While Docker has enabled an unprecedented velocity of software production, it is all too easy to spin out of control. A promotion-based model is required to control and track the flow of Docker images as much as it is required for a traditional software development lifecycle. New tools often introduce new paradigms. We will examine the patterns and the anti-patterns for Docker image management, and what impact the new tools have on the battle-proven paradigms of the software development lifecycle. This talk takes it from the point that everybody already understand the need in the CI/CD pipeline and some of the basic techniques are taken for granted. It’s much more about tools, processes and automation.

2. whoami
• Yoav Landman
• Co-founder & CTO at JFrog
• @_yoav_

3. JFrog Xray

4. JFrog + Docker

5. Poll Time!

6. Poll Time!
Can do the tutorial
PoCing, playing etc.
Production, baby!

10. Who’s using Docker and nothing
else?

13. The Promotion Pyramid
Development builds
Dev Integration tests
Integr. tests
Staging
Pre-Prod
Prod
Frequency of builds
Build/Deploytime
Numberofbinaries

14. Pipeline: Quality Gates and
Visibility
Source: Agile ALM, Michael Hüttermann, Manning Publications Co.

15. $docker build

17. Simple!

19. This is why

20. Let’s fix it!

21. Let’s fix it (again)!

22. Let’s fix it (again)!

23. Docker content mistrust

26. What’s up with the gates?!

28. What’s up with the gates?!

29. What’s up with the gates?!
- QA shouldn’t test dev images

30. What’s up with the gates?!
- QA shouldn’t test dev images
- non-QA’ed images shouldn't be staged

31. What’s up with the gates?!
- QA shouldn’t test dev images
- non-QA’ed images shouldn't be staged
- non-QA’ed, non-staged or dev images
shouldn’t end up in production!

32. Not so fast…

33. Trumped-up limitations

34. The Anatomy of Docker Tag

35. Wait a second, how can I
have more than one
repository per host now?!

36. How can we support this?
https://host:8081/artifactory/docker-dev/busybox
https://host:8081/artifactory/docker-staging/busybox
https://host:8081/artifactory/docker-qa/busybox
https://host:8081/artifactory/docker-prod/busybox

37. “One registry per host is
ought to be enough for
anybody.”
https://www.reddit.com/r/theydidthemath/comments/1x37rx/
request_how_much_alcohol_is_needed_to_get_a_whale

38. Panic!

39. Virtual hosts/ports to the
rescue
https://host:8081/artifactory/docker-dev/busybox
Context name
Virtual repository name
Tag name
https://host:port/v2/busybox

40. server {
listen 5001;
server_name 192.168.99.100;
if ($http_x_forwarded_proto = '') {
set $http_x_forwarded_proto $scheme;
}
rewrite ^/(v1|v2)/(.*) /artifactory/api/docker/docker-dev/$1/$2;
…
}
}

41. But then you realize…
Wait a second, now I need
to pull, retag and push for
every step?!

43. Virtual Repositories
Local Repository
Virtual Repository
Remote Repository
Docker Hub

44. What We’ll DO?
- Minimize number of repositories docker interacts
with

45. What We’ll DO?
- Minimize number of repositories docker interacts
with
- deploy to virtual (backed by dev repository)

46. What We’ll DO?
- Minimize number of repositories docker interacts
with
- deploy to virtual (backed by dev repository)
- promote within artifactory

47. What We’ll DO?
- Minimize number of repositories docker interacts
with
- deploy to virtual (backed by dev repository)
- promote within artifactory
- Resolve from virtual (production-ready images)

48. Virtual Repositories FTW
docker-dev-local
docker-prod-local
docker-virtual
Dev
docker-hub-remote
Docker Hub
resolve
resolve
resolve
resolve
resolve

49. Virtual Repositories FTW
docker-dev-local
docker-prod-local
docker-virtual
Dev
docker-hub-remote
Docker Hub
resolve
resolve
resolve
resolve
resolve
deploy
deploy

50. Virtual Repositories FTW
docker-dev-local
docker-prod-local
docker-virtual
Dev
docker-hub-remote
Docker Hub
resolve
resolve
resolve
resolve
resolve
deploy
deploy
promote

51. Virtual Repositories FTW
docker-dev-local
docker-prod-local
docker-virtual
Dev
docker-hub-remote
Docker Hub
resolve
resolve
resolve
resolve
resolve
deploy
deploy
promote
Prod
resolve
resolve

52. Anatomy of a container

53. Our Layers
Application:
• .war file
Framework:
• JDK8 + Tomcat
Base:
• ubuntu-trusty

54. Framework build
- Verified base image
- Add system dependencies from
artifactory
- JDK
- Tomcat

55. Framework build
Own it!

56. Minimal Framework build
Dockerfile
FROM ubuntu:14.04
MAINTAINER you@yourorg.com

57. Application build
- Base==Framework image
- Run app build
- Add app files to base
- Done!

58. Application build Dockerfile
FROM yourorg-docker.jfrog.io/myorg/framework:latest
MAINTAINER you@yourorg.com
ADD https://yourorg.jfrog.io/java-release-local/…/app-[RELEASE].war
/var/lib/tomcat7/webapps/app.war

59. Application build Dockerfile
FROM yourorg-docker.jfrog.io/myorg/framework:latest
MAINTAINER you@yourorg.com
ADD https://yourorg.jfrog.io/java-release-local/…/app-[RELEASE].war
/var/lib/tomcat7/webapps/app.war

60. Application build Dockerfile
FROM yourorg-docker.jfrog.io/myorg/framework:latest
MAINTAINER you@yourorg.com
ADD https://yourorg.jfrog.io/java-release-local/…/app-[RELEASE].war
/var/lib/tomcat7/webapps/app.war

63. Framework Pipeline
Application Pipeline

64. Framework Pipeline
Application Pipeline

65. Framework Pipeline
Application Pipeline

68. Install it!
 Installing with Docker compose
 Great for micro services located on
same host

70. End users have Docker
installed
 Don’t want to run/install docker-
compose
 Or any other installer
 Docker compose and docker client can
introduce incompatibilities

71. The Solution
- Create An “Installer” Image
- Provide variables for:
- Where to pull from
- Docker Daemon to use
- Have it run docker compose
- Install onto Client’s Docker!

72. Installer Image

73. Installer’s run.sh
 Just run docker-compose with the right
command
 start, stop, up, down, restart…
 Check calling script version
compatibility!

74. app.sh (user
script)
Set the repo to pull from
Set up script and
application versions
Determine the docker daemon
for docker-compose to use
Run the installer image

75. The installer pattern
Docker pulls
and runs the
installer
image
app.sh
Executes
run.sh
installer image
Runs docker-
compose
run.sh
Pulls down
and installs
micro-
services
Docker daemon Docker registry
docker-compose

76. HIGH QUALITY
(software and information) SPEED LOW COST
(automation)
Fast releases > Modular > Automation
Conclusions: Release Fast or
Die!

77. Thank you!