From 909f9f5ea808f2f1c36d4d5bb3712301b3e9afab Mon Sep 17 00:00:00 2001 From: Sebastiaan van Stijn Date: Thu, 18 Aug 2016 17:20:09 +0200 Subject: [PATCH 01/35] Merge pull request #25726 from vieux/new_plugin_system_doc adding some documentation about the new plugin system (cherry picked from commit 88a6a7763b789a35fff9df4e52e48ca99afd3c08) Signed-off-by: Charles Smith --- docs/extend/legacy_plugins.md | 91 ++++++++ docs/extend/{index.md => menu.md} | 12 +- docs/extend/plugin_api.md | 8 +- docs/extend/plugins.md | 307 +++++++++++++++++++++------ docs/extend/plugins_authorization.md | 6 +- docs/extend/plugins_network.md | 5 + docs/extend/plugins_volume.md | 1 + docs/userguide/networking/index.md | 2 +- 8 files changed, 360 insertions(+), 72 deletions(-) create mode 100644 docs/extend/legacy_plugins.md rename docs/extend/{index.md => menu.md} (63%) diff --git a/docs/extend/legacy_plugins.md b/docs/extend/legacy_plugins.md new file mode 100644 index 0000000000..02874f315e --- /dev/null +++ b/docs/extend/legacy_plugins.md @@ -0,0 +1,91 @@ + + +# Understand legacy Docker Engine plugins + +This document describes the Docker Engine plugins generally available in Docker +Engine 1.12 and earlier. To view information on plugins managed by Docker +Engine, refer to [Docker Engine plugin system](plugins.md). + +You can extend the capabilities of the Docker Engine by loading third-party +plugins. This page explains the types of plugins and provides links to several +volume and network plugins for Docker. + +## Types of plugins + +Plugins extend Docker's functionality. They come in specific types. For +example, a [volume plugin](plugins_volume.md) might enable Docker +volumes to persist across multiple Docker hosts and a +[network plugin](plugins_network.md) might provide network plumbing. + +Currently Docker supports authorization, volume and network driver plugins. In the future it +will support additional plugin types. + +## Installing a plugin + +Follow the instructions in the plugin's documentation. + +## Finding a plugin + +The sections below provide an inexhaustive overview of available plugins. + + + +### Network plugins + +Plugin | Description +----------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- +[Contiv Networking](https://github.com/contiv/netplugin) | An open source network plugin to provide infrastructure and security policies for a multi-tenant micro services deployment, while providing an integration to physical network for non-container workload. Contiv Networking implements the remote driver and IPAM APIs available in Docker 1.9 onwards. +[Kuryr Network Plugin](https://github.com/openstack/kuryr) | A network plugin is developed as part of the OpenStack Kuryr project and implements the Docker networking (libnetwork) remote driver API by utilizing Neutron, the OpenStack networking service. It includes an IPAM driver as well. +[Weave Network Plugin](https://www.weave.works/docs/net/latest/introducing-weave/) | A network plugin that creates a virtual network that connects your Docker containers - across multiple hosts or clouds and enables automatic discovery of applications. Weave networks are resilient, partition tolerant, secure and work in partially connected networks, and other adverse environments - all configured with delightful simplicity. + +### Volume plugins + +Plugin | Description +----------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- +[Azure File Storage plugin](https://github.com/Azure/azurefile-dockervolumedriver) | Lets you mount Microsoft [Azure File Storage](https://azure.microsoft.com/blog/azure-file-storage-now-generally-available/) shares to Docker containers as volumes using the SMB 3.0 protocol. [Learn more](https://azure.microsoft.com/blog/persistent-docker-volumes-with-azure-file-storage/). +[Blockbridge plugin](https://github.com/blockbridge/blockbridge-docker-volume) | A volume plugin that provides access to an extensible set of container-based persistent storage options. It supports single and multi-host Docker environments with features that include tenant isolation, automated provisioning, encryption, secure deletion, snapshots and QoS. +[Contiv Volume Plugin](https://github.com/contiv/volplugin) | An open source volume plugin that provides multi-tenant, persistent, distributed storage with intent based consumption using ceph underneath. +[Convoy plugin](https://github.com/rancher/convoy) | A volume plugin for a variety of storage back-ends including device mapper and NFS. It's a simple standalone executable written in Go and provides the framework to support vendor-specific extensions such as snapshots, backups and restore. +[DRBD plugin](https://www.drbd.org/en/supported-projects/docker) | A volume plugin that provides highly available storage replicated by [DRBD](https://www.drbd.org). Data written to the docker volume is replicated in a cluster of DRBD nodes. +[Flocker plugin](https://clusterhq.com/docker-plugin/) | A volume plugin that provides multi-host portable volumes for Docker, enabling you to run databases and other stateful containers and move them around across a cluster of machines. +[gce-docker plugin](https://github.com/mcuadros/gce-docker) | A volume plugin able to attach, format and mount Google Compute [persistent-disks](https://cloud.google.com/compute/docs/disks/persistent-disks). +[GlusterFS plugin](https://github.com/calavera/docker-volume-glusterfs) | A volume plugin that provides multi-host volumes management for Docker using GlusterFS. +[Horcrux Volume Plugin](https://github.com/muthu-r/horcrux) | A volume plugin that allows on-demand, version controlled access to your data. Horcrux is an open-source plugin, written in Go, and supports SCP, [Minio](https://www.minio.io) and Amazon S3. +[HPE 3Par Volume Plugin](https://github.com/hpe-storage/python-hpedockerplugin/) | A volume plugin that supports HPE 3Par and StoreVirtual iSCSI storage arrays. +[IPFS Volume Plugin](http://github.com/vdemeester/docker-volume-ipfs) | An open source volume plugin that allows using an [ipfs](https://ipfs.io/) filesystem as a volume. +[Keywhiz plugin](https://github.com/calavera/docker-volume-keywhiz) | A plugin that provides credentials and secret management using Keywhiz as a central repository. +[Local Persist Plugin](https://github.com/CWSpear/local-persist) | A volume plugin that extends the default `local` driver's functionality by allowing you specify a mountpoint anywhere on the host, which enables the files to *always persist*, even if the volume is removed via `docker volume rm`. +[NetApp Plugin](https://github.com/NetApp/netappdvp) (nDVP) | A volume plugin that provides direct integration with the Docker ecosystem for the NetApp storage portfolio. The nDVP package supports the provisioning and management of storage resources from the storage platform to Docker hosts, with a robust framework for adding additional platforms in the future. +[Netshare plugin](https://github.com/ContainX/docker-volume-netshare) | A volume plugin that provides volume management for NFS 3/4, AWS EFS and CIFS file systems. +[OpenStorage Plugin](https://github.com/libopenstorage/openstorage) | A cluster-aware volume plugin that provides volume management for file and block storage solutions. It implements a vendor neutral specification for implementing extensions such as CoS, encryption, and snapshots. It has example drivers based on FUSE, NFS, NBD and EBS to name a few. +[Quobyte Volume Plugin](https://github.com/quobyte/docker-volume) | A volume plugin that connects Docker to [Quobyte](http://www.quobyte.com/containers)'s data center file system, a general-purpose scalable and fault-tolerant storage platform. +[REX-Ray plugin](https://github.com/emccode/rexray) | A volume plugin which is written in Go and provides advanced storage functionality for many platforms including VirtualBox, EC2, Google Compute Engine, OpenStack, and EMC. +[Virtuozzo Storage and Ploop plugin](https://github.com/virtuozzo/docker-volume-ploop) | A volume plugin with support for Virtuozzo Storage distributed cloud file system as well as ploop devices. +[VMware vSphere Storage Plugin](https://github.com/vmware/docker-volume-vsphere) | Docker Volume Driver for vSphere enables customers to address persistent storage requirements for Docker containers in vSphere environments. + +### Authorization plugins + + Plugin | Description +------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ + [Twistlock AuthZ Broker](https://github.com/twistlock/authz) | A basic extendable authorization plugin that runs directly on the host or inside a container. This plugin allows you to define user policies that it evaluates during authorization. Basic authorization is provided if Docker daemon is started with the --tlsverify flag (username is extracted from the certificate common name). + +## Troubleshooting a plugin + +If you are having problems with Docker after loading a plugin, ask the authors +of the plugin for help. The Docker team may not be able to assist you. + +## Writing a plugin + +If you are interested in writing a plugin for Docker, or seeing how they work +under the hood, see the [docker plugins reference](plugin_api.md). diff --git a/docs/extend/index.md b/docs/extend/menu.md similarity index 63% rename from docs/extend/index.md rename to docs/extend/menu.md index 8a061e4e29..1c523e2dfa 100644 --- a/docs/extend/index.md +++ b/docs/extend/menu.md @@ -1,22 +1,20 @@ -## Extending Docker Engine +## New Docker Plugin System Currently, you can extend Docker Engine by adding a plugin. This section contains the following topics: * [Understand Docker plugins](plugins.md) * [Write a volume plugin](plugins_volume.md) -* [Write a network plugin](plugins_network.md) -* [Write an authorization plugin](plugins_authorization.md) -* [Docker plugin API](plugin_api.md) diff --git a/docs/extend/plugin_api.md b/docs/extend/plugin_api.md index a799a13520..1f55b6d528 100644 --- a/docs/extend/plugin_api.md +++ b/docs/extend/plugin_api.md @@ -5,7 +5,7 @@ description = "How to write Docker plugins extensions " keywords = ["API, Usage, plugins, documentation, developer"] [menu.main] parent = "engine_extend" -weight=1 +weight=7 +++ @@ -14,9 +14,13 @@ weight=1 Docker plugins are out-of-process extensions which add capabilities to the Docker Engine. +This document describes the Docker Engine plugin API generally available in +Docker Engine 1.12 and earlier. To view information on plugins managed by Docker +Engine, refer to [Docker Engine plugin system](plugins.md). + This page is intended for people who want to develop their own Docker plugin. If you just want to learn about or use Docker plugins, look -[here](plugins.md). +[here](legacy_plugins.md). ## What plugins are diff --git a/docs/extend/plugins.md b/docs/extend/plugins.md index 72d50bd150..cba09f5cd5 100644 --- a/docs/extend/plugins.md +++ b/docs/extend/plugins.md @@ -1,87 +1,272 @@ -# Understand Engine plugins +# Docker Engine plugin system -You can extend the capabilities of the Docker Engine by loading third-party -plugins. This page explains the types of plugins and provides links to several -volume and network plugins for Docker. +This document describes the plugin system available today in the **experimental +build** of Docker 1.12: -## Types of plugins +* [How to operate an existing plugin](#how-to-operate-a-plugin) +* [How to develop a plugin](#how-to-develop-a-plugin) -Plugins extend Docker's functionality. They come in specific types. For -example, a [volume plugin](plugins_volume.md) might enable Docker -volumes to persist across multiple Docker hosts and a -[network plugin](plugins_network.md) might provide network plumbing. +Unlike the legacy plugin system, you now manage plugins using Docker Engine: -Currently Docker supports authorization, volume and network driver plugins. In the future it -will support additional plugin types. +* install plugins +* start plugins +* stop plugins +* remove plugins -## Installing a plugin +The current Docker Engine plugin system only supports volume drivers. We are +adding more plugin driver types in the future releases. -Follow the instructions in the plugin's documentation. +For information on Docker Engine plugins generally available in Docker Engine +1.12 and earlier, refer to [Understand legacy Docker Engine plugins](legacy_plugins.md). -## Finding a plugin +## How to operate a plugin -The sections below provide an inexhaustive overview of available plugins. +Plugins are distributed as Docker images, so develpers can host them on Docker +Hub or on a private registry. - +You install the plugin using a single command: `docker plugin install `. +The `plugin install` command pulls the plugin from the Docker Hub or private +registry. If necessary the CLI prompts you to accept any privilige requriements. +For example the plugin may require access to a device on the host system. +Finally it enables the plugin. -### Network plugins +Run `docker plugin ls` to check the status of installed plugins. The Engine +markes plugins that are started without issues as `ENABLED`. -Plugin | Description ------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- -[Contiv Networking](https://github.com/contiv/netplugin) | An open source network plugin to provide infrastructure and security policies for a multi-tenant micro services deployment, while providing an integration to physical network for non-container workload. Contiv Networking implements the remote driver and IPAM APIs available in Docker 1.9 onwards. -[Kuryr Network Plugin](https://github.com/openstack/kuryr) | A network plugin is developed as part of the OpenStack Kuryr project and implements the Docker networking (libnetwork) remote driver API by utilizing Neutron, the OpenStack networking service. It includes an IPAM driver as well. -[Weave Network Plugin](https://www.weave.works/docs/net/latest/introducing-weave/) | A network plugin that creates a virtual network that connects your Docker containers - across multiple hosts or clouds and enables automatic discovery of applications. Weave networks are resilient, partition tolerant, secure and work in partially connected networks, and other adverse environments - all configured with delightful simplicity. +After you install a plugin, the plugin behavior is the same as legacy plugins. +The following example demonstrates how to install the `sshfs` plugin and use it +to create a volume. -### Volume plugins +1. Install the `sshfs` plugin. -Plugin | Description ------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- -[Azure File Storage plugin](https://github.com/Azure/azurefile-dockervolumedriver) | Lets you mount Microsoft [Azure File Storage](https://azure.microsoft.com/blog/azure-file-storage-now-generally-available/) shares to Docker containers as volumes using the SMB 3.0 protocol. [Learn more](https://azure.microsoft.com/blog/persistent-docker-volumes-with-azure-file-storage/). -[Blockbridge plugin](https://github.com/blockbridge/blockbridge-docker-volume) | A volume plugin that provides access to an extensible set of container-based persistent storage options. It supports single and multi-host Docker environments with features that include tenant isolation, automated provisioning, encryption, secure deletion, snapshots and QoS. -[Contiv Volume Plugin](https://github.com/contiv/volplugin) | An open source volume plugin that provides multi-tenant, persistent, distributed storage with intent based consumption using ceph underneath. -[Convoy plugin](https://github.com/rancher/convoy) | A volume plugin for a variety of storage back-ends including device mapper and NFS. It's a simple standalone executable written in Go and provides the framework to support vendor-specific extensions such as snapshots, backups and restore. -[DRBD plugin](https://www.drbd.org/en/supported-projects/docker) | A volume plugin that provides highly available storage replicated by [DRBD](https://www.drbd.org). Data written to the docker volume is replicated in a cluster of DRBD nodes. -[Flocker plugin](https://clusterhq.com/docker-plugin/) | A volume plugin that provides multi-host portable volumes for Docker, enabling you to run databases and other stateful containers and move them around across a cluster of machines. -[gce-docker plugin](https://github.com/mcuadros/gce-docker) | A volume plugin able to attach, format and mount Google Compute [persistent-disks](https://cloud.google.com/compute/docs/disks/persistent-disks). -[GlusterFS plugin](https://github.com/calavera/docker-volume-glusterfs) | A volume plugin that provides multi-host volumes management for Docker using GlusterFS. -[Horcrux Volume Plugin](https://github.com/muthu-r/horcrux) | A volume plugin that allows on-demand, version controlled access to your data. Horcrux is an open-source plugin, written in Go, and supports SCP, [Minio](https://www.minio.io) and Amazon S3. -[HPE 3Par Volume Plugin](https://github.com/hpe-storage/python-hpedockerplugin/) | A volume plugin that supports HPE 3Par and StoreVirtual iSCSI storage arrays. -[IPFS Volume Plugin](http://github.com/vdemeester/docker-volume-ipfs) | An open source volume plugin that allows using an [ipfs](https://ipfs.io/) filesystem as a volume. -[Keywhiz plugin](https://github.com/calavera/docker-volume-keywhiz) | A plugin that provides credentials and secret management using Keywhiz as a central repository. -[Local Persist Plugin](https://github.com/CWSpear/local-persist) | A volume plugin that extends the default `local` driver's functionality by allowing you specify a mountpoint anywhere on the host, which enables the files to *always persist*, even if the volume is removed via `docker volume rm`. -[NetApp Plugin](https://github.com/NetApp/netappdvp) (nDVP) | A volume plugin that provides direct integration with the Docker ecosystem for the NetApp storage portfolio. The nDVP package supports the provisioning and management of storage resources from the storage platform to Docker hosts, with a robust framework for adding additional platforms in the future. -[Netshare plugin](https://github.com/ContainX/docker-volume-netshare) | A volume plugin that provides volume management for NFS 3/4, AWS EFS and CIFS file systems. -[OpenStorage Plugin](https://github.com/libopenstorage/openstorage) | A cluster-aware volume plugin that provides volume management for file and block storage solutions. It implements a vendor neutral specification for implementing extensions such as CoS, encryption, and snapshots. It has example drivers based on FUSE, NFS, NBD and EBS to name a few. -[Quobyte Volume Plugin](https://github.com/quobyte/docker-volume) | A volume plugin that connects Docker to [Quobyte](http://www.quobyte.com/containers)'s data center file system, a general-purpose scalable and fault-tolerant storage platform. -[REX-Ray plugin](https://github.com/emccode/rexray) | A volume plugin which is written in Go and provides advanced storage functionality for many platforms including VirtualBox, EC2, Google Compute Engine, OpenStack, and EMC. -[Virtuozzo Storage and Ploop plugin](https://github.com/virtuozzo/docker-volume-ploop) | A volume plugin with support for Virtuozzo Storage distributed cloud file system as well as ploop devices. -[VMware vSphere Storage Plugin](https://github.com/vmware/docker-volume-vsphere) | Docker Volume Driver for vSphere enables customers to address persistent storage requirements for Docker containers in vSphere environments. + ```bash + $ docker plugin install vieux/sshfs -### Authorization plugins + Plugin "vieux/sshfs" is requesting the following privileges: + - network: [host] + - capabilities: [CAP_SYS_ADMIN] + Do you grant the above permissions? [y/N] y - Plugin | Description -------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ - [Twistlock AuthZ Broker](https://github.com/twistlock/authz) | A basic extendable authorization plugin that runs directly on the host or inside a container. This plugin allows you to define user policies that it evaluates during authorization. Basic authorization is provided if Docker daemon is started with the --tlsverify flag (username is extracted from the certificate common name). + vieux/sshfs + ``` -## Troubleshooting a plugin + The plugin requests 2 privileges, the `CAP_SYS_ADMIN` capability to be able + to do mount inside the plugin and `host networking`. -If you are having problems with Docker after loading a plugin, ask the authors -of the plugin for help. The Docker team may not be able to assist you. +2. Check for a value of `true` the `ENABLED` column to verify the plugin +started without error. -## Writing a plugin + ```bash + $ docker plugin ls -If you are interested in writing a plugin for Docker, or seeing how they work -under the hood, see the [docker plugins reference](plugin_api.md). + NAME TAG ENABLED + vieux/sshfs latest true + ``` + +3. Create a volume using the plugin. + + ```bash + $ docker volume create \ + -d vieux/sshfs \ + --name sshvolume \ + -o sshcmd=user@1.2.3.4:/remote + + sshvolume + ``` + +4. Use the volume `sshvolume`. + + ```bash + $ docker run -v sshvolume:/data busybox ls /data + + + ``` + +5. Verify the plugin successfully created the volume. + + ```bash + $ docker volume ls + + DRIVER NAME + vieux/sshfs sshvolume + ``` + + You can stop a plugin with the `docker plugin disable` + command or remove a plugin with `docker plugin remove`. + +See the [command line reference](../reference/commandline/index.md) for more +information. + +## How to develop a plugin + +Plugin creation is currently a manual process. We plan to add automation in a +future release with a command such as `docker plugin build`. + +This section describes the format of an existing enabled plugin. You have to +create and format the plugin files by hand. + +Plugins are stored in `/var/lib/docker/plugins`. For instance: + +```bash +# ls -la /var/lib/docker/plugins +total 20 +drwx------ 4 root root 4096 Aug 8 18:03 . +drwx--x--x 12 root root 4096 Aug 8 17:53 .. +drwxr-xr-x 3 root root 4096 Aug 8 17:56 cd851ce43a403 +-rw------- 1 root root 2107 Aug 8 18:03 plugins.json +``` + +`plugins.json` is an inventory of all installed plugins. For example: + +```bash +# cat plugins.json +{ + "cd851ce43a403": { + "plugin": { + "Manifest": { + "Args": { + "Value": null, + "Settable": null, + "Description": "", + "Name": "" + }, + "Env": null, + "Devices": null, + "Mounts": null, + "Capabilities": [ + "CAP_SYS_ADMIN" + ], + "ManifestVersion": "v0.1", + "Description": "sshFS plugin for Docker", + "Documentation": "https://docs.docker.com/engine/extend/plugins/", + "Interface": { + "Socket": "sshfs.sock", + "Types": [ + "docker.volumedriver/1.0" + ] + }, + "Entrypoint": [ + "/go/bin/docker-volume-sshfs" + ], + "Workdir": "", + "User": {}, + "Network": { + "Type": "host" + } + }, + "Config": { + "Devices": null, + "Args": null, + "Env": [], + "Mounts": [] + }, + "Active": true, + "Tag": "latest", + "Name": "vieux/sshfs", + "Id": "cd851ce43a403" + } + } +} +``` + +Each folder represents a plugin. For example: + +```bash +# ls -la /var/lib/docker/plugins/cd851ce43a403 +total 12 +drwx------ 19 root root 4096 Aug 8 17:56 rootfs +-rw-r--r-- 1 root root 50 Aug 8 17:56 plugin-config.json +-rw------- 1 root root 347 Aug 8 17:56 manifest.json +``` + +`rootfs` represents the root filesystem of the plugin. In this example, it was +created from a Dockerfile as follows: + +>**Note:** `/run/docker/plugins` is mandatory for docker to communicate with +the plugin._ + +```bash +$ git clone github.com/vieux/docker-volume-sshfs +$ cd docker-volume-sshfs +$ docker build -t rootfs . +$ id=$(docker create rootfs true) # id was cd851ce43a403 when the image was created +$ mkdir -p /var/lib/docker/plugins/$id/rootfs +$ docker export "$id" | tar -x -C /var/lib/docker/plugins/$id/rootfs +$ docker rm -vf "$id" +$ docker rmi rootfs +``` + +`manifest.json` describes the plugin and `plugin-config.json` contains some +runtime parameters. For example: + +```bash +# cat manifest.json +{ + "manifestVersion": "v0.1", + "description": "sshFS plugin for Docker", + "documentation": "https://docs.docker.com/engine/extend/plugins/", + "entrypoint": ["/go/bin/docker-volume-sshfs"], + "network": { + "type": "host" + }, + "interface" : { + "types": ["docker.volumedriver/1.0"], + "socket": "sshfs.sock" + }, + "capabilities": ["CAP_SYS_ADMIN"] +} +``` + +In this example, you can see the plugin is a volume driver, requires the +`CAP_SYS_ADMIN` capability, `host networking`, `/go/bin/docker-volume-sshfs` as +entrypoint and is going to use `/run/docker/plugins/sshfs.sock` to communicate +with the Docker Engine. + +```bash +# cat plugin-config.json +{ + "Devices": null, + "Args": null, + "Env": [], + "Mounts": [] +} +``` + +This plugin doesn't require runtime parameters. + +Both `manifest.json` and `plugin-config.json` are part of the `plugins.json`. +`manifest.json` is read-only and `plugin-config.json` is read-write. + +To summarize, follow the steps below to create a plugin: + +0. Choose a name for the plugin. Plugin name uses the same format as images, +for example: `/`. +1. Create a rootfs in `/var/lib/docker/plugins/$id/rootfs`. +2. Create manifest.json file in `/var/lib/docker/plugins/$id/`. +3. Create a `plugin-config.json` if needed. +4. Create or add a section to `/var/lib/docker/plugins/plugins.json`. Use + `/` as “Name” and `$id` as “Id”. +5. Restart the Docker Engine. +6. Run `docker plugin ls`. + * If your plugin is listed as `ENABLED=true`, you can push it to the + registry. + * If the plugin is not listed or if `ENABLED=false`, something went wrong. + Check the daemon logs for errors. +7. If you are not already logged in, use `docker login` to authenticate against + a registry. +8. Run `docker plugin push /` to push the plugin. diff --git a/docs/extend/plugins_authorization.md b/docs/extend/plugins_authorization.md index 4c11fa26ca..5b28fdc20a 100644 --- a/docs/extend/plugins_authorization.md +++ b/docs/extend/plugins_authorization.md @@ -6,13 +6,17 @@ keywords = ["security, authorization, authentication, docker, documentation, plu aliases = ["/engine/extend/authorization/"] [menu.main] parent = "engine_extend" -weight = -1 +weight = 4 +++ # Create an authorization plugin +This document describes Docker Engine authorization plugins generally +available in Docker Engine 1.12 and earlier. To view information on plugins +managed by Docker Engine, refer to [Docker Engine plugin system](plugins.md). + Docker's out-of-the-box authorization model is all or nothing. Any user with permission to access the Docker daemon can run any Docker client command. The same is true for callers using Docker's remote API to contact the daemon. If you diff --git a/docs/extend/plugins_network.md b/docs/extend/plugins_network.md index ec1ccddfea..f1d72ceeae 100644 --- a/docs/extend/plugins_network.md +++ b/docs/extend/plugins_network.md @@ -5,11 +5,16 @@ description = "Network driver plugins." keywords = ["Examples, Usage, plugins, docker, documentation, user guide"] [menu.main] parent = "engine_extend" +weight=5 +++ # Engine network driver plugins +This document describes Docker Engine network driver plugins generally +available in Docker Engine 1.12 and earlier. To view information on plugins +managed by Docker Engine, refer to [Docker Engine plugin system](plugins.md). + Docker Engine network plugins enable Engine deployments to be extended to support a wide range of networking technologies, such as VXLAN, IPVLAN, MACVLAN or something completely different. Network driver plugins are supported via the diff --git a/docs/extend/plugins_volume.md b/docs/extend/plugins_volume.md index 66afa7d439..b20732febe 100644 --- a/docs/extend/plugins_volume.md +++ b/docs/extend/plugins_volume.md @@ -5,6 +5,7 @@ description = "How to manage data with external volume plugins" keywords = ["Examples, Usage, volume, docker, data, volumes, plugin, api"] [menu.main] parent = "engine_extend" +weight=6 +++ diff --git a/docs/userguide/networking/index.md b/docs/userguide/networking/index.md index c7491312df..5911aad12e 100644 --- a/docs/userguide/networking/index.md +++ b/docs/userguide/networking/index.md @@ -537,7 +537,7 @@ built-in network drivers. For example: You can inspect it, add containers to and from it, and so forth. Of course, different plugins may make use of different technologies or frameworks. Custom networks can include features not present in Docker's default networks. For more -information on writing plugins, see [Extending Docker](../../extend/index.md) and +information on writing plugins, see [Extending Docker](../../extend/plugins.md) and [Writing a network driver plugin](../../extend/plugins_network.md). ### Docker embedded DNS server From 72f1556f622e58ff1659769879dc02650edfc1bf Mon Sep 17 00:00:00 2001 From: Aaron Lehmann Date: Mon, 22 Aug 2016 13:13:21 -0700 Subject: [PATCH 02/35] Merge pull request #25914 from lixiaobing10051267/masterSwarmJoinManager Remove option "--manager" description for swarm_join.md (cherry picked from commit 7cd88e5ec4fc13e1ded0eb7c565ed299b46c8259) Signed-off-by: Charles Smith --- docs/reference/commandline/swarm_join.md | 4 ---- 1 file changed, 4 deletions(-) diff --git a/docs/reference/commandline/swarm_join.md b/docs/reference/commandline/swarm_join.md index a9528ab884..540ebf27ef 100644 --- a/docs/reference/commandline/swarm_join.md +++ b/docs/reference/commandline/swarm_join.md @@ -87,10 +87,6 @@ name, the default port 2377 will be used. This flag is generally not necessary when joining an existing swarm. -### `--manager` - -Joins the node as a manager - ### `--token string` Secret value required for nodes to join the swarm From af2a9ba322476c9b13ed8b9d93d5734e7e093fff Mon Sep 17 00:00:00 2001 From: Vincent Demeester Date: Fri, 26 Aug 2016 07:57:07 +0200 Subject: [PATCH 03/35] Merge pull request #25919 from yuexiao-wang/fix-refer Remove the redundant words in reference for swarm (cherry picked from commit 72e7cd75c1f7a636b48774c3ba189cc8fd510138) Signed-off-by: Charles Smith --- docs/swarm/admin_guide.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/swarm/admin_guide.md b/docs/swarm/admin_guide.md index 515095c32a..7df810a119 100644 --- a/docs/swarm/admin_guide.md +++ b/docs/swarm/admin_guide.md @@ -32,7 +32,7 @@ This article covers the following swarm administration tasks: * [Forcefully removing a node](#force-remove-a-node) * [Recovering from disaster](#recover-from-disaster) -Refer to [How swarm mode nodes work](how-swarm-mode-works/nodes.md) +Refer to [How nodes work](how-swarm-mode-works/nodes.md) for a brief overview of Docker Swarm mode and the difference between manager and worker nodes. From d649ae03703948447b8f65bcff820905c5759ea6 Mon Sep 17 00:00:00 2001 From: Doug Davis Date: Mon, 22 Aug 2016 21:53:47 -0500 Subject: [PATCH 04/35] Merge pull request #25931 from fj/patch-1 Fix minor typo in "Getting Started" documentation (cherry picked from commit a949a79a5899df2b57c0ff3e6a3e9aa432db248c) Signed-off-by: Charles Smith --- docs/getstarted/step_one.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/getstarted/step_one.md b/docs/getstarted/step_one.md index 13ae76d942..81821617a6 100644 --- a/docs/getstarted/step_one.md +++ b/docs/getstarted/step_one.md @@ -64,7 +64,7 @@ If you have an earlier Windows system that doesn't meet the Docker for Windows p See [Docker Toolbox Overview](/toolbox/overview.md) for help on installing Docker with Toolbox. ### Docker for Linux -Docker Engine runs navitvely on Linux distributions. +Docker Engine runs natively on Linux distributions. For full instructions on getting Docker for various Linux distributions, see [Install Docker Engine](/engine/installation/index.md). From 9234cc38e237c08502774b324ef5525fab3401e7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?T=C3=B5nis=20Tiigi?= Date: Tue, 23 Aug 2016 11:19:52 -0700 Subject: [PATCH 05/35] Merge pull request #25946 from lixiaobing10051267/masterDockerImages Incorrect response field name for command "docker images" (cherry picked from commit 0b2ff0ccdef3327e52699941b2ab888f7fbecb1e) Signed-off-by: Charles Smith --- docs/getstarted/step_four.md | 2 +- docs/getstarted/step_six.md | 6 +++--- docs/getstarted/step_three.md | 2 +- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/docs/getstarted/step_four.md b/docs/getstarted/step_four.md index e925c90568..4baf9002d3 100644 --- a/docs/getstarted/step_four.md +++ b/docs/getstarted/step_four.md @@ -185,7 +185,7 @@ In this step, you verify the new images is on your computer and then you run you This command, you might remember, lists the images you have locally. $ docker images - REPOSITORY TAG IMAGE ID CREATED VIRTUAL SIZE + REPOSITORY TAG IMAGE ID CREATED SIZE docker-whale latest 7d9495d03763 4 minutes ago 273.7 MB docker/whalesay latest fb434121fc77 4 hours ago 247 MB hello-world latest 91c95931e552 5 weeks ago 910 B diff --git a/docs/getstarted/step_six.md b/docs/getstarted/step_six.md index 6f81a942d5..7855919db2 100644 --- a/docs/getstarted/step_six.md +++ b/docs/getstarted/step_six.md @@ -31,7 +31,7 @@ If you don't already have a terminal open, open one now: 2. At the prompt, type `docker images` to list the images you currently have: $ docker images - REPOSITORY TAG IMAGE ID CREATED VIRTUAL SIZE + REPOSITORY TAG IMAGE ID CREATED SIZE docker-whale latest 7d9495d03763 38 minutes ago 273.7 MB 5dac217f722c 45 minutes ago 273.7 MB docker/whalesay latest fb434121fc77 4 hours ago 247 MB @@ -61,7 +61,7 @@ If you don't already have a terminal open, open one now: 7. Type the `docker images` command again to see your newly tagged image. $ docker images - REPOSITORY TAG IMAGE ID CREATED VIRTUAL SIZE + REPOSITORY TAG IMAGE ID CREATED SIZE maryatdocker/docker-whale latest 7d9495d03763 5 minutes ago 273.7 MB docker-whale latest 7d9495d03763 2 hours ago 273.7 MB 5dac217f722c 5 hours ago 273.7 MB @@ -116,7 +116,7 @@ from the hub — why would it? The two images are identical. 2. At the prompt, type `docker images` to list the images you currently have on your local machine. $ docker images - REPOSITORY TAG IMAGE ID CREATED VIRTUAL SIZE + REPOSITORY TAG IMAGE ID CREATED SIZE maryatdocker/docker-whale latest 7d9495d03763 5 minutes ago 273.7 MB docker-whale latest 7d9495d03763 2 hours ago 273.7 MB 5dac217f722c 5 hours ago 273.7 MB diff --git a/docs/getstarted/step_three.md b/docs/getstarted/step_three.md index a00439618e..aaf77ef508 100644 --- a/docs/getstarted/step_three.md +++ b/docs/getstarted/step_three.md @@ -99,7 +99,7 @@ Make sure Docker is running. On Docker for Mac and Docker for Windows, this is i `docker/whalesay` in the list. $ docker images - REPOSITORY TAG IMAGE ID CREATED VIRTUAL SIZE + REPOSITORY TAG IMAGE ID CREATED SIZE docker/whalesay latest fb434121fc77 3 hours ago 247 MB hello-world latest 91c95931e552 5 weeks ago 910 B From 6e9dd212b9e8281cc0864e5c5f0cc26945f74c09 Mon Sep 17 00:00:00 2001 From: Vincent Demeester Date: Tue, 23 Aug 2016 21:44:26 +0200 Subject: [PATCH 06/35] Merge pull request #25948 from lixiaobing10051267/masterImages get a redis-cli image while using docker pull (cherry picked from commit 602b2381360cf59fffe46b64bb4bdfa180639c44) Signed-off-by: Charles Smith --- docs/admin/ambassador_pattern_linking.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/admin/ambassador_pattern_linking.md b/docs/admin/ambassador_pattern_linking.md index 772142e258..7622d2796a 100644 --- a/docs/admin/ambassador_pattern_linking.md +++ b/docs/admin/ambassador_pattern_linking.md @@ -70,7 +70,7 @@ On the Docker host (192.168.1.52) that Redis will run on: # start actual redis server $ docker run -d --name redis crosbymichael/redis - # get a redis-cli container for connection testing + # get a redis-cli image for connection testing $ docker pull relateiq/redis-cli # test the redis server by talking to it directly From a3098657c3e065616d5a90592f5021db79b62903 Mon Sep 17 00:00:00 2001 From: Justin Cormack Date: Wed, 24 Aug 2016 10:57:10 +0100 Subject: [PATCH 07/35] Merge pull request #25963 from yuexiao-wang/fix-repo Modify incorrect repository URL (cherry picked from commit a110512e38a14e938096fe18b345e8f920605b9f) Signed-off-by: Charles Smith --- docs/extend/plugins.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/extend/plugins.md b/docs/extend/plugins.md index cba09f5cd5..fd17441714 100644 --- a/docs/extend/plugins.md +++ b/docs/extend/plugins.md @@ -201,7 +201,7 @@ created from a Dockerfile as follows: the plugin._ ```bash -$ git clone github.com/vieux/docker-volume-sshfs +$ git clone https://github.com/vieux/docker-volume-sshfs $ cd docker-volume-sshfs $ docker build -t rootfs . $ id=$(docker create rootfs true) # id was cd851ce43a403 when the image was created From af9378f713c6c3885b09c4d64933dfb7c1ec94d6 Mon Sep 17 00:00:00 2001 From: Vincent Demeester Date: Thu, 25 Aug 2016 17:58:00 +0200 Subject: [PATCH 08/35] Merge pull request #25996 from yuexiao-wang/fix-docker-daemon Replace docker command from 'docker daemon' to 'dockerd' (cherry picked from commit aff33055ac138e09ef693c8d07ea005cde55e025) Signed-off-by: Charles Smith --- docs/admin/index.md | 8 ++++---- docs/admin/logging/awslogs.md | 2 +- docs/admin/logging/fluentd.md | 2 +- docs/admin/logging/gcplogs.md | 2 +- docs/admin/logging/journald.md | 2 +- docs/admin/logging/overview.md | 2 +- docs/admin/logging/splunk.md | 2 +- docs/admin/systemd.md | 8 ++++---- docs/extend/plugins_authorization.md | 2 +- docs/reference/api/docker_remote_api_v1.20.md | 2 +- docs/reference/api/docker_remote_api_v1.21.md | 2 +- docs/reference/api/docker_remote_api_v1.22.md | 2 +- docs/reference/api/docker_remote_api_v1.23.md | 2 +- docs/reference/commandline/dockerd.md | 4 ++-- docs/security/https.md | 2 +- docs/security/https/Makefile | 2 +- docs/userguide/labels-custom-metadata.md | 2 +- 17 files changed, 24 insertions(+), 24 deletions(-) diff --git a/docs/admin/index.md b/docs/admin/index.md index 5b4017187d..e65807f9cf 100644 --- a/docs/admin/index.md +++ b/docs/admin/index.md @@ -25,7 +25,7 @@ or `systemd` to manage the `docker` daemon's start and stop. ### Running the docker daemon directly -The `docker` daemon can be run directly using the `dockerd` command. By default it listens on +The Docker daemon can be run directly using the `dockerd` command. By default it listens on the Unix socket `unix:///var/run/docker.sock` $ dockerd @@ -38,9 +38,9 @@ the Unix socket `unix:///var/run/docker.sock` ### Configuring the docker daemon directly -If you're running the `docker` daemon directly by running `docker daemon` instead +If you're running the Docker daemon directly by running `dockerd` instead of using a process manager, you can append the configuration options to the `docker` run -command directly. Other options can be passed to the `docker` daemon to configure it. +command directly. Other options can be passed to the Docker daemon to configure it. Some of the daemon's options are: @@ -51,7 +51,7 @@ Some of the daemon's options are: | `--tls=false` | Enable or disable TLS. By default, this is false. | -Here is an example of running the `docker` daemon with configuration options: +Here is an example of running the Docker daemon with configuration options: $ dockerd -D --tls=true --tlscert=/var/docker/server.pem --tlskey=/var/docker/serverkey.pem -H tcp://192.168.59.3:2376 diff --git a/docs/admin/logging/awslogs.md b/docs/admin/logging/awslogs.md index 3f90c41426..fce53aee6b 100644 --- a/docs/admin/logging/awslogs.md +++ b/docs/admin/logging/awslogs.md @@ -22,7 +22,7 @@ and Command Line Tools](http://docs.aws.amazon.com/cli/latest/reference/logs/ind You can configure the default logging driver by passing the `--log-driver` option to the Docker daemon: - docker daemon --log-driver=awslogs + dockerd --log-driver=awslogs You can set the logging driver for a specific container by using the `--log-driver` option to `docker run`: diff --git a/docs/admin/logging/fluentd.md b/docs/admin/logging/fluentd.md index 238bd06a40..aeaab0e89f 100644 --- a/docs/admin/logging/fluentd.md +++ b/docs/admin/logging/fluentd.md @@ -39,7 +39,7 @@ Some options are supported by specifying `--log-opt` as many times as needed: Configure the default logging driver by passing the `--log-driver` option to the Docker daemon: - docker daemon --log-driver=fluentd + dockerd --log-driver=fluentd To set the logging driver for a specific container, pass the `--log-driver` option to `docker run`: diff --git a/docs/admin/logging/gcplogs.md b/docs/admin/logging/gcplogs.md index d19afefa1e..834082962d 100644 --- a/docs/admin/logging/gcplogs.md +++ b/docs/admin/logging/gcplogs.md @@ -18,7 +18,7 @@ Logging. You can configure the default logging driver by passing the `--log-driver` option to the Docker daemon: - docker daemon --log-driver=gcplogs + dockerd --log-driver=gcplogs You can set the logging driver for a specific container by using the `--log-driver` option to `docker run`: diff --git a/docs/admin/logging/journald.md b/docs/admin/logging/journald.md index 8476dd062f..d4991cfb59 100644 --- a/docs/admin/logging/journald.md +++ b/docs/admin/logging/journald.md @@ -30,7 +30,7 @@ driver stores the following metadata in the journal with each message: You can configure the default logging driver by passing the `--log-driver` option to the Docker daemon: - docker daemon --log-driver=journald + dockerd --log-driver=journald You can set the logging driver for a specific container by using the `--log-driver` option to `docker run`: diff --git a/docs/admin/logging/overview.md b/docs/admin/logging/overview.md index 2cad6061aa..4c4c16304a 100644 --- a/docs/admin/logging/overview.md +++ b/docs/admin/logging/overview.md @@ -45,7 +45,7 @@ to manually start the daemon with the `json-file` driver, and include additional attributes in the output, run the following command: ```bash -$ docker daemon \ +$ dockerd \ --log-driver=json-file \ --log-opt labels=foo \ --log-opt env=foo,fizz diff --git a/docs/admin/logging/splunk.md b/docs/admin/logging/splunk.md index d33f964778..b1a4d85c23 100644 --- a/docs/admin/logging/splunk.md +++ b/docs/admin/logging/splunk.md @@ -20,7 +20,7 @@ in Splunk Enterprise and Splunk Cloud. You can configure the default logging driver by passing the `--log-driver` option to the Docker daemon: - docker daemon --log-driver=splunk + dockerd --log-driver=splunk You can set the logging driver for a specific container by using the `--log-driver` option to `docker run`: diff --git a/docs/admin/systemd.md b/docs/admin/systemd.md index 6d560335d5..5c0c699e1d 100644 --- a/docs/admin/systemd.md +++ b/docs/admin/systemd.md @@ -53,7 +53,7 @@ following: EnvironmentFile=-/etc/sysconfig/docker-storage EnvironmentFile=-/etc/sysconfig/docker-network ExecStart= - ExecStart=/usr/bin/docker daemon -H fd:// $OPTIONS \ + ExecStart=/usr/bin/dockerd -H fd:// $OPTIONS \ $DOCKER_STORAGE_OPTIONS \ $DOCKER_NETWORK_OPTIONS \ $BLOCK_REGISTRY \ @@ -90,7 +90,7 @@ In this example, we'll assume that your `docker.service` file looks something li [Service] Type=notify - ExecStart=/usr/bin/docker daemon -H fd:// + ExecStart=/usr/bin/dockerd -H fd:// LimitNOFILE=1048576 LimitNPROC=1048576 TasksMax=1048576 @@ -104,7 +104,7 @@ directory: [Service] ExecStart= - ExecStart=/usr/bin/docker daemon -H fd:// --graph="/mnt/docker-data" --storage-driver=overlay + ExecStart=/usr/bin/dockerd -H fd:// --graph="/mnt/docker-data" --storage-driver=overlay You can also set other environment variables in this file, for example, the `HTTP_PROXY` environment variables described below. @@ -114,7 +114,7 @@ by a new configuration as follows: [Service] ExecStart= - ExecStart=/usr/bin/docker daemon -H fd:// --bip=172.17.42.1/16 + ExecStart=/usr/bin/dockerd -H fd:// --bip=172.17.42.1/16 If you fail to specify an empty configuration, Docker reports an error such as: diff --git a/docs/extend/plugins_authorization.md b/docs/extend/plugins_authorization.md index 5b28fdc20a..4eda85988d 100644 --- a/docs/extend/plugins_authorization.md +++ b/docs/extend/plugins_authorization.md @@ -110,7 +110,7 @@ Enable the authorization plugin with a dedicated command line flag in the value. This value can be the plugin’s socket or a path to a specification file. ```bash -$ docker daemon --authorization-plugin=plugin1 --authorization-plugin=plugin2,... +$ dockerd --authorization-plugin=plugin1 --authorization-plugin=plugin2,... ``` Docker's authorization subsystem supports multiple `--authorization-plugin` parameters. diff --git a/docs/reference/api/docker_remote_api_v1.20.md b/docs/reference/api/docker_remote_api_v1.20.md index 43f1174c3b..c614d0647e 100644 --- a/docs/reference/api/docker_remote_api_v1.20.md +++ b/docs/reference/api/docker_remote_api_v1.20.md @@ -2357,4 +2357,4 @@ To set cross origin requests to the remote api please give values to `--api-cors-header` when running Docker in daemon mode. Set * (asterisk) allows all, default or blank means CORS disabled - $ docker daemon -H="192.168.1.9:2375" --api-cors-header="http://foo.bar" + $ dockerd -H="192.168.1.9:2375" --api-cors-header="http://foo.bar" diff --git a/docs/reference/api/docker_remote_api_v1.21.md b/docs/reference/api/docker_remote_api_v1.21.md index 4eb8ca90a4..a05cb5a964 100644 --- a/docs/reference/api/docker_remote_api_v1.21.md +++ b/docs/reference/api/docker_remote_api_v1.21.md @@ -2923,4 +2923,4 @@ To set cross origin requests to the remote api please give values to `--api-cors-header` when running Docker in daemon mode. Set * (asterisk) allows all, default or blank means CORS disabled - $ docker daemon -H="192.168.1.9:2375" --api-cors-header="http://foo.bar" + $ dockerd -H="192.168.1.9:2375" --api-cors-header="http://foo.bar" diff --git a/docs/reference/api/docker_remote_api_v1.22.md b/docs/reference/api/docker_remote_api_v1.22.md index 610df35fca..8f03a7b674 100644 --- a/docs/reference/api/docker_remote_api_v1.22.md +++ b/docs/reference/api/docker_remote_api_v1.22.md @@ -3258,4 +3258,4 @@ To set cross origin requests to the remote api please give values to `--api-cors-header` when running Docker in daemon mode. Set * (asterisk) allows all, default or blank means CORS disabled - $ docker daemon -H="192.168.1.9:2375" --api-cors-header="http://foo.bar" + $ dockerd -H="192.168.1.9:2375" --api-cors-header="http://foo.bar" diff --git a/docs/reference/api/docker_remote_api_v1.23.md b/docs/reference/api/docker_remote_api_v1.23.md index 1c9e2732eb..ee7e57af7d 100644 --- a/docs/reference/api/docker_remote_api_v1.23.md +++ b/docs/reference/api/docker_remote_api_v1.23.md @@ -3374,4 +3374,4 @@ To set cross origin requests to the remote api please give values to `--api-cors-header` when running Docker in daemon mode. Set * (asterisk) allows all, default or blank means CORS disabled - $ docker daemon -H="192.168.1.9:2375" --api-cors-header="http://foo.bar" + $ dockerd -H="192.168.1.9:2375" --api-cors-header="http://foo.bar" diff --git a/docs/reference/commandline/dockerd.md b/docs/reference/commandline/dockerd.md index ead462d5f0..8f37c51ac7 100644 --- a/docs/reference/commandline/dockerd.md +++ b/docs/reference/commandline/dockerd.md @@ -574,7 +574,7 @@ options for `zfs` start with `zfs` and options for `btrfs` start with `btrfs`. **size** cannot be smaller than **btrfs.min_space**. Example use: - $ docker daemon -s btrfs --storage-opt btrfs.min_space=10G + $ dockerd -s btrfs --storage-opt btrfs.min_space=10G #### Overlay2 options @@ -1212,7 +1212,7 @@ The `--tls*` options enable use of specific certificates for individual daemons. Example script for a separate “bootstrap” instance of the Docker daemon without network: ```bash -$ docker daemon \ +$ dockerd \ -H unix:///var/run/docker-bootstrap.sock \ -p /var/run/docker-bootstrap.pid \ --iptables=false \ diff --git a/docs/security/https.md b/docs/security/https.md index 04f72b32ea..b106471de9 100644 --- a/docs/security/https.md +++ b/docs/security/https.md @@ -136,7 +136,7 @@ prevent accidental damage: Now you can make the Docker daemon only accept connections from clients providing a certificate trusted by our CA: - $ docker daemon --tlsverify --tlscacert=ca.pem --tlscert=server-cert.pem --tlskey=server-key.pem \ + $ dockerd --tlsverify --tlscacert=ca.pem --tlscert=server-cert.pem --tlskey=server-key.pem \ -H=0.0.0.0:2376 To be able to connect to Docker and validate its certificate, you now diff --git a/docs/security/https/Makefile b/docs/security/https/Makefile index 3c84697461..a346a43e22 100644 --- a/docs/security/https/Makefile +++ b/docs/security/https/Makefile @@ -13,7 +13,7 @@ cert: build certs: cert run: - sudo docker daemon -D --tlsverify --tlscacert=ca.pem --tlscert=server-cert.pem --tlskey=server-key.pem -H=0.0.0.0:6666 --pidfile=$(pwd)/docker.pid --graph=$(pwd)/graph + sudo dockerd -D --tlsverify --tlscacert=ca.pem --tlscert=server-cert.pem --tlskey=server-key.pem -H=0.0.0.0:6666 --pidfile=$(pwd)/docker.pid --graph=$(pwd)/graph client: sudo docker --tls --tlscacert=ca.pem --tlscert=cert.pem --tlskey=key.pem -H=$(HOST):6666 version diff --git a/docs/userguide/labels-custom-metadata.md b/docs/userguide/labels-custom-metadata.md index 74df2b88f3..da15edd266 100644 --- a/docs/userguide/labels-custom-metadata.md +++ b/docs/userguide/labels-custom-metadata.md @@ -182,7 +182,7 @@ on how to query labels set on a container. ## Daemon labels - docker daemon \ + dockerd \ --dns 8.8.8.8 \ --dns 8.8.4.4 \ -H unix:///var/run/docker.sock \ From 2aa780abe4813225787ece380ad4d6bbbdf0768a Mon Sep 17 00:00:00 2001 From: Charles Smith Date: Fri, 26 Aug 2016 15:55:26 -0700 Subject: [PATCH 09/35] Merge pull request #26028 from londoncalling/docs-pinata-for-swarm Clarify how to use d4mac, d4win with swarm mode (cherry picked from commit 6072e6bfd20598f4e9cb28d32c09bfddec6df76c) Signed-off-by: Charles Smith --- docs/swarm/swarm-tutorial/create-swarm.md | 6 ++++++ docs/swarm/swarm-tutorial/index.md | 2 +- 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/docs/swarm/swarm-tutorial/create-swarm.md b/docs/swarm/swarm-tutorial/create-swarm.md index 57e67ba353..3188cf655c 100644 --- a/docs/swarm/swarm-tutorial/create-swarm.md +++ b/docs/swarm/swarm-tutorial/create-swarm.md @@ -25,6 +25,12 @@ node. For example, the tutorial uses a machine named `manager1`. docker swarm init --advertise-addr ``` + >**Note:** If you are using Docker for Mac or Docker for Windows to test +single-node swarm, simply run `docker swarm init` with no arguments. There is no +need to specify ` --advertise-addr` in this case. To learn more, see the topic +on how to [Use Docker for Mac or Docker for +Windows](index.md#use-docker-for-mac-or-docker-for-windows) with Swarm. + In the tutorial, the following command creates a swarm on the `manager1` machine: diff --git a/docs/swarm/swarm-tutorial/index.md b/docs/swarm/swarm-tutorial/index.md index 1c00c4700e..1887186079 100644 --- a/docs/swarm/swarm-tutorial/index.md +++ b/docs/swarm/swarm-tutorial/index.md @@ -83,7 +83,7 @@ mode, including initializing a swarm with a single node, creating services, and scaling services. Docker "Moby" on Hyperkit (Mac) or Hyper-V (Windows) will serve as the single swarm node. -

+

* Currently, you cannot use Docker for Mac or Windows alone to test a _multi-node_ swarm. However, you can use the included version of [Docker From 8f0254da4124c44e510e8a4c354c1e5c84ee2d05 Mon Sep 17 00:00:00 2001 From: Antonio Murdaca Date: Fri, 26 Aug 2016 12:06:58 +0200 Subject: [PATCH 10/35] Merge pull request #26029 from WhisperingChaos/25918-permissive-to-privileged Fixes #25918 - Changed --permissive to --privileged. (cherry picked from commit 91fdafb79f1532de33e2e258446d6eab80fd0d53) Signed-off-by: Charles Smith --- docs/reference/run.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/reference/run.md b/docs/reference/run.md index 404bbb6270..883726bd98 100644 --- a/docs/reference/run.md +++ b/docs/reference/run.md @@ -645,7 +645,7 @@ allows you to share the same content between containers. > **Note**: Automatic translation of MLS labels is not currently supported. To disable the security labeling for this container versus running with the -`--permissive` flag, use the following command: +`--privileged` flag, use the following command: $ docker run --security-opt label=disable -it fedora bash From 44180a48e9cdef0ced94ef1aceac3fbcfc6c830a Mon Sep 17 00:00:00 2001 From: Doug Davis Date: Fri, 26 Aug 2016 09:06:30 -0400 Subject: [PATCH 11/35] Merge pull request #26030 from yongtang/08252016-doc-docker-create-rm Update docs for `docker create` to include `--rm` flag (cherry picked from commit 91ec7fa811c7476b7c20e3b95a92ea9062d498fa) Signed-off-by: Charles Smith --- docs/reference/commandline/create.md | 1 + 1 file changed, 1 insertion(+) diff --git a/docs/reference/commandline/create.md b/docs/reference/commandline/create.md index 3b550c0464..276391f632 100644 --- a/docs/reference/commandline/create.md +++ b/docs/reference/commandline/create.md @@ -90,6 +90,7 @@ Options: --read-only Mount the container's root filesystem as read only --restart string Restart policy to apply when a container exits (default "no") Possible values are: no, on-failure[:max-retry], always, unless-stopped + --rm Automatically remove the container when it exits --runtime string Runtime to use for this container --security-opt value Security Options (default []) --shm-size string Size of /dev/shm, default value is 64MB. From 49e863f6d0d9818b989a037f3fb14432f0892bc6 Mon Sep 17 00:00:00 2001 From: Vincent Demeester Date: Sat, 27 Aug 2016 14:51:16 +0200 Subject: [PATCH 12/35] Merge pull request #26036 from yuexiao-wang/add-gcplog Add the content for Google Cloud Loging driver in index (cherry picked from commit 48659599cbb4c896e9597e50ae16c087d9dd5ac9) Signed-off-by: Charles Smith --- docs/admin/logging/index.md | 1 + 1 file changed, 1 insertion(+) diff --git a/docs/admin/logging/index.md b/docs/admin/logging/index.md index b47686bf8a..c01d4552ad 100644 --- a/docs/admin/logging/index.md +++ b/docs/admin/logging/index.md @@ -21,3 +21,4 @@ weight=9 * [Amazon CloudWatch Logs logging driver](awslogs.md) * [Splunk logging driver](splunk.md) * [ETW logging driver](etwlogs.md) +* [Google Cloud Logging driver](gcplogs.md) \ No newline at end of file From aaa7a58c6380495ce3b0944b4419df05c3ab202e Mon Sep 17 00:00:00 2001 From: Vincent Demeester Date: Mon, 29 Aug 2016 14:36:49 +0200 Subject: [PATCH 13/35] Merge pull request #26080 from sw-double/patch-1 [docs] Fix volume binding in fluentd container example (cherry picked from commit ad73e8f169ee39ed830bfa385583bddd5741012d) Signed-off-by: Charles Smith --- docs/admin/logging/fluentd.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/admin/logging/fluentd.md b/docs/admin/logging/fluentd.md index aeaab0e89f..575fb0efe4 100644 --- a/docs/admin/logging/fluentd.md +++ b/docs/admin/logging/fluentd.md @@ -107,7 +107,7 @@ aggregate store. 2. Launch Fluentd container with this configuration file: - $ docker run -it -p 24224:24224 -v /path/to/conf/test.conf:/fluentd/etc -e FLUENTD_CONF=test.conf fluent/fluentd:latest + $ docker run -it -p 24224:24224 -v /path/to/conf/test.conf:/fluentd/etc/test.conf -e FLUENTD_CONF=test.conf fluent/fluentd:latest 3. Start one or more containers with the `fluentd` logging driver: From 9bef12dcfd4c1d83692713eea53f55a257c07f24 Mon Sep 17 00:00:00 2001 From: Justin Cormack Date: Tue, 30 Aug 2016 13:36:50 +0100 Subject: [PATCH 14/35] Merge pull request #26096 from ohmystack/fix/docs-dockerd Add docs for "--containerd" in dockerd (cherry picked from commit 644cb53b41b49fd750fe9c86e922125ef8156259) Signed-off-by: Charles Smith --- docs/reference/commandline/dockerd.md | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/docs/reference/commandline/dockerd.md b/docs/reference/commandline/dockerd.md index 8f37c51ac7..db5cf6eb93 100644 --- a/docs/reference/commandline/dockerd.md +++ b/docs/reference/commandline/dockerd.md @@ -594,6 +594,14 @@ The Docker daemon relies on a (invoked via the `containerd` daemon) as its interface to the Linux kernel `namespaces`, `cgroups`, and `SELinux`. +By default, the Docker daemon automatically starts `containerd`. If you want to +control `containerd` startup, manually start `containerd` and pass the path to +the `containerd` socket using the `--containerd` flag. For example: + +```bash +$ dockerd --containerd /var/run/dev/docker-containerd.sock +``` + Runtimes can be registered with the daemon either via the configuration file or using the `--add-runtime` command line argument. From abe05f4a29491034071f1625475ad6b141392644 Mon Sep 17 00:00:00 2001 From: Charles Smith Date: Mon, 29 Aug 2016 12:09:15 -0700 Subject: [PATCH 15/35] Merge pull request #26114 from londoncalling/fix-linespacing-swarmtut fixed line spacing in Swarm tutorial bullets (cherry picked from commit 62215920871b8d15a6ffe538baac5abe2b715409) Signed-off-by: Charles Smith --- docs/swarm/swarm-tutorial/index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/swarm/swarm-tutorial/index.md b/docs/swarm/swarm-tutorial/index.md index 1887186079..1c00c4700e 100644 --- a/docs/swarm/swarm-tutorial/index.md +++ b/docs/swarm/swarm-tutorial/index.md @@ -83,7 +83,7 @@ mode, including initializing a swarm with a single node, creating services, and scaling services. Docker "Moby" on Hyperkit (Mac) or Hyper-V (Windows) will serve as the single swarm node. -

+

* Currently, you cannot use Docker for Mac or Windows alone to test a _multi-node_ swarm. However, you can use the included version of [Docker From 9c2b789cafc725e96607073e5552526bed7e7e77 Mon Sep 17 00:00:00 2001 From: Vincent Demeester Date: Wed, 31 Aug 2016 10:43:02 +0200 Subject: [PATCH 16/35] Merge pull request #26122 from sfsmithcha/updates_for_new_plugin_docs some fixes to clean up new plugin system docs (cherry picked from commit c1b82df74042a0290b995283c504b60ac6b4bc95) Signed-off-by: Charles Smith --- docs/extend/{plugins.md => index.md} | 6 +++--- docs/extend/legacy_plugins.md | 11 ++++++----- docs/extend/menu.md | 11 +++-------- docs/extend/plugin_api.md | 6 +++--- docs/extend/plugins_authorization.md | 6 +++--- docs/extend/plugins_network.md | 6 +++--- docs/extend/plugins_volume.md | 4 ++-- docs/tutorials/dockervolumes.md | 2 +- docs/userguide/networking/index.md | 2 +- 9 files changed, 25 insertions(+), 29 deletions(-) rename docs/extend/{plugins.md => index.md} (98%) diff --git a/docs/extend/plugins.md b/docs/extend/index.md similarity index 98% rename from docs/extend/plugins.md rename to docs/extend/index.md index fd17441714..4e77c698e6 100644 --- a/docs/extend/plugins.md +++ b/docs/extend/index.md @@ -3,8 +3,8 @@ aliases = [ "/engine/extend/" ] -title = "New Plugin System" -description = "How to operate and create a plugin with the new system" +title = "Managed plugin system" +description = "How develop and use a plugin with the managed plugin system" keywords = ["API, Usage, plugins, documentation, developer"] advisory = "experimental" [menu.main] @@ -13,7 +13,7 @@ weight=1 +++ -# Docker Engine plugin system +# Docker Engine managed plugin system This document describes the plugin system available today in the **experimental build** of Docker 1.12: diff --git a/docs/extend/legacy_plugins.md b/docs/extend/legacy_plugins.md index 02874f315e..0d3404831c 100644 --- a/docs/extend/legacy_plugins.md +++ b/docs/extend/legacy_plugins.md @@ -1,6 +1,7 @@ -# Understand legacy Docker Engine plugins +# Use Docker Engine plugins This document describes the Docker Engine plugins generally available in Docker -Engine 1.12 and earlier. To view information on plugins managed by Docker -Engine, refer to [Docker Engine plugin system](plugins.md). +Engine. To view information on plugins managed by Docker Engine currently in +experimental status, refer to [Docker Engine plugin system](index.md). You can extend the capabilities of the Docker Engine by loading third-party plugins. This page explains the types of plugins and provides links to several @@ -21,7 +22,7 @@ volume and network plugins for Docker. ## Types of plugins -Plugins extend Docker's functionality. They come in specific types. For +Plugins extend Docker's functionality. They come in specific types. For example, a [volume plugin](plugins_volume.md) might enable Docker volumes to persist across multiple Docker hosts and a [network plugin](plugins_network.md) might provide network plumbing. diff --git a/docs/extend/menu.md b/docs/extend/menu.md index 1c523e2dfa..4b9955038a 100644 --- a/docs/extend/menu.md +++ b/docs/extend/menu.md @@ -1,7 +1,7 @@ -## New Docker Plugin System - -Currently, you can extend Docker Engine by adding a plugin. This section contains the following topics: - -* [Understand Docker plugins](plugins.md) -* [Write a volume plugin](plugins_volume.md) + diff --git a/docs/extend/plugin_api.md b/docs/extend/plugin_api.md index 1f55b6d528..5801ba9151 100644 --- a/docs/extend/plugin_api.md +++ b/docs/extend/plugin_api.md @@ -14,9 +14,9 @@ weight=7 Docker plugins are out-of-process extensions which add capabilities to the Docker Engine. -This document describes the Docker Engine plugin API generally available in -Docker Engine 1.12 and earlier. To view information on plugins managed by Docker -Engine, refer to [Docker Engine plugin system](plugins.md). +This document describes the Docker Engine plugin API. To view information on +plugins managed by Docker Engine currently in experimental status, refer to +[Docker Engine plugin system](index.md). This page is intended for people who want to develop their own Docker plugin. If you just want to learn about or use Docker plugins, look diff --git a/docs/extend/plugins_authorization.md b/docs/extend/plugins_authorization.md index 4eda85988d..4447465f1a 100644 --- a/docs/extend/plugins_authorization.md +++ b/docs/extend/plugins_authorization.md @@ -13,9 +13,9 @@ weight = 4 # Create an authorization plugin -This document describes Docker Engine authorization plugins generally -available in Docker Engine 1.12 and earlier. To view information on plugins -managed by Docker Engine, refer to [Docker Engine plugin system](plugins.md). +This document describes the Docker Engine plugins generally available in Docker +Engine. To view information on plugins managed by Docker Engine currently in +experimental status, refer to [Docker Engine plugin system](index.md). Docker's out-of-the-box authorization model is all or nothing. Any user with permission to access the Docker daemon can run any Docker client command. The diff --git a/docs/extend/plugins_network.md b/docs/extend/plugins_network.md index f1d72ceeae..7a107e2ce3 100644 --- a/docs/extend/plugins_network.md +++ b/docs/extend/plugins_network.md @@ -12,8 +12,8 @@ weight=5 # Engine network driver plugins This document describes Docker Engine network driver plugins generally -available in Docker Engine 1.12 and earlier. To view information on plugins -managed by Docker Engine, refer to [Docker Engine plugin system](plugins.md). +available in Docker Engine. To view information on plugins +managed by Docker Engine, refer to [Docker Engine plugin system](index.md). Docker Engine network plugins enable Engine deployments to be extended to support a wide range of networking technologies, such as VXLAN, IPVLAN, MACVLAN @@ -46,7 +46,7 @@ commands. For example, $ docker network create --driver weave mynet -Some network driver plugins are listed in [plugins](plugins.md) +Some network driver plugins are listed in [plugins](legacy_plugins.md) The `mynet` network is now owned by `weave`, so subsequent commands referring to that network will be sent to the plugin, diff --git a/docs/extend/plugins_volume.md b/docs/extend/plugins_volume.md index b20732febe..f9c93a3de1 100644 --- a/docs/extend/plugins_volume.md +++ b/docs/extend/plugins_volume.md @@ -13,8 +13,8 @@ weight=6 Docker Engine volume plugins enable Engine deployments to be integrated with external storage systems, such as Amazon EBS, and enable data volumes to persist -beyond the lifetime of a single Engine host. See the [plugin -documentation](plugins.md) for more information. +beyond the lifetime of a single Engine host. See the +[plugin documentation](legacy_plugins.md) for more information. ## Changelog diff --git a/docs/tutorials/dockervolumes.md b/docs/tutorials/dockervolumes.md index 778f61add2..72471f3651 100644 --- a/docs/tutorials/dockervolumes.md +++ b/docs/tutorials/dockervolumes.md @@ -211,7 +211,7 @@ $ docker run -d -P \ ``` A list of available plugins, including volume plugins, is available -[here](../extend/plugins.md). +[here](../extend/legacy_plugins.md). ### Volume labels diff --git a/docs/userguide/networking/index.md b/docs/userguide/networking/index.md index 5911aad12e..c993b82dfc 100644 --- a/docs/userguide/networking/index.md +++ b/docs/userguide/networking/index.md @@ -537,7 +537,7 @@ built-in network drivers. For example: You can inspect it, add containers to and from it, and so forth. Of course, different plugins may make use of different technologies or frameworks. Custom networks can include features not present in Docker's default networks. For more -information on writing plugins, see [Extending Docker](../../extend/plugins.md) and +information on writing plugins, see [Extending Docker](../../extend/legacy_plugins.md) and [Writing a network driver plugin](../../extend/plugins_network.md). ### Docker embedded DNS server From 755addd56f920a8c24780cf880c00ac9ce004aed Mon Sep 17 00:00:00 2001 From: Brian Goff Date: Tue, 30 Aug 2016 10:18:19 -0400 Subject: [PATCH 17/35] Merge pull request #26127 from lixiaobing10051267/masterDockerDeploy usage description of docker deploy in md not consistant with go file (cherry picked from commit afd54a1a8645bde7d5d87efc5567ee0d3c788e78) Signed-off-by: Charles Smith --- experimental/docker-stacks-and-bundles.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/experimental/docker-stacks-and-bundles.md b/experimental/docker-stacks-and-bundles.md index d685a3959d..b56d0e5c8d 100644 --- a/experimental/docker-stacks-and-bundles.md +++ b/experimental/docker-stacks-and-bundles.md @@ -41,7 +41,7 @@ A stack is created using the `docker deploy` command: Usage: docker deploy [OPTIONS] STACK -Create and update a stack +Create and update a stack from a Distributed Application Bundle (DAB) Options: --file string Path to a Distributed Application Bundle file (Default: STACK.dab) From 934d7b83ef78e272ff142e01e418a1621f8ac898 Mon Sep 17 00:00:00 2001 From: Vincent Demeester Date: Tue, 30 Aug 2016 10:53:50 +0200 Subject: [PATCH 18/35] Merge pull request #26135 from kmkr/master Fix typo in builder.md (cherry picked from commit 20869b5650bd059cd67969f9774fb4eb78b6dbfd) Signed-off-by: Charles Smith --- docs/reference/builder.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/reference/builder.md b/docs/reference/builder.md index c63bcf5347..cba4ddb518 100644 --- a/docs/reference/builder.md +++ b/docs/reference/builder.md @@ -1068,7 +1068,7 @@ user 0m 0.03s sys 0m 0.03s ``` -> **Note:** you can over ride the `ENTRYPOINT` setting using `--entrypoint`, +> **Note:** you can override the `ENTRYPOINT` setting using `--entrypoint`, > but this can only set the binary to *exec* (no `sh -c` will be used). > **Note**: From e773b059d1fd2b4060540b165c76552806083215 Mon Sep 17 00:00:00 2001 From: Justin Cormack Date: Wed, 31 Aug 2016 16:37:50 +0100 Subject: [PATCH 19/35] Merge pull request #26139 from yuexiao-wang/fix-link Modify link for hub and registry (cherry picked from commit ad6f5a49d5f24f8b64def11176b6c8df162d839f) Signed-off-by: Charles Smith --- docs/reference/api/hub_registry_spec.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/reference/api/hub_registry_spec.md b/docs/reference/api/hub_registry_spec.md index f2517c2386..87c4c88482 100644 --- a/docs/reference/api/hub_registry_spec.md +++ b/docs/reference/api/hub_registry_spec.md @@ -12,7 +12,7 @@ parent="smn_hub_ref" # The Docker Hub and the Registry v1 This API is deprecated as of 1.7. To view the old version, see the [go -here](hub_registry_spec.md) in +here](https://docs.docker.com/v1.7/docker/reference/api/hub_registry_spec/) in the 1.7 documentation. If you want an overview of the current features in Docker Hub or other image management features see the [image management overview](../../userguide/eng-image/image_management.md) in the current documentation set. From dc0d2166d52da4c0530376b67bfe7f9d859397ed Mon Sep 17 00:00:00 2001 From: Sven Dowideit Date: Mon, 5 Sep 2016 10:02:35 +1000 Subject: [PATCH 20/35] Merge pull request #26245 from dbdd4us/master add volumes, networks, nodes and services into label doc (cherry picked from commit 384de833c0f7e20d6a36b6786d1f2e2e67b90d2f) Signed-off-by: Charles Smith --- docs/userguide/labels-custom-metadata.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/userguide/labels-custom-metadata.md b/docs/userguide/labels-custom-metadata.md index da15edd266..27998c2ec5 100644 --- a/docs/userguide/labels-custom-metadata.md +++ b/docs/userguide/labels-custom-metadata.md @@ -11,7 +11,7 @@ weight=90 # Apply custom metadata -You can apply metadata to your images, containers, or daemons via +You can apply metadata to your images, containers, volumes, networks, nodes, services or daemons via labels. Labels serve a wide range of uses, such as adding notes or licensing information to an image, or to identify a host. From b7e9344365488e5d3248ba1c24a4fdea3c1abbd3 Mon Sep 17 00:00:00 2001 From: Vincent Demeester Date: Tue, 6 Sep 2016 17:43:19 +0200 Subject: [PATCH 21/35] Merge pull request #26258 from mstanleyjones/25625_swarm_init_return_value Add response to swarm/init example (fixes #25625 (cherry picked from commit d4e173fc347911999458eb82fe4c0fd1b3818218) Signed-off-by: Charles Smith --- docs/reference/api/docker_remote_api_v1.24.md | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/docs/reference/api/docker_remote_api_v1.24.md b/docs/reference/api/docker_remote_api_v1.24.md index 02e371a06a..de1afd7e61 100644 --- a/docs/reference/api/docker_remote_api_v1.24.md +++ b/docs/reference/api/docker_remote_api_v1.24.md @@ -4142,7 +4142,7 @@ Inspect swarm `POST /swarm/init` -Initialize a new swarm +Initialize a new swarm. The body of the HTTP response includes the node ID. **Example request**: @@ -4164,8 +4164,12 @@ Initialize a new swarm **Example response**: HTTP/1.1 200 OK - Content-Length: 0 - Content-Type: text/plain; charset=utf-8 + Content-Length: 28 + Content-Type: application/json + Date: Thu, 01 Sep 2016 21:49:13 GMT + Server: Docker/1.12.0 (linux) + + "7v2t30z9blmxuhnyo6s4cpenp" **Status codes**: From 7e2259bb63e2f3bc02493863416e54b4ab2c7215 Mon Sep 17 00:00:00 2001 From: Vincent Demeester Date: Fri, 2 Sep 2016 12:39:31 +0200 Subject: [PATCH 22/35] Merge pull request #26271 from AkihiroSuda/fix-service-create-doc update docs/reference/commandline/service_create.md (cherry picked from commit 1a04d7b1e13ffe725a5310b55e83ae60b1ab7e55) Signed-off-by: Charles Smith --- docs/reference/commandline/service_create.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/reference/commandline/service_create.md b/docs/reference/commandline/service_create.md index 0090832c98..5a0da6794b 100644 --- a/docs/reference/commandline/service_create.md +++ b/docs/reference/commandline/service_create.md @@ -140,9 +140,9 @@ metadata](../../userguide/labels-custom-metadata.md). ### Set service mode -Is this a replicated service or a global service. A replicated service runs as -many tasks as specified, while a global service runs on each active node in the -swarm. +You can set the service mode to "replicated" (default) or to "global". A +replicated service runs as many tasks as specified, while a global service +runs on each active node in the swarm. The following command creates a "global" service: From 931418603e66953a1802cf39ded20eed26a88027 Mon Sep 17 00:00:00 2001 From: Charles Smith Date: Tue, 6 Sep 2016 10:41:46 -0700 Subject: [PATCH 23/35] Merge pull request #26288 from sfsmithcha/add_tls author merge: addressed @diogomonica ' remark: add how pki works topic (cherry picked from commit 75c36bcc64a5597919a16a7d43463f7e7c5e1499) Signed-off-by: Charles Smith --- docs/swarm/how-swarm-mode-works/nodes.md | 3 +- docs/swarm/how-swarm-mode-works/pki.md | 72 ++++++++++++++++++++ docs/swarm/how-swarm-mode-works/services.md | 5 ++ docs/swarm/images/src/tls.svg | 1 + docs/swarm/images/tls.png | Bin 0 -> 69747 bytes 5 files changed, 80 insertions(+), 1 deletion(-) create mode 100644 docs/swarm/how-swarm-mode-works/pki.md create mode 100644 docs/swarm/images/src/tls.svg create mode 100644 docs/swarm/images/tls.png diff --git a/docs/swarm/how-swarm-mode-works/nodes.md b/docs/swarm/how-swarm-mode-works/nodes.md index 825939e5b8..ac8dc76b3f 100644 --- a/docs/swarm/how-swarm-mode-works/nodes.md +++ b/docs/swarm/how-swarm-mode-works/nodes.md @@ -86,6 +86,7 @@ You can also demote a manager node to a worker node. See [node demote](../../reference/commandline/node_demote.md). -## What's Next +## Learn More * Read about how swarm mode [services](services.md) work. +* Learn how [PKI](pki.md) works in swarm mode diff --git a/docs/swarm/how-swarm-mode-works/pki.md b/docs/swarm/how-swarm-mode-works/pki.md new file mode 100644 index 0000000000..6f2698c3f7 --- /dev/null +++ b/docs/swarm/how-swarm-mode-works/pki.md @@ -0,0 +1,72 @@ + + +# How PKI works in swarm mode + +The swarm mode public key infrastructure (PKI) system built into Docker Engine +makes it simple to securely deploy a container orchestration system. The nodes +in a swarm use mutual Transport Layer Security (TLS) to authenticate, authorize, +and encrypt the communications between themselves and other nodes in the swarm. + +When you create a swarm by running `docker swarm init`, the Docker Engine +designates istself as a manager node. By default, the manager node generates +itself a new root Certificate Authority (CA) along with a key pair to secure +communications with other nodes that join the swarm. If you prefer, you can pass +the `--external-ca` flag to specify a root CA external to the swarm. Refer to +the [docker swarm init](../../reference/commandline/swarm_init.md) CLI +reference. + +The manager node also generates two tokens to use when you join additional nodes +to the swarm: one worker token and one manager token. Each token includes the +digest of the root CA's certificate and a randomly generated secret. When a node +joins the swarm, it uses the digest to validate the root CA certificate from the +remote manager. It uses the secret to ensure the node is an approved node. + +Each time a new node joins the swarm, the manager issues a certificate to the +node that contains a randomly generated node id to identify the node under the +certificate common name (CN) and the role under the organizational unit (OU). +The node id serves as the cryptographically secure node identity for the +lifetime of the node in the current swarm. + +The diagram below illustrates how worker manager nodes and worker nodes encrypt +communications using a minimum of TLS 1.2. + +![tls diagram](../images/tls.png) + + +The example below shows the information from a certificate from a worker node: + +```bash +Certificate: + Data: + Version: 3 (0x2) + Serial Number: + 3b:1c:06:91:73:fb:16:ff:69:c3:f7:a2:fe:96:c1:73:e2:80:97:3b + Signature Algorithm: ecdsa-with-SHA256 + Issuer: CN=swarm-ca + Validity + Not Before: Aug 30 02:39:00 2016 GMT + Not After : Nov 28 03:39:00 2016 GMT + Subject: O=ec2adilxf4ngv7ev8fwsi61i7, OU=swarm-worker, CN=dw02poa4vqvzxi5c10gm4pq2g +...snip... +``` + +By default, each node in the swarm renews its certificate every three months. +You can run `docker swarm update --cert-expiry