Sizes for node/slim/alpine

slide-63
SLIDE 63

Good Defaults: Swarm Architectures

slide-64
SLIDE 64

Good Defaults: Swarm Architectures

  • Simple sizing guidelines based off:

○ Docker internal testing ○ Docker reference architectures ○ Real world deployments ○ Swarm3k lessons learned

slide-65
SLIDE 65
slide-66
SLIDE 66
slide-67
SLIDE 67

Baby Swarm: 1-Node

slide-68
SLIDE 68

Baby Swarm: 1-Node

  • "docker swarm init" done!
  • Solo VM's do it, so can Swarm
  • Gives you more features

then docker run

  • bret.show/babyswarm
slide-69
SLIDE 69

HA Swarm: 3-Node

slide-70
SLIDE 70

HA Swarm: 3-Node

  • Minimum for HA
  • All Managers
  • One node can fail
  • Use when very small budget
  • Pet projects or Test/CI
slide-71
SLIDE 71

Biz Swarm: 5-Node

slide-72
SLIDE 72

Biz Swarm: 5-Node

  • Better high-availability
  • All Managers
  • Two nodes can fail
  • My minimum for uptime that

affects $$$

slide-73
SLIDE 73

Flexy Swarm: 10+ Nodes

slide-74
SLIDE 74

Flexy Swarm: 10+ Nodes

  • 5 dedicated Managers
  • Workers in DMZ
  • Anything beyond 5 nodes, stick with

5 Managers and rest Workers

  • Control container placement with

labels + constraints

slide-75
SLIDE 75

Swole Swarm: 100+ Nodes

slide-76
SLIDE 76

Swole Swarm: 100+ Nodes

  • 5 dedicated managers
  • Resize Managers as you grow
  • Multiple Worker subnets on

Private/DMZ

  • Control container placement with

labels + constraints

slide-77
SLIDE 77

Don't Turn Cattle into Pets

slide-78
SLIDE 78

Don't Turn Cattle into Pets

  • Assume nodes will be replaced
  • Assume containers will be recreated
  • Automate any host customization
  • Every time you SSH into a server 🐽🔬
slide-79
SLIDE 79

Reasons for Multiple Clusters

slide-80
SLIDE 80

Reasons for Multiple Clusters

Bad Reasons

  • Different hardware

configurations (or OS!)

  • Different subnets or

security groups

  • Different availability zones
  • Security boundaries for

compliance

slide-81
SLIDE 81

Reasons for Multiple Clusters

Bad Reasons

  • Different hardware

configurations (or OS!)

  • Different subnets or

security groups

  • Different availability zones
  • Security boundaries for

compliance

Good Reasons

  • Learning: Run Stuff on Test

Swarm

  • Geographical boundaries
  • Management boundaries

using Docker API (or Docker EE RBAC, or other auth plugin)

slide-82
SLIDE 82

What About Windows Server 2019?

  • Hard to be "Windows Only Swarm", mix with Linux nodes
  • Much of those tools are Linux only
  • Windows = Less choice, but easier path
  • My recommendation:

○Managers on Linux ○Reserve Windows for Windows-exclusive workloads

  • Swarm is more stable, Kubernetes is still early days
slide-83
SLIDE 83

DevSecOps: Making Friends With InfoSec

  • Good: Just putting apps in Docker vs. host =

○Whiltelist of Linux kernel capabilities ✔ ○AppLocker profile enabled ✔ ○SecComp profile enabled ✔

  • USER appname: App is not container root (e.g. node/python)
  • User Namespaces: Container root isn't root (turn on per host)
  • More basics at: bret.show/securityfirst
slide-84
SLIDE 84

DevSecOps: Shift Left Security

  • Scan, Scan, Scan.
  • Scan for CVE's in git: snyk.io
  • Scan for CVE's in image builds: MicroScanner
  • Scan for CVE's in images: Trivy
slide-85
SLIDE 85

DevSecOps: Content Trust

  • Only used scanned images
  • Only allow running of signed images
  • Only used signed code
slide-86
SLIDE 86

DevOps: Focus On Outcomes, Not Tools

slide-87
SLIDE 87

DevOps: Focus On Outcomes, Not Tools

  • Only change/implement what:
slide-88
SLIDE 88

DevOps: Focus On Outcomes, Not Tools

  • Only change/implement what:

○Gives you back a measurable chunk of time

slide-89
SLIDE 89

DevOps: Focus On Outcomes, Not Tools

  • Only change/implement what:

○Gives you back a measurable chunk of time ○Greatly improves MTTR

slide-90
SLIDE 90

DevOps: Focus On Outcomes, Not Tools

  • Only change/implement what:

○Gives you back a measurable chunk of time ○Greatly improves MTTR ○Greatly improves deployment frequency

slide-91
SLIDE 91

DevOps: Focus On Outcomes, Not Tools

  • Only change/implement what:

○Gives you back a measurable chunk of time ○Greatly improves MTTR ○Greatly improves deployment frequency

  • NO to everything else!
slide-92
SLIDE 92

DevOps: Focus On Outcomes, Not Tools

  • Only change/implement what:

○Gives you back a measurable chunk of time ○Greatly improves MTTR ○Greatly improves deployment frequency

  • NO to everything else!
  • More at bret.show/humandevops
slide-93
SLIDE 93

Outsource Well-Defined Plumbing

slide-94
SLIDE 94

Outsource Well-Defined Plumbing

  • Beware the "not implemented here" syndrome
slide-95
SLIDE 95

Outsource Well-Defined Plumbing

  • Beware the "not implemented here" syndrome
  • My formula for "Do we use SaaS/Commercial"?
slide-96
SLIDE 96

Outsource Well-Defined Plumbing

  • Beware the "not implemented here" syndrome
  • My formula for "Do we use SaaS/Commercial"?

○If it's a challenge to implement and maintain

slide-97
SLIDE 97

Outsource Well-Defined Plumbing

  • Beware the "not implemented here" syndrome
  • My formula for "Do we use SaaS/Commercial"?

○If it's a challenge to implement and maintain ○+ SaaS/commercial market is mature

slide-98
SLIDE 98

Outsource Well-Defined Plumbing

  • Beware the "not implemented here" syndrome
  • My formula for "Do we use SaaS/Commercial"?

○If it's a challenge to implement and maintain ○+ SaaS/commercial market is mature ○= Opportunities for outsourcing

slide-99
SLIDE 99

Outsourcing: For Your Consideration

slide-100
SLIDE 100

Outsourcing: For Your Consideration

  • Image registry
slide-101
SLIDE 101

Outsourcing: For Your Consideration

  • Image registry
  • Logs
slide-102
SLIDE 102

Outsourcing: For Your Consideration

  • Image registry
  • Logs
  • Monitoring and alerting
slide-103
SLIDE 103

Outsourcing: For Your Consideration

  • Image registry
  • Logs
  • Monitoring and alerting
  • Big Tools/Projects: github.com/cncf/landscape
slide-104
SLIDE 104

Outsourcing: For Your Consideration

  • Image registry
  • Logs
  • Monitoring and alerting
  • Big Tools/Projects: github.com/cncf/landscape
  • All The Things: github.com/veggiemonk/awesome-docker

github.com/ramitsurana/awesome-kubernetes

slide-105
SLIDE 105

Tech Stacks

Designs for a full-featured cluster

slide-106
SLIDE 106

Pure Open Source Swarm Stack

slide-107
SLIDE 107

Pure Open Source Swarm Stack

HW / OS Ansible Terraform

slide-108
SLIDE 108

Pure Open Source Swarm Stack

HW / OS Ansible Terraform Runtime Docker

slide-109
SLIDE 109

Pure Open Source Swarm Stack

HW / OS Ansible Terraform Runtime Docker Orchestration Docker Swarm

slide-110
SLIDE 110

Pure Open Source Swarm Stack

HW / OS Ansible Terraform Runtime Docker Orchestration Docker Swarm Networking Docker Swarm

slide-111
SLIDE 111

Pure Open Source Swarm Stack

HW / OS Ansible Terraform Runtime Docker Orchestration Docker Swarm Networking Docker Swarm Storage REX-Ray

slide-112
SLIDE 112

Pure Open Source Swarm Stack

HW / OS Ansible Terraform Runtime Docker Orchestration Docker Swarm Networking Docker Swarm Storage REX-Ray CI/CD Jenkins Drone

slide-113
SLIDE 113

Pure Open Source Swarm Stack

HW / OS Ansible Terraform Runtime Docker Orchestration Docker Swarm Networking Docker Swarm Storage REX-Ray CI/CD Jenkins Drone Registry Docker Distribution + Portus

slide-114
SLIDE 114

Pure Open Source Swarm Stack

HW / OS Ansible Terraform Runtime Docker Orchestration Docker Swarm Networking Docker Swarm Storage REX-Ray CI/CD Jenkins Drone Registry Docker Distribution + Portus Layer 7 Proxy Traefik

slide-115
SLIDE 115

Pure Open Source Swarm Stack

HW / OS Ansible Terraform Runtime Docker Orchestration Docker Swarm Networking Docker Swarm Storage REX-Ray CI/CD Jenkins Drone Registry Docker Distribution + Portus Layer 7 Proxy Traefik Central Logging ELK

slide-116
SLIDE 116

Pure Open Source Swarm Stack

HW / OS Ansible Terraform Runtime Docker Orchestration Docker Swarm Networking Docker Swarm Storage REX-Ray CI/CD Jenkins Drone Registry Docker Distribution + Portus Layer 7 Proxy Traefik Central Logging ELK Central Monitoring Prometheus + Grafana

slide-117
SLIDE 117

Pure Open Source Swarm Stack

HW / OS Ansible Terraform Runtime Docker Orchestration Docker Swarm Networking Docker Swarm Storage REX-Ray CI/CD Jenkins Drone Registry Docker Distribution + Portus Layer 7 Proxy Traefik Central Logging ELK Central Monitoring Prometheus + Grafana GUI Management Portainer

slide-118
SLIDE 118

Pure Open Source Swarm Stack

HW / OS Ansible Terraform Runtime Docker Orchestration Docker Swarm Networking Docker Swarm Storage REX-Ray CI/CD Jenkins Drone Registry Docker Distribution + Portus Layer 7 Proxy Traefik Central Logging ELK Central Monitoring Prometheus + Grafana GUI Management Portainer Also Functions As A Service: OpenFaaS

slide-119
SLIDE 119

Commercial Products/SaaS Swarm Stack

slide-120
SLIDE 120

Commercial Products/SaaS Swarm Stack

GUI Management Portainer Central Monitoring Librato / DataDog / Sysdig Central Logging DataDog / Papertrail / Loggly Layer 7 Proxy Traefik Enterprise Registry Docker Hub Quay CI/CD GitLab CircleCI Storage Portworx Networking Docker Swarm / Weave Orchestration Docker Swarm Runtime Docker HW / OS Ansible Terraform

slide-121
SLIDE 121

Docker Enterprise Swarm or Kubernetes

slide-122
SLIDE 122

Docker Enterprise Swarm or Kubernetes

Swarm GUI Docker Enterprise (UCP) Central Monitoring Prometheus Sysdig Central Logging Docker for AWS/Azure Layer 7 Proxy Docker Enterprise (UCP) Registry Docker Enterprise (DTR) CI/CD Jenkins GitLab Storage NetApp / Portworx / CSI Networking Swarm Overlay / Calico Orchestration Docker Swarm / Kubernetes Runtime Docker Enterprise HW / OS Docker Enterprise

slide-123
SLIDE 123

Docker Enterprise Swarm or Kubernetes

Swarm GUI Docker Enterprise (UCP) Central Monitoring Prometheus Sysdig Central Logging Docker for AWS/Azure Layer 7 Proxy Docker Enterprise (UCP) Registry Docker Enterprise (DTR) CI/CD Jenkins GitLab Storage NetApp / Portworx / CSI Networking Swarm Overlay / Calico Orchestration Docker Swarm / Kubernetes Runtime Docker Enterprise HW / OS Docker Enterprise Also Image Security Scanning Role-Based Access Cont Image Promotion Content Trust

slide-124
SLIDE 124
slide-125
SLIDE 125
slide-126
SLIDE 126

Session Name

Title & Company

Speaker Name

😭

slide-127
SLIDE 127

Thank You! @bretfisher

Free 15 Hour Course: bret.show/gotoberdocker Slide resources: bretfisher.com/docker

🤙