Providing and Supporting Docker Images Philipp Krenn 4444 @xeraa

Infrastructure | Developer !

Who uses Docker?

Who uses Docker in production?

Who uses stateful Docker images?

Who uses our images?

Who uses our stack with other images?

Docker: the world's most heavily funded college project Internal quote from Slack

Content "Official" Base images Release policy Security Support Orchestration

Docker Hub "official"

What do you get? docker pull elasticsearch

Custom registry docker.elastic.co

I’m surprised more people don’t just host their own container registries since doing that is faster than every cloud offering and docker hub https://twitter.com/jessfraz/status/978449365261082625

Our Motivation Download statistics Speed & reliability

https://www.docker.elastic.co

Problems Some broken tooling like automated builds, Kitematic,... China IPv6

https://hub.docker.com/r/elastic/ elasticsearch/ kibana/ *beat/ logstash/ apm-server/

Quick Quiz Our image or not?

docker pull logstash:alpine

docker pull elastic/elasticsearch

docker pull kibana

docker pull docker.elastic.co/beats/filebeat:6.2.3

Base Images

Elasticsearch Alpine

Kibana 4 Beats 4 Logstash Ubuntu

Common base image in 5.4+ CentOS 7

https://github.com/elastic/elasticsearch-docker/blob/master/templates/Dockerfile.j2 FROM centos:7 LABEL maintainer "Elastic Docker Team docker@elastic.co" ENV ELASTIC_CONTAINER true ENV PATH /usr/share/elasticsearch/bin:$PATH ENV JAVA_HOME /usr/lib/jvm/jre-1.8.0-openjdk RUN yum update -y &&
yum install -y nc java-1.8.0-openjdk-headless unzip wget which &&
yum clean all

Upside Similar setup Shared layers JVM images largish anyway

Downside Size

$ docker images REPOSITORY TAG IMAGE ID SIZE docker.elastic.co/kibana/kibana 6.3.0 128b6bfb9645 729MB docker.elastic.co/elasticsearch/elasticsearch 6.3.0 7e188ef97fe0 783MB docker.elastic.co/beats/filebeat 6.3.0 f90fd7f32529 318MB docker.elastic.co/kibana/kibana 6.2.4 327c6538ba4c 933MB docker.elastic.co/elasticsearch/elasticsearch 6.2.4 7cb69da7148d 515MB docker.elastic.co/beats/filebeat 6.2.4 26a00abcde82 319MB docker.elastic.co/kibana/kibana 5.6.7 0f8347a118b3 697MB docker.elastic.co/elasticsearch/elasticsearch 5.6.7 f9bc1b5416b9 574MB docker.elastic.co/beats/filebeat 5.6.7 02648e71cced 334MB docker.elastic.co/kibana/kibana 5.3.3 ffe778f7e489 679MB docker.elastic.co/elasticsearch/elasticsearch 5.3.3 5857f98b5920 165MB docker.elastic.co/beats/filebeat 5.3.3 c01be8a8f630 232MB

5.3 5.6 6.2 6.3 ES 165MB 574MB 515MB 783MB Kibana 679MB 697MB 933MB 729MB Filebeat 232MB 334MB 319MB 318MB

Does it matter? stateful vs stateless

What to include?

Single image for 5.x Platinum trial

Three flavors 6.0 to 6.2 Basic * , OSS, Platinum trial *   Default

Two flavors 6.3+ Basic / Platinum trial * , OSS 783MB vs 673MB *   Default

Future

Multiple JDK versions? 6.2: OpenJDK 8 6.3 BC: OpenJDK 10.0.1

Multiple base images?

Windows?!

Release Policy

No :latest

Zombies ideas that should have been killed by evidence, but keep shambling along

5 and 5.6 ?

What's in a tag? docker.elastic.co/elasticsearch/elasticsearch 5.3.3 5857f98b5920 4 months ago docker.elastic.co/beats/filebeat 5.3.3 c01be8a8f630 5 months ago docker.elastic.co/kibana/kibana 5.3.3 ffe778f7e489 5 months ago

Currently Overwrite tag

Label Schema LABEL org.label-schema.schema-version="1.0"
org.label-schema.vendor="Elastic"
org.label-schema.name="elasticsearch"
org.label-schema.version="{{ elastic_version }}"
org.label-schema.url="https://www.elastic.co/products/elasticsearch"
org.label-schema.vcs-url="https://github.com/elastic/elasticsearch-docker"
{% if image_flavor == 'oss' -%} license="Apache-2.0" {% else -%} license="Elastic License" {% endif -%}

Base image & JVM direct dependencies

Future Add image version?

Security

Run Elasticsearch as root

Cockroaches claims that disappear for a while when proved wrong, but just keep on coming back

Mode Production: Clusterable Development: Local network

"Docker" mode discovery.type=single-node

Bootstrap checks are here to stay

6.0+ no more default credentials

6.0+ X-Pack non-trial requires certificates

Support

The container runs Elasticsearch as user elasticsearch using uid:gid 1000:1000 . https://www.elastic.co/guide/en/elasticsearch/reference/current/ docker.html

Don't mutate the bind mounted local directory

Zombies ideas that should have been killed by evidence, but keep shambling along

Those who do not understand Unix are condemned to reinvent it, poorly. — Henry Spencer

Docker default value? LimitNOFILE & LimitNPROC

infinity https://github.com/moby/moby/commit/ 8db61095a3d0bcb0733580734ba5d54bc27a614d (July 2016)

Test $ docker run --rm centos:7 /bin/bash -c \

'ulimit -Hn && ulimit -Sn && ulimit -Hu && ulimit -Su' 1048576 1048576 unlimited unlimited

Combine two new systems to get chaos & despair

Docker is a leaky abstraction

Orchestration

Who uses Kubernetes?

Who uses Swarm?

Who uses Mesos?

Who uses Nomad?

No orchestration yet

Testing images for orchestration

Kubernetes 1.8 allows dots in env vars https://github.com/kubernetes/kubernetes/issues/2707

Kubernetes has made huge improvements in the ability to run stateful workloads including databases and message queues, but I still prefer not to run them on Kubernetes. https://twitter.com/kelseyhightower/status/963413508300812295

Kubernetes makes it easier to deploy stateful services not manage them. Stateful services must meet Kubernetes half way and manage their own cluster membership, failover, and replication. CockroachDB and Consul are two great examples, but far from perfect. https://twitter.com/kelseyhightower/status/963415653930553345

Conclusion

"Docker is disrupting the industry"

"Can I run Elasticsearch on Docker?"

"Should I run Elasticsearch on Docker?"

Even when stateful services do the right things managing state is still hard. Mixing stateful and stateless applications on the same cluster elevates the complexity of the entire cluster. Cluster security and upgrades become much harder. https://twitter.com/kelseyhightower/status/963417215608369153

https://www.meetup.com/Elasticsearch-Berlin/ Thursday June 14, 19:00 Springer Nature

Questions & Discussion Philipp Krenn 444 @xeraa