docker/docs
1
0
Fork 0
mirror of https://github.com/docker/docs.git synced 2026-11-05 00:14:17 +03:00
Code Activity

Adds docs for 1.1 and some spring cleaning

Browse Source 
* Reorganize docs to make docs easier to browse
* Remove duplicate information
* Update information for UCP 1.1
* Adds new docs for
  * System requirements
  * Architecture
  * Offline install

Still missing docs for 1.1 features like:
* Backup/restore
* eNZi impacts, if any.
This commit is contained in:
Joao Fernandes
2016-03-30 18:59:36 -07:00
parent e6dc703e42
commit e992cc1d36
39 changed files with 631 additions and 669 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
deploy-application.md → applications/deploy-app-cli.md
View File

@@ -1,16 +1,16 @@
<!--[metadata]>
+++
title = "Deploy an application"
description = "Deploy an application thru UCP"
aliases = ["/ucp/deploy-application/"]
title = "Deploy an app from the CLI"
description = "Learn how to deploy containerized applications on a cluster, with Docker Universal Control Plane."
keywords = ["deploy, application"]
[menu.main]
parent="mn_ucp"
weight=-80
parent="mn_ucp_applications"
+++
<![end-metadata]-->
# Deploy an application onto UCP
# Deploy an app from the CLI
In this quickstart, you learn how to deploy multi-container applications onto UCP.
While UCP is intended for deploying multi-container applications, the workflow
@@ -48,9 +48,7 @@ that require them, the team may need to create Docker container volumes and
ensure they are of sufficient size.
Once the team has developed a microservice application, they should test it
locally at scale on a Swarm cluster. The Swarm documentation includes detailed
documentation about [troubleshooting a microservice
application](https://docs.docker.com/swarm/scale/05-troubleshoot/).
locally at scale on a Swarm cluster.
The output of application development should be a Docker Compose file and a set
of images ready for deployment. These images can be stored in Docker Hub. If
@@ -61,16 +59,16 @@ must ensure store the images in an accessible registry account.
## Step 1. Before you begin
This example requires that you have an installed UCP deployment and that you have
<a href="/ucp/networking/" target="_blank">enabled container networking</a>
on that installation. Take a moment to check this requirement.
This example requires that you have an installed UCP deployment and that you
have [enabled container networking](../configuration/multi-host-networking.md).
Take a moment to check this requirement.
When deploying an application to UCP, you work from a local environment using
the UCP client bundle for your UCP user. You should never deploy from the
command-line while directly logged into a UCP node. The deploy on this page,
requires that your local environment includes the following software:
* <a href="https://git-scm.com/" target="_blank">Git</a>
* [Git](https://git-scm.com/)
* Docker Engine
* Docker Compose
@@ -216,7 +214,7 @@ frontend that sends jobs to asynchronous background workers. The application's
design can accommodate arbitrarily large scale. The diagram below shows the high
level architecture of the application.
![](images/app-architecture.jpg)
![](../images/app-architecture.jpg)
The application is fully dockerized with all services running inside of
containers.
@@ -372,7 +370,7 @@ In this step, you deploy the application in UCP.
8. Expand to the app to see which nodes the application containers are running in.
![](images/votingapp_default.png)
![](../images/votingapp_default.png)
## Step 5. Test the application
@@ -403,4 +401,4 @@ DNS name to the public IP address of the `votingapp_web-vote-app_1` node.
3. Point your web browser to [http://votingapp.local](http://votingapp.local)
![](images/vote-app-test.jpg)
![](../images/vote-app-test.jpg)

11
applications/index.md Normal file
View File

@@ -0,0 +1,11 @@
<!--[metadata]>
+++
title = "Applications"
description = "Learn how to manage applications on Docker Universal Control Plane."
keywords = ["docker, ucp, apps, management"]
[menu.main]
identifier="mn_ucp_applications"
parent="mn_ucp"
weight=80
+++
<![end-metadata]-->

88
architecture.md Normal file
View File

@@ -0,0 +1,88 @@
<!--[metadata]>
+++
title = "Architecture"
description = "Learn about the architecture of Docker Universal Control Plane."
keywords = ["docker, ucp, architecture"]
[menu.main]
parent="mn_ucp"
identifier="ucp_architecture"
weight=20
+++
<![end-metadata]-->
# UCP architecture
Docker Universal Control Plane (UCP) helps you manage your container cluster
from a single place.
UCP is a containerized application, so the first step to install UCP is
installing the Commercially Supported (CS) Docker Engine on all the nodes that
are going to be part of the cluster.
![](images/architecture-1.png)
After CS Docker Engine is installed, you can install UCP, and join as many
nodes you want to the cluster.
![](images/architecture-2.png)
## UCP controller node
When you install Docker UCP on a node, the following containers are started.
![](images/architecture-3.png)
| Name | Description |
|:--------------------|:-----------------------------------------------------------------------------------------------------------------------------------------------------------|
| ucp-proxy | A TLS proxy. It allows secure access to the local Docker Engine. |
| ucp-controller | The UCP application. It uses the key-value store for persisting configurations. |
| ucp-swarm-manager | Provides the clustering capabilities. It uses the key-value store for leader election, and keeping track of cluster members. |
| ucp-swarm-join | Heartbeat to record on the key-value store that this node is alive. If the node goes down, this heartbeat stops, and the node is dropped from the cluster. |
| ucp-kv | Used to store the UCP configurations. Don't use it in your applications, since it's for internal use only. |
| ucp-cluster-root-ca | A certificate authority to sign the certificates used when joining new nodes, and on administrator client bundles. |
| ucp-client-root-ca | A certificate authority to sign user bundles. Only used when UCP is installed without an external root CA. |
## UCP node
When you join a node to a Docker UCP cluster, the following containers are
started.
![](images/architecture-4.png)
| Name | Description |
|:---------------|:-----------------------------------------------------------------------------------------------------------------------------------------------------------|
| ucp-proxy | A TLS proxy. It allows secure access to the local Docker Engine. |
| ucp-swarm-join | Heartbeat to record on the key-value store that this node is alive. If the node goes down, this heartbeat stops, and the node is dropped from the cluster. |
## Volumes
Docker UCP uses these named volumes for persisting data:
| Volume name | Location on host (/var/lib/docker/volumes/) | Description |
|:----------------------------|:--------------------------------------------|:---------------------------------------------------------------------------------------------------------------|
| ucp-client-root-ca | ucp-client-root-ca/_data | The certificate and key for the UCP root CA. Do not create this volume if you are using your own certificates. |
| ucp-cluster-root-ca | ucp-cluster-root-ca/_data | The certificate and key for the Swarm root CA. |
| ucp-controller-client-certs | ucp-controller-client-certs/_data | The UCP Controller Swarm client certificates for the current node. |
| ucp-controller-server-certs | ucp-controller-server-certs/_data | The controller certificates for the UCP controllers web server. |
| ucp-kv | ucp-kv/_data | Key value store persistence. |
| ucp-kv-certs | ucp-kv-certs/_data | The Swarm KV client certificates for the current node (repeated on every node in the cluster). |
| ucp-node-certs | ucp-node-certs/_data | The Swarm certificates for the current node (repeated on every node in the cluster). |
If you don’t create these volumes, when installing UCP, they are created with
the default volume driver and flags.
## High-availability support
For load balancing and high-availability, you can add more controller nodes
to a UCP cluster. In that case, you’ll have multiple nodes, each running the
same set of containers.
<!--TODO: add diagram with 3 controllers -->
Notice that:
* You can load balance user requests between the controller nodes.
When you make a change to the configuration of one controller node, that
configuration is replicated to the other controllers.
* For high-availability, you should set up 3, 5, or 7 controller nodes.

27
configuration/configure-logs.md Normal file
View File

@@ -0,0 +1,27 @@
<!--[metadata]>
+++
title = "Configure UCP logging"
description = "Learn how to configure Docker Universal Control Plane to store your logs on an external log system."
keywords = ["docker, ucp, integrate, logs"]
[menu.main]
parent="mn_ucp_configuration"
weight=20
+++
<![end-metadata]-->
## Configure UCP logging
You can configure UCP for sending logs to a remote logging service:
1. Login into UCP with an administrator account
2. Navigate to the **Settings** page
3. Set the information about your logging server, and click
**Enable Remote Logging**
![](../images/settings-log.png)
## Where to go next
* [Integrate with DTR](dtr-integration.md)
* [Set up high availability](../high-availability/understand_ha.md)

18
dtr-integration.md → configuration/dtr-integration.md
View File

@@ -1,15 +1,17 @@
<!--[metadata]>
+++
title = "Integrate with Trusted Registry"
aliases = [ "/ucp/dtr-integration/"]
title = "Integrate with Docker Trusted Registry"
description = "Integrate UCP with Docker Trusted Registry"
keywords = ["trusted, registry, integrate, UCP, DTR"]
[menu.main]
parent="mn_ucp"
parent="mn_ucp_configuration"
weight=10
+++
<![end-metadata]-->
# Integrate UCP with Docker Trusted Registry
# Integrate with Docker Trusted Registry
This page explains how to integrate Universal Control Plane (UCP) with the
Docker Trusted Registry (DTR). Trusted Registry is a image storage and
@@ -132,7 +134,7 @@ Registry CA into your UCP.
b. Upload the `dtr.pem` file you just created.
![](images/dtr-integrate-2.png)
![](../images/dtr-integrate-2.png)
6. Press **Update Registry** to save your changes.
@@ -169,7 +171,7 @@ repository on the Trusted Registry.
4. Create a private repository called `hello_world` under your username.
![](images/dtr-integrate.png)
![](../images/dtr-integrate.png)
5. Press **Save**.
@@ -245,13 +247,13 @@ bundle.
8. Log into the Trusted Registry and confirm your repository contains the image your pushed.
![](images/dtr_tag.png)
![](../images/dtr_tag.png)
9. Log into UCP.
10. Choose **Images** and search for `hello`.
![](images/dtr_hello.png)
![](../images/dtr_hello.png)
11. Delete any `hello-world` or `hello_world` image.
@@ -261,7 +263,7 @@ bundle.
13. Enter the name of your test image and press **Pull**.
![](images/dtr_pull.png)
![](../images/dtr_pull.png)
## Troubleshooting section

11
configuration/index.md Normal file
View File

@@ -0,0 +1,11 @@
<!--[metadata]>
+++
title = "Configuration"
description = "Learn how to configure Docker Universal Control Plane on production."
keywords = ["docker, ucp, install, configuration"]
[menu.main]
identifier="mn_ucp_configuration"
parent="mn_ucp"
weight=50
+++
<![end-metadata]-->

13
networking.md → configuration/multi-host-networking.md
View File

@@ -1,10 +1,12 @@
<!--[metadata]>
+++
aliases = [ "/ucp/networking/"]
title ="Set up container networking"
keywords= ["networking, kv, engine-discovery, ucp"]
description="Docker Universal Control Plane"
[menu.main]
parent="mn_ucp"
parent="mn_ucp_configuration"
weight=0
+++
<![end-metadata]-->
@@ -61,7 +63,7 @@ nodes for network communication.
A page listing the installed UCP nodes appears.
![Nodes page](images/host_ip_address.png)
![Nodes page](../images/host_ip_address.png)
3. Use the **ADDRESS** field to record the host IP address for each node.
@@ -220,7 +222,7 @@ Error response from daemon: failed to parse pool request for address space "Glob
If you attempt the same operation from UCP's web administration, you receive
the same error.
![Network error](images/network_gui_error.png)
![Network error](../images/network_gui_error.png)
If you have not configured multi-host networking using the `engine-discovery`
command, the Docker client returns these errors. Check the Engine daemon
@@ -258,3 +260,8 @@ A ping requires that inbound ICMP requests are allowed on the controller.
$ sudo /usr/bin/docker daemon -D --cluster-advertise eth0:12376 --cluster-store etcd://CONTROLLER_PUBLIC_IP_OR_DOMAIN:12379 --cluster-store-opt kv.cacertfile=/var/lib/docker/discovery_certs/ca.pem --cluster-store-opt kv.certfile=/var/lib/docker/discovery_certs/cert.pem --cluster-store-opt kv.keyfile=/var/lib/docker/discovery_certs/key.pem
Remember, you'll need to restart the daemon each time you change the start options.
## Where to go next
* [Integrate with DTR](dtr-integration.md)
* [Set up high availability](../high-availability/understand_ha.md)

11
high-availability/index.md Normal file
View File

@@ -0,0 +1,11 @@
<!--[metadata]>
+++
title = "High-availability"
description = "Learn how to set up Docker Universal Control Plane for high availability."
keywords = ["docker, ucp, high-availability, backup, recovery"]
[menu.main]
identifier="mn_ucp_high_availability"
parent="mn_ucp"
weight=60
+++
<![end-metadata]-->

51
understand_ha.md → high-availability/understand_ha.md
View File

@@ -1,10 +1,11 @@
<!--[metadata]>
+++
aliases = [ "/ucp/understand_ha/"]
title ="Set up high availability"
description="Docker Universal Control plane has support for high availability. Learn how to set up your installation to ensure it tolerates failures."
keywords= ["replica, controller, availability, high, ucp"]
[menu.main]
parent="mn_ucp"
parent="mn_ucp_high_availability"
+++
<![end-metadata]-->
@@ -35,35 +36,35 @@ A Docker UCP installation is made of several nodes:
The **controller** is the first node added to cluster by running the
`ucp install`. This node runs the following containers:
| Name | Description |
|:----------------------|:----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| `ucp-kv` | This container runs the key-value store used by UCP. Don't use this key-value store in your applications, since it's for internal use only. |
| `ucp-swarm-manager` | This Swarm manager uses the replicated KV store for leader election and cluster membership tracking. |
| `ucp-controller` | This container runs the UCP server, using the replicated KV store for configuration state. |
| `ucp-swarm-join` | Runs the `swarm join` command to periodically publish this nodes existence to the KV store. If the node goes down, this publishing stops, and the registration times out, and the node is automatically dropped from the cluster. |
| `ucp-proxy` | Runs a local TLS proxy for the docker socket to enable secure access of the local docker daemon. |
| `ucp-cluster-root-ca` | These **unreplicated** containers run the Swarm CA used for admin certificate bundles, and adding new nodes. |
| `ucp-client-root-ca` | These **unreplicated** containers run the (optional) UCP CA used for signing user bundles. |
| Name | Description |
|:--------------------|:----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| ucp-kv | This container runs the key-value store used by UCP. Don't use this key-value store in your applications, since it's for internal use only. |
| ucp-swarm-manager | This Swarm manager uses the replicated KV store for leader election and cluster membership tracking. |
| ucp-controller | This container runs the UCP server, using the replicated KV store for configuration state. |
| ucp-swarm-join | Runs the `swarm join` command to periodically publish this nodes existence to the KV store. If the node goes down, this publishing stops, and the registration times out, and the node is automatically dropped from the cluster. |
| ucp-proxy | Runs a local TLS proxy for the docker socket to enable secure access of the local docker daemon. |
| ucp-cluster-root-ca | These containers run the Swarm CA used for admin certificate bundles, and adding new nodes. |
| ucp-client-root-ca | These containers run the (optional) UCP CA used for signing user bundles. |
A **replica node** is a node you add to the cluster by running the
`ucp join --replica` command. These nodes run the following containers:
| Name | Description |
|:--------------------|:----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| `ucp-kv` | This etcd container runs the replicated KV store. |
| `ucp-swarm-manager` | This Swarm manager uses the replicated KV store for leader election and cluster membership tracking. |
| `ucp-controller` | This container runs the UCP server, using the replicated KV store for configuration state. |
| `ucp-swarm-join` | Runs the `swarm join` command to periodically publish this nodes existence to the KV store. If the node goes down, this publishing stops, and the registration times out, and the node is automatically dropped from the cluster. |
| `ucp-proxy` | Runs a local TLS proxy for the docker socket to enable secure access of the local docker daemon. |
| Name | Description |
|:------------------|:----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| ucp-kv | This etcd container runs the replicated KV store. |
| ucp-swarm-manager | This Swarm manager uses the replicated KV store for leader election and cluster membership tracking. |
| ucp-controller | This container runs the UCP server, using the replicated KV store for configuration state. |
| ucp-swarm-join | Runs the `swarm join` command to periodically publish this nodes existence to the KV store. If the node goes down, this publishing stops, and the registration times out, and the node is automatically dropped from the cluster. |
| ucp-proxy | Runs a local TLS proxy for the docker socket to enable secure access of the local docker daemon. |
The remaining **non-replica nodes** provide additional capacity to the cluster,
to run your own containers and applications. They don't contribute to the
high-availability of the UCP cluster. These nodes run the following containers:
| Name | Description |
|:-----------------|:----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| `ucp-swarm-join` | Runs the `swarm join` command to periodically publish this nodes existence to the KV store. If the node goes down, this publishing stops, and the registration times out, and the node is automatically dropped from the cluster. |
| `ucp-proxy` | Runs a local TLS proxy for the docker socket to enable secure access of the local docker daemon. |
| Name | Description |
|:---------------|:----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| ucp-swarm-join | Runs the `swarm join` command to periodically publish this nodes existence to the KV store. If the node goes down, this publishing stops, and the registration times out, and the node is automatically dropped from the cluster. |
| ucp-proxy | Runs a local TLS proxy for the docker socket to enable secure access of the local docker daemon. |
## Size your deployment
@@ -107,7 +108,7 @@ UCP configurations are stored using a key-value store that is replicated across
the controller and replica nodes. This makes the cluster tolerant to failures.
The data of the key-value store and the certificates used for TLS are persisted
using volumes. [These volumes](plan-production-install.md#data-volumes-used)
using volumes. [These volumes](../architecture.md#volumes)
are created when installing UCP on a node, and when joining nodes to a cluster.
On UCP version 1.0, the CAs present in the controller node are not replicated
@@ -129,3 +130,9 @@ it's not possible to:
You should keep a backup of these volumes, so that you can restore the CAs used
in the controller node, in case of failure.
## Where to go next
* [UCP architecture](../architecture.md)
* [Install UCP for production](../installation/install-production.md)

BIN
images/architecture-1.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 16 KiB

BIN
images/architecture-2.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 27 KiB

BIN
images/architecture-3.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 24 KiB

BIN
images/architecture-4.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 11 KiB

62
index.md
View File

@@ -10,62 +10,8 @@ identifier="mn_ucp"
# Docker Universal Control Plane
Docker Universal Control Plane (UCP) is an enterprise on premise solution that
enables IT operations teams to deploy and manage their Dockerized applications
in production. It gives developers and administrators the agility and
portability they need to manage Docker resources, all from within the enterprise
firewall.
Docker Universal Control Plane (UCP) is the enterprise-grade cluster management
solution from Docker. You install it behind your firewall, and it helps you
manage your whole cluster from a single place.
## Deploy, manage, and monitor Docker Engine resources
Universal Control Plane can be deployed to any private infrastructure and public
cloud including Microsoft Azure, Digital Ocean, Amazon Web Services, and
SoftLayer.
Once deployed, UCP uses Docker Swarm to create and manage clusters, tested up to
10,000 nodes deployed in any private data center or public cloud provider.
## Secure communications
UCP has built in in security, and integration with existing LDAP/AD for
authentication and role based access control. Optionally, you can use its native
integration with Docker Trusted registry. The integration with Docker Trusted
Registry allows enterprises to leverage Docker Content Trust (Notary in the
open source world), a built in security tool for signing images.
Universal Control Plane is the only tool on
the market that comes comes with Docker Content Trust directly
out of the box. With these integrations Universal Control Plane
gives enterprise IT security teams the necessary control over their
environment and application content.
## Control user access
Security is top of mind for many enterprise IT operations teams. Docker UCP
integrates with existing tools like LDAP/AD for user authentication and its
integration with Docker Trusted Registry. This integration enables enterprises
to control the entire build, ship and run workflow in a secure fashion.
Within Docker UCP, you can do a local set up for account information, or you can
do centralized authentication by linking UCP with your LDAP or Active Directory.
The integration with Docker Trusted Registry also means that you can use Docker
Content Trust, to sign your images and ensure that they are not altered in
anyway and are safe for use within your organization. Users can pull images from
Docker Trusted Registry into Docker UCP and not have to worry about their
security.
For RBAC, within UCP you can view the roles of existing accounts as well as see
the roles that they have within UCP. The granular role based access control
allows you to control who can access certain images. This drastically reduces
organizational risk within enterprises.
## Where to go next
* If you are interested in evaluating UCP on your laptop, you can use the [evaluation installation and quickstart](evaluation-install.md).
* Technical users and managers can get detailed explanation of the UCP architecture and requirements from the [plan a production installation](plan-production-install.md) page. The step-by-step [production installation](plan-production-install.md) is also available.
* To learn more about controlling users in UCP, see [Manage and authorize UCP users](manage/monitor-manage-users.md).
* If you have used UCP in our BETA program, be sure to read the [release notes](release_notes.md).
The UCP documentation includes the following topics:

28
evaluation-install.md → install-sandbox.md
View File

@@ -1,22 +1,25 @@
<!--[metadata]>
+++
title = "Evaluation installation"
aliases = ["/ucp/evaluation-install/"]
title = "Evaluate UCP in a sandbox"
description = "Evaluation installation"
keywords = ["tbd, tbd"]
[menu.main]
parent="mn_ucp"
weight=-100
weight=10
+++
<![end-metadata]-->
# Evaluation installation and quickstart
# Evaluate UCP in a sandbox
This page helps you to learn about Docker Universal Control Plane (UCP) at a
high-level through installing and running UCP in your local, sandbox
installation. The installation should be done on a Mac OS X or Windows system.
If you are experienced with Linux or a technical DevOps user wanting a technical
deep dive, please feel free to skip this evaluation and go directly to [Plan a production installation](plan-production-install.md) and then to [Install UCP for production](production-install.md).
deep dive, please feel free to skip this evaluation and go directly to
[Plan a production installation](installation/plan-production-install.md)
and then to [Install UCP for production](installation/install-production.md).
A UCP installation consists of an UCP controller and one or more hosts. These
instructions use Docker Machine, Docker's provisioning tool, to create several
@@ -50,7 +53,7 @@ a Docker Swarm cluster. The UCP installation process by default secures the clus
This example is intended as an introduction for non-technical users wanting to
explore UCP for themselves. If you are a highly technical user intending to act as
UCP administration operator, you may prefer to skip this and go straight to
[Plan a production installation](plan-production-install.md).
[Plan a production installation](installation/plan-production-install.md).
>**Note**: The command examples in this page were tested for a Mac OSX environment.
If you are in another, you may need to adjust the commands to use analogous
@@ -142,11 +145,11 @@ an image with subcommands to `install` a UCP controller or `join` a node to a
UCP controller. The general format of these commands are:
| Docker client | `run` command with options | `ucp` image | Subcommand with options |
|---------------|----------------------------|--------------|-------------------------|
| `docker` | `run --rm -it` | `docker/ucp` | `install --help` |
| `docker` | `run --rm -it` | `docker/ucp` | `join --help` |
| `docker` | `run --rm -it` | `docker/ucp` | `uninstall --help` |
| Docker client | `run` command with options | `ucp` image | Subcommand with options |
|:--------------|:---------------------------|:-------------|:------------------------|
| `docker` | `run --rm -it` | `docker/ucp` | `install --help` |
| `docker` | `run --rm -it` | `docker/ucp` | `join --help` |
| `docker` | `run --rm -it` | `docker/ucp` | `uninstall --help` |
You can these subcommands interactively by passing them the `-i` option or by
passing command-line options. The `ucp` tool is designed to make UCP easier to
@@ -689,6 +692,5 @@ activities you can perform with UCP.
## Where to Go Next
* [Plan a production installation](plan-production-install.md)
* [Install UCP for production](production-install.md)
* [Docker Machine overview](https://docs.docker.com/machine/)
* [UCP architecture](architecture.md)
* [UCP system requirements](installation/system-requirements.md)

11
installation/index.md Normal file
View File

@@ -0,0 +1,11 @@
<!--[metadata]>
+++
title = "Installation"
description = "Learn the requirements and procedure to install Docker Universal Control Plane on production."
keywords = ["docker, ucp, install, requirements"]
[menu.main]
identifier="mn_ucp_installation"
parent="mn_ucp"
weight=30
+++
<![end-metadata]-->

56
installation/install-offline.md Normal file
View File

@@ -0,0 +1,56 @@
<!--[metadata]>
+++
title = "Install offline"
description = "Learn how to install Docker Universal Control Plane. on a machine with no internet access."
keywords = ["docker, ucp, install, offline"]
[menu.main]
identifier="ucp_install_offline"
parent="mn_ucp_installation"
weight=30
+++
<![end-metadata]-->
# Install UCP offline
The procedure to install Docker Universal Control Plane on a host is the same,
whether that host has access to the internet or not.
The only difference when installing on an offline host,
is that instead of pulling the UCP images from Docker Hub, you use a
computer that is connected to the internet to download a single package with
all the images. Then you copy that package to the host where you’ll install UCP.
## Step 1. Get the UCP package
Use a computer with internet access to download a single package with all UCP
images. As an example, to download UCP 1.1, run:
```bash
$ wget https://packages.docker.com/ucp/1.0/ucp-1.1.tar
```
## Step 2. Copy the package
Now that you have the UCP package file, transfer it to the host where you want
to install Docker UCP. You can use the `scp` command for this.
```bash
$ scp ./ucp-1.1.tar user@ucp-host:/tmp
```
## Step 3. Load the UCP images
Once the package is on the host where you want to install UCP, you can use
the `docker load` command, to load the images from the .tar file.
```bash
$ docker load < /tmp/ucp-1.1.tar
```
## Step 4. Install Docker UCP
Now that the offline host has all the images needed to install UCP,
you can [install Docker UCP that machine](install-production.md).
## Where to go next
* [Install UCP for production](install-production.md).
* [UCP system requirements](system-requirements.md)

72
production-install.md → installation/install-production.md
View File

@@ -1,11 +1,12 @@
<!--[metadata]>
+++
aliases = [ "/ucp/production-install/"]
title = "Install UCP for production"
description = "Learn how to install Docker Universal Control Plane on production"
keywords = ["Universal Control Plane, UCP, install"]
[menu.main]
parent="mn_ucp"
weight=-85
parent="mn_ucp_installation"
weight=20
+++
<![end-metadata]-->
@@ -33,7 +34,6 @@ contains the following sections:
- [Step 9: Add more nodes to the UCP cluster](#step-9-add-more-nodes-to-the-ucp-cluster)
- [Step 10: Set up certificates for the Docker CLI](#step-10-set-up-certificates-for-the-docker-cli)
- [Disable collection of usage metrics](#disable-collection-of-usage-metrics)
- [Uninstall](#uninstall)
- [Where to go next](#where-to-go-next)
## About these installation instructions
@@ -92,7 +92,7 @@ communicate. Configure your network to make sure these ports are open:
| controller, replicas | out | 80 | send anonymous usage reports to Docker. |
Some of the ports used, are customizable. Check the
[UCP install command reference](reference/install.md) for more
[UCP install command reference](../reference/install.md) for more
information on this. This guide uses the default ports.
## Step 3: Install Docker CS Engine on each node
@@ -173,7 +173,7 @@ Be sure to have this information at hand before starting the installation.
If you're installing UCP on a cloud provider such as AWS, make sure your
instance has a public IP or hostname, as displayed below.
![Controller public IP on AWS](images/ip_cloud_provider.png)
![Controller public IP on AWS](../images/ip_cloud_provider.png)
On the controller node, install UCP:
@@ -182,7 +182,7 @@ On the controller node, install UCP:
$ docker run --rm -it docker/ucp install --help
You can also find the documentation for these option on
the [UCP install command reference](reference/install.md).
the [UCP install command reference](../reference/install.md).
2. Run the `ucp` command interactively.
@@ -205,11 +205,11 @@ license to your installation:
1. Navigate to [Docker Hub](https://hub.docker.com/) to download your license.
On the top-right menu, choose **Settings**.
![Docker hub home page](images/docker-hub-settings.png)
![Docker hub home page](../images/docker-hub-settings.png)
2. Navigate to the **Licenses** tab.
![Docker Hub licenses page](images/docker-hub-license.png)
![Docker Hub licenses page](../images/docker-hub-license.png)
Download the license by clicking on it.
@@ -218,7 +218,7 @@ On the top-right menu, choose **Settings**.
In your browser, navigate to the IP of the node where you installed the
UCP controller. In this example, it's `https://52.70.188.239`.
![UCP login screen](images/login.png)
![UCP login screen](../images/login.png)
Your browser may warn that the connection to UCP is not secure. The warning
appears because you are accessing UCP with HTTPS, but the certificates used
@@ -240,7 +240,7 @@ the installation.
After logging in, you're redirected to the licensing page. Click the
**Upload License** button, and choose your license file.
![UCP Login screenshot](images/skip-this.png)
![UCP Login screenshot](../images/skip-this.png)
6. Check the **Dashboard** page.
@@ -248,7 +248,7 @@ the installation.
should show that there's only a single node in your cluster:
the controller node.
![UCP dashboard screenshot](images/dashboard.png)
![UCP dashboard screenshot](../images/dashboard.png)
## Step 8: Add controller replicas to the UCP cluster
@@ -267,7 +267,7 @@ to the cluster.
Also, in UCP v1.0 the controller serves as root CA. During a controller
failure, it might not be possible to add more nodes to the cluster.
[Learn more about high availability](understand_ha.md).
[Learn more about high availability](../high-availability/understand_ha.md).
When adding replica nodes to your installation, you will be prompted for
@@ -286,7 +286,7 @@ Review the options available on the `ucp join` command.
$ docker run --rm -it docker/ucp join --help
You can also find the documentation for the `ucp join` command at
the [UCP join command reference](reference/join.md) page.
the [UCP join command reference](../reference/join.md) page.
For each node that you want to turn into a controller replica:
@@ -315,7 +315,7 @@ For each node that you want to turn into a controller replica:
The Dashboard page should now display your new replica nodes. In the
bottom of the screen, you can see the health of the controller and replicas.
![UCP nodes page](images/replica-nodes.png)
![UCP nodes page](../images/replica-nodes.png)
## Step 9: Add more nodes to the UCP cluster
@@ -339,7 +339,7 @@ Review the options available on the `ucp join` command:
$ docker run --rm -it docker/ucp join --help
You can also find the documentation for the `ucp join` command on
the [UCP join command reference](reference/join.md) page.
the [UCP join command reference](../reference/join.md) page.
For each node that you want to add to your UCP cluster:
@@ -363,7 +363,7 @@ For each node that you want to add to your UCP cluster:
The nodes page should now display all the nodes of your cluster.
![UCP nodes page](images/nodes-page.png)
![UCP nodes page](../images/nodes-page.png)
## Step 10: Set up certificates for the Docker CLI
@@ -523,7 +523,7 @@ can use to interact with UCP with the CLI client.
In the UCP web app, navigate to your **profile**, and click the **Add an
Existing Public Key** button.
![Add public key](images/add-pk.png)
![Add public key](../images/add-pk.png)
Set a name, and the contents of the `cert.pub` file.
@@ -556,41 +556,7 @@ To disable usage reporting:
4. Click the **Update Usage Reporting** button, to save your changes.
## Uninstall
To uninstall Docker UCP, use the `ucp uninstall` command. This command only
removes the UCP containers, and doesn't affect any other containers.
When uninstalling UCP from a cluster, leave the UCP controller node for last.
Review the options available on the `ucp uninstall` command.
$ docker run --rm -it docker/ucp uninstall --help
You can also find the documentation for the `ucp uninstall` command at
the [UCP uninstall command reference](reference/uninstall.md) page.
To uninstall UCP from a node:
1. Login into the node you want to remove UCP from
2. Run the the following command:
```
$ docker run --rm -it -v /var/run/docker.sock:/var/run/docker.sock --name ucp docker/ucp uninstall -i
INFO[0000] Removing UCP Containers
INFO[0001] Removing UCP images
INFO[0007] Removing UCP volumes
```
After uninstalling UCP, you can remove the `docker/ucp` images that
were pulled from Docker Hub when installing UCP.
3. Repeat steps 1 and 2 on each node of the cluster. Make sure to save
the controller for last.
## Where to go next
* Read more [about Docker UCP](https://www.docker.com/universal-control-plane)
* Read more [about the Docker CLI client](http://docs.docker.com/reference/commandline/cli/)
* Learn [about Docker Swarm](http://docs.docker.com/swarm/)
* [UCP architecture](../architecture.md)
* [UCP system requirements](system-requirements.md)

56
installation/plan-production-install.md Normal file
View File

@@ -0,0 +1,56 @@
<!--[metadata]>
+++
aliases = ["/ucp/plan-production-install/"]
title = "Plan a production installation"
description = "Learn about the Docker Universal Control Plane architecture, and the requirements to install it on production."
keywords = ["docker, ucp, install, checklist"]
[menu.main]
parent="mn_ucp_installation"
weight=10
+++
<![end-metadata]-->
# Plan a production installation
Docker Universal Control Plane can be installed on-premises, or
on a virtual private cloud. If you've never used Docker UCP before,
you should start by [installing it on a sandbox](../install-sandbox.md).
To secure your data, Docker UCP is automatically set up to use mutual TLS on
all communications. Before you install UCP, make sure you know:
* The fully qualified domain names (FQDN) of the hosts where you'll install UCP,
* Their Subject Alternative Names (SANs).
## Fully-qualified domain names
When installing Docker UCP, the installer tries to find the fully-qualified
domain names (FQDN) of your hosts.
If the installer can't detect this automatically, or if you want to use a
different FQDN or IP address, use the `--host-address` option when installing.
This option allows you to specify the IP or hostname that UCP is going to use
to reach that host.
If you're installing UCP on a cloud provider such as AWS or Digital Ocean,
you might need to create a private network for you UCP installation. In that
case, make sure all nodes of the cluster can communicate using their private
IPs.
## Subject alternative names (SANs)
When joining new nodes to the cluster, UCP creates leaf certificates for that
node. Those certificates are then used by for communicating over mutual TLS
with other members of the cluster.
You can specify the subject alternative names (SANs) to be used in the
certificate. If you are installing UCP interactively you'll be prompted for
this. You can also use the `--san` option when installing and joining nodes
to the cluster.
## Where to go next
* [UCP system requirements](system-requirements.md)
* [Install UCP for production](install-production.md)

58
installation/system-requirements.md Normal file
View File

@@ -0,0 +1,58 @@
<!--[metadata]>
+++
title = "System requirements"
description = "Learn about the system requirements for installing Docker Universal Control Plane."
keywords = ["docker, ucp, architecture, requirements"]
[menu.main]
parent="mn_ucp_installation"
identifier="ucp_system_requirements"
weight=0
+++
<![end-metadata]-->
# UCP system requirements
Docker Universal Control Plane can be installed on-premises or on the cloud.
Before installing, be sure your infrastructure has these requirements.
## Hardware and software requirements
You can install UCP on-premises or on a cloud provider. To install UCP,
all nodes must have:
* 1.50 GB of RAM
* 3.00 GB of available disk space
* One of the supported operating systems installed:
* RHEL 7.0, 7.1
* Ubuntu 14.04 LTS
* CentOS 7.1
* SUSE Linux Enterprise 12
* Linux kernel version 3.10 or higher
* CS Docker Engine version 1.10 or higher
## Ports used
When installing UCP on a host, make sure the following ports are open:
| Hosts | Direction | Port | Purpose |
|:-------------------|:---------:|:--------------------|:------------------------------------------------------------|
| controllers | in | 443 (configurable) | Web app and CLI client access to UCP. |
| controllers | in | 2376 (configurable) | Swarm manager accepts requests from UCP controller. |
| controllers, nodes | in | 2375 | Heartbeat for nodes, to ensure they are running. |
| controllers, nodes | in | 12376 | Proxy for TLS, provides access to UCP, Swarm, and Engine. |
| controller | in | 12379 | Internal node configuration, cluster configuration, and HA. |
| controller | in | 12380 | Internal node configuration, cluster configuration, and HA. |
| controller | in | 12381 | Proxy for TLS, provides access to UCP. |
| controller | in | 12382 | Manages TLS and requests from swarm manager. |
| controller | out | 443 | Send anonymous usage reports to Docker. |
UCP collects anonymous usage metrics, to help us improve it. These metrics
are entirely anonymous, don’t identify your company, users, applications,
or any other sensitive information. You can disable this when installing
or on the UCP settings screen.
## Where to go next
* [UCP architecture](../architecture.md)
* [Plan a production installation](plan-production-install.md)

71
installation/uninstall.md Normal file
View File

@@ -0,0 +1,71 @@
<!--[metadata]>
+++
title = "Uninstall UCP"
description = "Learn how to uninstall a Docker Universal Control Plane cluster."
keywords = ["docker, ucp, uninstall"]
[menu.main]
parent="mn_ucp_installation"
weight=50
+++
<![end-metadata]-->
# Uninstall UCP
Use the docker/ucp uninstall command, to uninstall Docker Universal Control
Plane from a node. This command only removes the UCP containers, and doesn’t
affect any other containers.
To see what options are available in the uninstall command, check the
[uninstall command reference](../reference/uninstall.md), or run:
```bash
$ docker run --rm -it docker/ucp uninstall --help
```
To uninstall Docker UCP from a cluster, you should:
1. Uninstall UCP from every node joined in the cluster,
2. Uninstall UCP from every controller node, one at a time.
## Example
The following example illustrates an interactive uninstall.
1. Run the uninstall command.
```
$ docker run --rm -it -v /var/run/docker.sock:/var/run/docker.sock --name ucp docker/ucp uninstall -i
INFO[0000] We're about to uninstall the local components for UCP ID: FEY4:M46O:7OUS:QQA4:HLR3:4HRD:IUTH:LC2W:QPRE:BLYH:UWEM:3TYV
Do you want proceed with the uninstall? (y/n): y
INFO[0000] Removing UCP Containers
INFO[0000] Removing UCP images
INFO[0005] Removing UCP volumes
```
2. List the images remaining on the node.
```
$ docker images
REPOSITORY TAG IMAGE ID CREATED SIZE
docker/ucp latest 788bdcfde423 8 days ago 8.239 MB
```
3. Remove the `ucp` image from the node.
Because the `ucp` tool is running during the installation, it can't remove
its own image. If you want to free up that space, delete the ucp image.
```
$ docker rmi docker/ucp:latest
Untagged: docker/ucp:latest
Deleted: sha256:788bdcfde423b6226b90ac98e6f233b15c0c527779177d7017a4e17db31404c9
Deleted: sha256:dee84053b25f9b3edffb734c842a70313021063cc78d9158c63de109e1b3cb72
Deleted: sha256:93743d5df2362466e2fe116a677ec6a4b0091bd09e889abfc9109047fcfcdebf
```
4. Return to the UCP web application to confirm the node is removed.

26
upgrade-ucp.md → installation/upgrade.md
View File

@@ -1,11 +1,13 @@
<!--[metadata]>
+++
aliases = [ "/ucp/upgrade-ucp/"]
title = "Upgrade UCP"
description = "Learn how to upgrade Docker Universal Control Plane with the minimal impact to your users."
description = "Learn how to upgrade Docker Universal Control Plane with minimal impact to your users."
keywords = ["Docker, UCP, upgrade, update"]
[menu.main]
parent="mn_ucp"
weight=-81
identifier="ucp_upgrade_installation"
parent="mn_ucp_installation"
weight=40
+++
<![end-metadata]-->
@@ -14,7 +16,7 @@ weight=-81
This page guides you on upgrading Docker Universal Control Plane (UCP).
Before upgrading to a new version of UCP, check the
[release notes](release_notes.md) for the version you are upgrading to.
[release notes](../release_notes.md) for the version you are upgrading to.
There you'll find information about the new features, breaking changes, and
other relevant information for upgrading to a particular version.
@@ -35,7 +37,7 @@ $ docker run --rm -it docker/ucp upgrade --help
```
You can also find the documentation for the `upgrade` command on the
[UCP upgrade command reference](reference/upgrade.md).
[UCP upgrade command reference](../reference/upgrade.md).
When you run the `upgrade` command, it:
@@ -46,7 +48,7 @@ When you run the `upgrade` command, it:
to upgrade directly to the latest version. In that case, you'll need
to upgrade to intermediate versions before upgrading to the latest version.
Check the [release notes](release_notes.md) to see if its possible to
Check the [release notes](../release_notes.md) to see if its possible to
upgrade directly or not.
3. Stops and removes the old UCP containers.
@@ -67,7 +69,7 @@ while a cluster that supports high-availability has multiple controller nodes.
To check the number of controller nodes in your cluster, navigate to the **UCP
web application**, and check the **Nodes** page.
![Cluster replicas](images/multiple-replicas.png)
![Cluster replicas](../images/multiple-replicas.png)
In this example we have 3 controller nodes set up, which means that this
cluster is set up for high-availability.
@@ -95,14 +97,14 @@ replica nodes):
To download a client bundle, **login** with an administrator user,
go to your **profile** and click the **Create a Client Bundle** button.
![Create a client bundle](images/add-pk.png)
![Create a client bundle](../images/add-pk.png)
2. Make sure your cluster is healthy before starting the upgrade.
Login into **UCP** and navigate to the **Nodes** page. Make sure all nodes
are listed.
![UCP nodes](images/cluster-nodes.png)
![UCP nodes](../images/cluster-nodes.png)
You can also use your client bundle for this. In the command line, navigate
to the directory of the client bundle and run:
@@ -174,14 +176,14 @@ If your cluster is set up for high-availability (has several replica nodes):
To download a client bundle, **login** with an administrator user,
go to your **profile** and click the **Create a Client Bundle** button.
![Create a client bundle](images/add-pk.png)
![Create a client bundle](../images/add-pk.png)
3. Make sure your cluster is healthy before starting the upgrade.
Login into **UCP** and navigate to the **Nodes** page. Make sure all nodes
are listed.
![UCP nodes](images/cluster-nodes.png)
![UCP nodes](../images/cluster-nodes.png)
You can also use your client bundle for this. In the command line, navigate
to the directory of the client bundle and run:
@@ -274,5 +276,5 @@ If your cluster is set up for high-availability (has several replica nodes):
## Where to go next
* [Plan a production installation](plan-production-install.md)
* [UCP release notes](../release_notes.md)
* [Upgrade Docker Trusted Registry](https://docs.docker.com/docker-trusted-registry/install/upgrade/)

10
ldap-config.md
View File

@@ -1,10 +0,0 @@
<!--[metadata]>
+++
title = "Configure LDAP"
description = "Learn how configure UCP with LDAP"
draft="true"
keywords= ["UCP, LDAP"]
[menu.main]
parent="mn_ucp"
+++
<![end-metadata]-->

16
manage/index.md
View File

@@ -1,16 +0,0 @@
<!--[metadata]>
+++
title = "Manage and monitor"
description = "Manage, monitor, troubleshoot"
keywords = ["Manage, monitor, troubleshoot"]
[menu.main]
identifier="mn_manage_ucp"
parent="mn_ucp"
weight=88
+++
<![end-metadata]-->
# UCP resource management and monitoring
* [Your UCP installation](monitor-ucp.md)
* [Users](monitor-manage-users.md)

27
manage/monitor-manage-applications.md
View File

@@ -1,27 +0,0 @@
<!--[metadata]>
+++
draft=true
title = "Applications"
description = "Monitor, manage, troubleshoot applications"
keywords = ["tbd, tbd"]
[menu.main]
parent="mn_manage_ucp"
+++
<![end-metadata]-->
# Monitor, manage, and troubleshoot applications
Intro 1-2 paras, page purpose, intended user, list steps if page is tutorial.
## Understand applications and UCP
* version matrix
* which features are supported
* features that aren’t supported
* requirements
## Review applications on UCP
tbd
## Troubleshoot applications

33
manage/monitor-manage-containers.md
View File

@@ -1,33 +0,0 @@
<!--[metadata]>
+++
draft=true
title = "Containers"
description = "Monitor, manage, troubleshoot containers"
keywords = ["tbd, tbd"]
[menu.main]
parent="mn_manage_ucp"
+++
<![end-metadata]-->
# Monitor, manage, and troubleshoot containers
Intro 1-2 paras, page purpose, intended user, list steps if page is tutorial.
## Understand containers and UCP
* UCP launch
* Compose launch
* CLI launch
## Getting container information
tbd
## Monitoring container resources
Best practices document for monitoring Docker containers (if there is one)
## Restricting container launch
* From UCP
* From ClI

38
manage/monitor-manage-images.md
View File

@@ -1,38 +0,0 @@
<!--[metadata]>
+++
draft=true
title = "Images"
description = "Monitor, manage, troubleshoot images"
keywords = ["tbd, tbd"]
[menu.main]
parent="mn_manage_ucp"
+++
<![end-metadata]-->
# Monitor, manage, and troubleshoot images
Intro 1-2 paras, page purpose, intended user, list steps if page is tutorial.
## Understand images and UCP
* Which registries can users pull images from
* Image “life cycle” for admins (graphic)
## Explain how to pull images by example
* GUI
* Contrast with command-line
* Compose for automated pulls
## Update or review images through UCP
tbd
## Ensure containers run the correct image
tbd
## Content Trust in UCP
tbd
## Troubleshooting image problems
if a container is running an old image (how to tell)

26
manage/monitor-manage-networks.md
View File

@@ -1,26 +0,0 @@
<!--[metadata]>
+++
draft=true
title = "Container networks"
description = "Monitor, manage, and troubleshoot container networks"
keywords = ["tbd, tbd"]
[menu.main]
parent="mn_manage_ucp"
+++
<![end-metadata]-->
# Monitor, manage, and troubleshoot networks
Intro 1-2 paras, page purpose, intended user, list steps if page is tutorial.
## Understand container networks and UCP
tbd
## Review networks on UCP
tbd
## Restricting network launches
* From UCP
* From CLI

27
manage/monitor-manage-volumes.md
View File

@@ -1,27 +0,0 @@
<!--[metadata]>
+++
draft="true"
title = "Volumes"
description = "Monitor, manage, and troubleshoot volumes"
keywords = ["tbd, tbd"]
[menu.main]
parent="mn_manage_ucp"
+++
<![end-metadata]-->
# Monitor, manage, and troubleshoot volumes
Intro 1-2 paras, page purpose, intended user, list steps if page is tutorial.
## Understand volumes and UCP
* bind mounted volumes
* data volume container
## Review volumes on UCP
tbd
## Troubleshoot volumes
tbd

12
monitor/index.md Normal file
View File

@@ -0,0 +1,12 @@
<!--[metadata]>
+++
aliases = [ "/ucp/manage/"]
title = "Monitor and troubleshoot"
description = "Manage, monitor, troubleshoot"
keywords = ["manage, monitor, troubleshoot"]
[menu.main]
identifier="mn_monitor_ucp"
parent="mn_ucp"
weight=50
+++
<![end-metadata]-->

24
manage/monitor-ucp.md → monitor/monitor-ucp.md
View File

@@ -1,15 +1,16 @@
<!--[metadata]>
+++
title = "Monitor and troubleshoot UCP"
aliases = [ "/ucp/manage/monitor-ucp/"]
title = "Monitor your cluster"
description = "Monitor your Docker Universal Control Plane installation, and learn how to troubleshoot it."
keywords = ["Docker, UCP, troubleshoot"]
[menu.main]
parent="mn_manage_ucp"
parent="mn_monitor_ucp"
weight=-80
+++
<![end-metadata]-->
# Monitor and troubleshoot your UCP installation
# Monitor your cluster
This article gives you an overview of how to monitor your Docker UCP
installation. Here you'll also find the information you need to troubleshoot
@@ -23,7 +24,7 @@ Docker UCP has several components:
* UCP replica nodes: replicas of the controller node, for high-availability,
* UCP nodes: the nodes that run your own containers.
[Learn more about the UCP architecture](../plan-production-install.md#ucp-architecture).
[Learn more about the UCP architecture](../installation/plan-production-install.md#ucp-architecture).
## Check the cluster status
@@ -68,7 +69,7 @@ You can also check UCP status using the command line:
UCP uses mutual TLS. So you need to have a client certificate bundle
to interact with UCP from the command line.
[Learn how to get a client bundle](../production-install.md#set-8-set-up-certificates-for-the-cli).
[Learn how to get a client bundle](../installation/install-production.md#step-10-set-up-certificates-for-the-docker-cli).
If you don't have a client bundle, you'll need to login into the
host directly.
@@ -216,19 +217,8 @@ $ docker -H tcp://ec2-54-183-169-0.us-west-1.compute.amazonaws.com:12376 logs uc
--- output snipped ---
```
## Configure UCP logging
You can configure UCP for sending logs to a remote logging service:
1. Login into UCP with an administrator account
2. Navigate to the **Settings** page
3. Set the information about your logging server, and click
**Enable Remote Logging**
![](../images/settings-log.png)
## Where to go next
* [Learn about the UCP architecture](../plan-production-install.md#ucp-architecture)
* [Troubleshoot your cluster](troubleshoot-ucp.md)
* [Get support](../support.md)

12
kv_store.md → monitor/troubleshoot-ucp.md
View File

@@ -1,14 +1,15 @@
<!--[metadata]>
+++
title ="UCP Key/Value Store Backends"
aliases = ["/ucp/kv_store/"]
title ="Troubleshoot your cluster"
keywords= ["ectd, key, value, store, ucp"]
description="Docker Universal Control Plane"
[menu.main]
parent="mn_ucp"
parent="mn_monitor_ucp"
+++
<![end-metadata]-->
# UCP Key/Value Store Backend
# Troubleshoot your cluster
In this release, UCP leverages the [etcd](https://github.com/coreos/etcd/) KV
store internally for node discovery and high availability. This use is specific
@@ -124,3 +125,8 @@ client certificates signed by the Swarm Root CA. As admin account
certificates are also signed by this Swarm Root CA, administrators can
access the KV store using `curl` or other tools, provided the admin's
certificate is used as the client certificate.
## Where to go next
* [Monitor your cluster](monitor-ucp.md)
* [Get support](../support.md)

84
overview.md
View File

@@ -1,35 +1,71 @@
<!--[metadata]>
+++
title ="Docker Universal Control Plane"
keywords= ["univeral, introduction, overview, ucp"]
description="Docker Universal Control Plane"
title ="Universal Control Plane overview"
description="Learn about Docker Universal Control Plane, the enterprise-grade cluster management solution from Docker."
keywords= ["docker, ucp, overview, orchestration, clustering"]
[menu.main]
parent="mn_ucp"
weight="-100"
weight=0
+++
<![end-metadata]-->
# Universal Control Plane overview
# UCP table of contents
Docker Universal Control Plane (UCP) is the enterprise-grade cluster management
solution from Docker. You install it behind your firewall, and it helps you
manage your whole cluster from a single place.
Universal Control Plane is a Docker native solution designed to provision and
cluster Docker hosts and their resources. You can use UCP to deploy and manage
Dockerized applications. UCP has full support for the Docker API. This feature
means an easy deployment of applications from development to test to production
&ndash; without code changes.
![](images/replica-nodes.png)
The UCP documentation includes the following topics:
## Centralized cluster management
* [UCP Overview](index.md)
* [Evaluation installation](evaluation-install.md)
* [Plan a production installation](plan-production-install.md)
* [Install UCP for production](production-install.md)
* [Set up container networking with UCP](networking.md)
* [Set up high availability](understand_ha.md)
* [Deploy an application thru UCP](deploy-application.md)
* [UCP Key/Value Store Backend](kv_store.md)
* [Manage, monitor, and troubleshoot UCP and its resources](manage/monitor-ucp.md)
* [Manage and authorize users](manage/monitor-manage-users.md)
* [The ucp tool reference](reference/index.md)
* [Work with Docker Support](support.md)
* [UCP Release Notes](release_notes.md)
Docker UCP can be installed on-premises, or on a virtual private cloud.
And with it, you can manage thousands of nodes as if they were a single one.
You can monitor and manage your cluster using a graphical UI.
![](images/container-detail-2.png)
Since UCP exposes the standard Docker API, you can continue using the tools
you already know, to manage a whole cluster.
As an example, you can use the `docker info` command to check the
status of the cluster:
```bash
$ docker info
Containers: 30
Images: 24
Server Version: swarm/1.1.3
Role: primary
Strategy: spread
Filters: health, port, dependency, affinity, constraint
Nodes: 2
ucp: 192.168.99.103:12376
└ Status: Healthy
└ Containers: 20
ucp-replica: 192.168.99.102:12376
└ Status: Healthy
└ Containers: 10
```
## Deploy, manage, and monitor
With Docker UCP you can manage the nodes of your infrastructure. You can also
manage apps, containers, networks, images, and volumes, in a transparent way.
## Built-in security and access control
Docker UCP has its own built-in authentication mechanism, and supports LDAP
and Active Directory. It also supports Role Based Access Control (RBAC).
This ensures that only authorized users can access and make changes to cluster.
Docker UCP also integrates with Docker Trusted Registry and Docker Content
Trust. This allows you to keep your images stored behind your firewall,
where they are safe. It also allows you to sign those images to ensure that
the images you deploy have not been altered in any way.
## Where to go next
* [Get started with UCP](install-sandbox.md)
* [UCP architecture](architecture.md)

249
plan-production-install.md
View File

@@ -1,249 +0,0 @@
<!--[metadata]>
+++
title = "Plan a production installation"
description = "Learn about the Docker Universal Control Plane architecture, and the requirements to install it on production."
keywords = ["docker, ucp, install, checklist"]
[menu.main]
parent="mn_ucp"
weight=-90
+++
<![end-metadata]-->
# Plan a production installation
This article gives you an overview of the Docker Universal Control Plane (UCP)
architecture and its components. Here you'll also find all the information
you need to plan a UCP installation on a production environment.
The following topics are covered:
* [UCP architecture](#ucp-architecture)
* [The UCP installation](#the-ucp-installation)
* [Understand your installation options](#understand-your-installation-options)
* [Installation checklist](#installation-checklist)
## UCP architecture
Docker UCP is a cluster with multiple nodes, each running the
Commercially Supported (CS) Docker Engine.
In this cluster, there are 3 different types of nodes:
* [UCP controller node](#UCP-controller-node): the node that handles user
requests,
* [UCP replica nodes](#ucp-replica-nodes): replicas of the controller node, for
high-availability,
* [UCP nodes](#ucp-nodes): the nodes that run your own containers.
![](images/ucp-architecture.png)
#### UCP controller node
This is the node that handles user requests to UCP. Users interact with UCP
using a web browser, or a CLI client.
Below is a list of the containers that are deployed to the controller node,
when running the `ucp install` command:
| Name | Description |
|:----------------------|:---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| `ucp-kv` | This container runs the key-value store used by UCP. Don't use this key-value store in your applications, since it's for internal use only. |
| `ucp-swarm-manager` | This Swarm manager uses the replicated KV store for leader election and cluster membership tracking. |
| `ucp-controller` | This container runs the UCP server, using the replicated KV store for configuration state. |
| `ucp-swarm-join` | Runs the `swarm join` command to periodically publish this node existence to the KV store. If the node goes down, this publishing stops, and the registration times out, and the node is automatically dropped from the cluster. |
| `ucp-proxy` | Runs a local TLS proxy for the docker socket to enable secure access of the local docker daemon. |
| `ucp-cluster-root-ca` | Run the Swarm CA used for admin certificate bundles, and adding new nodes. |
| `ucp-client-root-ca` | Run the (optional) UCP CA used for signing user bundles. |
#### UCP replica nodes
Docker UCP has support for high availability. You can configure replica nodes
for:
* Load-balancing user requests across the controller and replica nodes,
* Maintain a copy of the system configuration, in case the controller fails.
A cluster with N controller and replica nodes can only tolerate (N-1)/2 node
failures. So be sure to set up at least two replicas, when installing UCP for
production.
Below is a list of the containers that are deployed to the replica node,
when running the `ucp join --replica` command:
| Name | Description |
|:--------------------|:---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| `ucp-kv` | This container runs the key-value store used by UCP. Don't use this key-value store in your applications, since it's for internal use only. |
| `ucp-swarm-manager` | This Swarm manager uses the replicated KV store for leader election and cluster membership tracking. |
| `ucp-controller` | This container runs the UCP server, using the replicated KV store for configuration state. |
| `ucp-swarm-join` | Runs the `swarm join` command to periodically publish this node existence to the KV store. If the node goes down, this publishing stops, and the registration times out, and the node is automatically dropped from the cluster. |
| `ucp-proxy` | Runs a local TLS proxy for the docker socket to enable secure access of the local docker daemon. |
In UCP v1.0 the controller serves as root CA, and no other nodes are able to
sign certificates. If the controller fails, it might not be possible to add new
nodes to the cluster. [Learn more about high availability](understand_ha.md)
#### UCP nodes
These are the nodes that run your own containers. When you deploy
your containers using UCP, it spreads the load across these nodes. You can
configure the strategies used by UCP to deploy the containers across multiple
nodes.
Below is a list of the containers that are deployed to the node,
when running the `ucp join` command:
| Name | Description |
|:-----------------|:---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| `ucp-swarm-join` | Runs the `swarm join` command to periodically publish this node existence to the KV store. If the node goes down, this publishing stops, and the registration times out, and the node is automatically dropped from the cluster. |
| `ucp-proxy` | Runs a local TLS proxy for the docker socket to enable secure access of the local docker daemon. |
## The UCP installation
The UCP installation consists of using the Docker Engine CLI to run the `ucp`
tool. The `ucp` tool is a Docker image that can run subcommands like `install`
to install UCP on a node, or `join` to join a node to a UCP cluster.
The general format of these commands is:
| Docker client | run command with options | ucp image | Subcommand with options |
|:--------------|:-------------------------|:-------------|:------------------------|
| `docker` | `run --rm -it` | `docker/ucp` | `install --help` |
| `docker` | `run --rm -it` | `docker/ucp` | `join --help` |
| `docker` | `run --rm -it` | `docker/ucp` | `uninstall --help` |
You can use the `ucp` tool interactively, by passing them the `-i` option, or
non-interactively, by passing command-line options.
To list all the possible subcommands for the `ucp` tool, use:
$ docker run --rm -it docker/ucp --help
You can also find more information about the `ucp` command at the
[UCP tool reference page](reference/index.md).
The `ucp` tool pulls several images from Docker Hub, and runs them in
containers. The only change the `ucp` tool makes to your system, is
creating certificates under the
[data volumes you create when installing](#data-volumes-used).
## Understand your installation options
The best way to test-drive UCP is to install and run it on a sandbox.
The default options of the `ucp install` command, make it easy to test UCP.
[Learn how to install UCP on your local machine](evaluation-install.md).
When installing UCP for production, you'll want to ensure your installation
scales and is secure. You'll need to:
* Set up UCP for high availability,
* Customize some of the ports used,
* Customize the data volumes used,
* Use your own certificates.
[Learn how to install UCP in production](production-install.md).
## Installation checklist
Before installing UCP, make sure you have the following requirements:
* [Hardware and sofware requirements](#hardware-and-software-requirements)
* [Ports used](#ports-used)
* [IP addresses and fully-qualified domain names](#ip-addresses-and-fully-qualified-domain-names)
* [Subject alternative names (SANs)](#subject-alternative-names-sans)
* [Data volumes used](#data-volumes-used)
### Hardware and software requirements
You can install UCP on-premises or on a cloud provider such AWS or Digital
Ocean. To install UCP, all nodes must have:
* 1.50 GB of RAM
* 3.00 GB of available disk space
* One of the supported operating systems installed:
* RHEL 7.0, 7.1
* Ubuntu 14.04 LTS
* CentOS 7.1
* Kernel version 3.10 or higher
* CS Docker Engine installed
If the `ucp` tool detects that your system doesn't have these
requirements, it displays a warning message.
### Ports used
The following ports are using on UCP installation:
| Hosts | Direction | Port | Purpose |
|:----------------------------|:---------:|:--------------------|:------------------------------------------------------------|
| controller, replicas | in | 443 (configurable) | Web app and CLI client access to UCP. |
| controller, replicas | in | 2376 (configurable) | Swarm manager accepts requests from UCP controller. |
| controller, replicas, nodes | in | 2375 | Heartbeat for nodes, to ensure they are running. |
| controller, replicas, nodes | in | 12376 | Proxy for TLS, provides access to UCP, Swarm, and Engine. |
| controller, replicas | in | 12379 | Internal node configuration, cluster configuration, and HA. |
| controller, replicas | in | 12380 | Internal node configuration, cluster configuration, and HA. |
| controller | in | 12381 | Proxy for TLS, provides access to UCP. |
| controller | in | 12382 | Manages TLS and requests from swarm manager. |
| controller, replicas | out | 443 | Send anonymous usage reports to Docker. |
UCP collects anonymous usage metrics, to help us improve it.
These metrics are entirely anonymous, don't identify your company, users,
applications, or any other sensitive information.
You can disable this at any time on the UCP settings screen.
### IP addresses and fully-qualified domain names
The `ucp install` command tries to use your network configurations to find
the fully-qualified domain names (FQDN) of your hosts.
If you haven't set up your network with FQDNs, the installer might not be able
to find the FQDN for the host. If that happens, you'll be prompted for an
accessible host address. You can also use the `--host-address` option to
specify the FQDN to the install command.
If you're installing UCP on a cloud provider such as AWS or Digital Ocean,
you might need to create a private network for you UCP installation. In that
case, make sure all nodes of the cluster can communicate using their private
IPs.
### Subject alternative names (SANs)
All the communication between the nodes is protected by mutual TLS. The UCP
installation configures TLS for you automatically.
For that, UCP requires that all clients, including the Docker Engine, use a
Swarm TLS certificate chain signed by the UCP Swarm Root CA. You provide the
certificate system with subject alternative names or SANs. The SANs are used to
set up individual "leaf certificates."
When using the `ucp install` or `ucp join` commands interactively, you are
prompted for the subject alternative names of the host. This can be a public
IP address, or fully-qualified domain name.
You can also send the `--san` option to specify the SANs for a host.
### Data volumes used
UCP uses named volumes for persistence of data. When installing UCP for
production, you need to create the following volumes:
| Volume name | Data |
|:----------------------------|:---------------------------------------------------------------------------------------------------------------|
| ucp-client-root-ca | The certificate and key for the UCP root CA. Do not create this volume if you are using your own certificates. |
| ucp-cluster-root-ca | The certificate and key for the Swarm root CA. |
| ucp-controller-server-certs | The controller certificates for the UCP controllers web server. |
| ucp-node-certs | The Swarm certificates for the current node (repeated on every node in the cluster). |
| ucp-kv-certs | The Swarm KV client certificates for the current node (repeated on every node in the cluster). |
| ucp-controller-client-certs | The UCP Controller Swarm client certificates for the current node. |
| ucp-kv | Key value store persistence. |
If you don't create these volumes, the `ucp install` command creates them for
you with the default volume driver and flags.
## Where to go next
* [Test-drive Docker UCP by installing it on a sandbox](evaluation-install.md)
* [Install Docker UCP on production](production-install.md)

6
reference/index.md
View File

@@ -1,12 +1,14 @@
<!--[metadata]>
+++
title = "UCP tool reference"
keywords= ["tool, reference, ucp"]
description = "Run UCP commands"
[menu.main]
identifier = "ucp_ref"
parent = "mn_ucp"
weight=90
parent = "mn_ucp_installation"
weight=100
+++
<![end-metadata]-->
# ucp tool Reference

6
release_notes.md
View File

@@ -6,7 +6,7 @@ keywords = ["Docker, UCP", "Release notes", "Versions"]
[menu.main]
identifier="ucp_rnotes"
parent="mn_ucp"
weight="99"
weight=110
+++
<![end-metadata]-->
@@ -133,5 +133,5 @@ use `ucp uninstall` command from version 1.0:
docker run --rm -it --name ucp -v /var/run/docker.sock:/var/run/docker.sock docker/ucp:1.0.0 uninstall -i
After uninstalling, you can [Install UCP for evaluation](evaluation-install.md),
or [Install UCP for production](production-install.md).
After uninstalling, you can [Install UCP on a sandbox](install-sandbox.md),
or [Install UCP for production](installation/install-production.md).

2
support.md
View File

@@ -5,7 +5,7 @@ description="Your Docker subscription gives you access to prioritized support. Y
keywords = ["Docker, support", "help"]
[menu.main]
parent="mn_ucp"
weight="92"
weight=100
+++
<![end-metadata]-->

11
user-management/index.md Normal file
View File

@@ -0,0 +1,11 @@
<!--[metadata]>
+++
title = "User management"
description = "Learn how to manage user permissions on Docker Universal Control Plane."
keywords = ["docker, ucp, management, security, users"]
[menu.main]
identifier="mn_ucp_user_management"
parent="mn_ucp"
weight=70
+++
<![end-metadata]-->

19
manage/monitor-manage-users.md → user-management/manage-users.md
View File

@@ -1,10 +1,11 @@
<!--[metadata]>
+++
aliases = [ "ucp/manage/monitor-manage-users/"]
title = "Manage and authorize users"
description = "Manage and authorize users"
keywords = ["authorize, authentication, users, teams, UCP, Docker, objects"]
[menu.main]
parent="mn_manage_ucp"
parent="mn_ucp_user_management"
+++
<![end-metadata]-->
@@ -17,7 +18,7 @@ and create permissions within UCP. On this page, you learn to do both. You also
learn about the features and systems of UCP that support user management and
authorization.
## Understand user authorization in UCP
## Understand user authorization
Users in UCP have two levels of authorization. They may have authorization to
manage UCP and they have authorization to access the Docker objects and
@@ -38,12 +39,12 @@ container object, is possible through the use of teams.
The possible permissions are:
| Type | Description |
|--------------------|--------------------------------------------------------------------------------------------------------------|
| No Access | Cannot access any resources. |
| Type | Description |
|:-------------------|:----------------------------------------------------------------------------------------------------------|
| No Access | Cannot access any resources. |
| View Only | Can view resources. This role grants the ability to view a container but not restart, kill, or remove it. |
| Restricted Control | Can edit resources. This role grants the ability to create, restart, kill, and remove containers. |
| Full Control | Can do anything possible to resources. This role grants full rights to all actions on containers. |
| Full Control | Can do anything possible to resources. This role grants full rights to all actions on containers. |
For containers only, you can extend the default access permissions with more
granular, role-based permissions. Docker Engine allows container creators to
@@ -66,7 +67,7 @@ interactions on the command line via the client bundle.
standard SSH and addressing the Swarm cluster directly. For this reason, You
must be sure to secure network access to a cluster's nodes.
## Understand Restricted Control
## Understand restricted control
Containers run as services on your network. Without proper knowledge, users can
launch a container with an insecure configuration. To reduce the risk of this
@@ -79,7 +80,7 @@ container. These users are can not `docker exec` into a container. Additionally,
options:
| Prevented Option | Description |
|----------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|:---------------------|:--------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| `--privileged` | A “privileged” container is given access to all devices. |
| `--cap-add` | The ability to expand the kernel-level capabilities a user or process has in a container. |
| host mounted volumes | Mount a volume from the host where the container is running. |
@@ -88,7 +89,7 @@ options:
Users that attempt to create containers with these options receive an error message.
## Creating users through UCP
## Creating users on UCP
UCP offers two ways to create user accounts. You can manually create accounts
one-at-a-time or you can import users as a group into a team via UCP's LDAP