DockerCon EU 2015

This talk is inspired by the series of blog posts Jessie wrote. This talk will cover running tor relays in containers, routing all traffic through tor in a container, running a tor socks proxy in a container, and lastly running a Docker native networking plugin to route all container traffic through tor.

Many companies use expensive proprietary hardware and software to provide load-balancing and routing for their users and services. I'm going to demonstrate how the same or even exceeding performance and feature set can be achieved using an open-source technology which has been a part of the mainline Linux kernel for over a decade – IPVS. Specifically, you'll see how IPVS can be used to automatically configure load balancing and routing for Docker containers using a simple Go daemon and a Docker plugin.

Linux containers are different from Solaris Zones or BSD Jails: they use discrete kernel features like cgroups, namespaces, SELinux, and more. We will describe those mechanisms in depth, as well as demo how to put them together to produce a container. We will also highlight how different container runtimes compare to each other. 

How Docker is used at Gilt: At Gilt we use Docker primarily as a unit of immutability and to allow a standard way of deploying all kinds of software as opposed to its container properties. 

Why Gilt built Ionroller: An overview of the problems we tried to solve with Ionroller and immutable deploys. Pitfalls we've encountered with immutable deployments since Ionroller saw adoption in Gilt. Will cover issues such as DNS traffic migration, utilisation of resources ELBs not warmed up properly, Elasticbeanstalk using Nginx as proxy etc. Our experiences with Cloudformation and Codedeploy as an alternative to Ionroller and Elasticbeanstalk. 

Jobs: How we used to do batch jobs. Solutions we considered such as Mesos and Chronos. An overview of Sundial, an in house solution we built in the last few months and hope to open source for running containerized Docker jobs on Amazon ECS and why we chose it as our preferred solution. 

 In this talk I will briefly show why you might want to live migrate a container, why you might want to avoid doing this and what can be done instead. The main topic of the talk would to demonstrate why live migrating a container is more complex than live migrating a virtual machines and what can be done with this complexity. 

John’s presentation will cover his lessons learned from running Docker in Production @ SalesforceIQ. Learn how to scale your registry using AWS and S3. Should you use Device Mapper or AUFS? Why run Swarm, Mesos, Kubernetes, or neither. Finally, know how persistent storage (Kafka, Cassandra, or SQL) can be run successfully with Docker in Production

His team focuses on Docker based solutions to power their SaaS infrastructure and developer operations.

In this session, you will learn everything you need to know about docker security best practices. We will cover how to write clean Dockerfiles and trim down on your base images. We will go over the runtime security settings you can and should apply to your running containers, go over a few examples around monitoring and incident respo nse and will end up demoing image signing and verification in Docker.

This is a no-slides session, and the console will be the only thing up on the screen.

Porting Docker for Windows is no small feat.  The technology behind Docker today takes advantage of Linux capabilities like namespaces and cgroups.  For native containers to exist on Windows and to have a Docker Engine for Windows, first similar primitives needed to be developed into the Windows operating system.  In this session we will explain these Windows primitives in relation to similar primitives in Linux and other architectural changes on the OS and Engine side to make containerization possible.  The process of porting includes not only the technology but also open source community interactions and cultural changes to enable this development.  And of course there will be a cool demo…

Running a container app in the container is easy, attaching a custom app to a running container is a bit trickier. But, what if I wanted to run any arbitrary binary in any arbitrary running container? Common wisdom says it's impossible. Is it ? This talk dives into containers internals, just above the kernel surface and demonstrates that this is, indeed possible. With a bit of C magic and ptrace.