Links
Comment on page

Swarm

Docker container clusters

docker swarm init

  • Lots of PKI and security automation
    • Root signing certificate create for our Swarm
    • Certificate is issued for first Manager node
    • Join tokens are created
  • Raft database create to store root CA, configs and secrets
    • Encrypted by default on disk
    • No need for another key / value system to hold orchestration / secrets
    • Replicates logs amongst Managers via mutual TLS in "control plane"
docker swarm join-token manager
  • scaling up to multiple containers:
  • docker service update --replicas <#>

Swarm Stacks: Production grade compose

  • IN Docker 1.13 Docker adds a new layer of abstraction to Swarm called Stacks
  • Stacks accept Compose files as their declarative definition for services, networks and volumes.
  • We use 'docker stack deploy' rather than docker stack create
  • Stacks manages all those objects for us, including overlay network per stack. Adds stack name to start of their name.
  • New 'deploy:' key in Compose file, does not support 'build:'
  • Compose now ignores 'deploy:'; Swarm ignores 'build:'
  • docker-compose CLI is not needed on Swarm server
docker stack deploy -c my-stack.yml demoapp docker stack services demoapp

Swarm Secrets Storage

  • Easiest "secure" solution for storing secrets in Swarm
  • Supports generic strings or binary content up to 500Kb in size
  • Doesn't require apps to be rewritten
  • As of Docker 1.13 Swarm Raft DB is encrypted on disk
  • Only stored on disk on manager nodes
  • Default is Managers and Workers "control plane" is TLS + Mutual Auth
  • Secrets are first stored in Swarm then assigned to a Service
  • Only containers in assigned Services can see them
  • They look like files in container but are actually in-memory file system
  • /run/secrets/{secrets-name} or /run/secrets/{secrets-alias}
  • Local docker-compose can use file-based secrets, but not secure

Option 1 - create from file

docker secret create psql_user psql_user.txt

Option 2 - Create from STDIN

echo "MyDbPassWORD" | docker secret create psql_user -
// Enable secret in the service
docker service create --name psql --secret psql_user --secret psql_pass -e POSTGRES_PASSWORD_FILE=/run/secrets/psql_pass -e POSTGRES_USER_FILE=/run/secrets/psql_user postgres
With compose 3.1 secrets are supported inside Compose files
secrets:
my_first_secret:
file: ./secret_data
my_second_secret:
external: true
name: redis_secret