Docker:
Multi-arch All
The Things
Phil Estes
IBM Cloud @estesp
Michael Friis
Docker, Inc. @friism
Agenda
● Docker Engine across Multiple
CPU and OS Platforms
● Container Images for Multiple
Platforms and Architectures
● Multi-Architecture Orchestration
linux/amd64
linux/arm64
linux/arm
linux/s390x
linux/ppc64le
windows/amd64
Multi-arch in action!
$ docker run golang go version
Go version go1.9.1 <os/arch>
$
* https://blog.docker.com/2017/09/docker-official-images-now-multi-platform/
Docker Platform Expansion
2014 2015 2016 2017
2013-14 Docker on x86_64
April 2015: Docker client
on Windows
June 2015: Docker
engine on Raspberry
Pi (ARMv5), z13 (s390x
mainframe), and
Power Systems
June 2016: Docker engine
in Windows 10 Preview
April 2017: Docker EE
official support for IBM
z/LinuxONE and Power
Systems
Go runtime porting to s390x,
ppc64le, improvements to
ARM/other embedded CPUs
2014-2015
Why do we care?
> Docker runs across many operating
environments/CPU architectures
> Portability and ease of use are core
Docker tenets
Goal: Building and running applications on
Docker should works the same anywhere!
Container Images for
Different Platforms
Containers != VMs
Containers:
● Do not virtualize hardware or kernel
○ Great for performance and density
○ But, stuck with host CPU/kernel
● Can’t “emulate” CPU arch capability**
○ Can’t run Windows containers on Linux host
○ or z/Linux containers on x86_64 Linux host
** caveat: qemu “binfmt” support on Linux
We must build multi-arch images
Docker Hub
nginx microsoft/iis
Manifest lists
Required: image type support
for per-platform images
● The Docker v2.2 image spec
met this requirement (Jan 2016)
● Included a new media type: “v2
manifest list”
A manifest list contains
platform segregated
references to single-platform
manifest entries
$ docker run mplatform/mquery golang
Image: golang
* Manifest List: Yes
* Supported platforms:
- amd64/linux
- arm/linux (variant: v7)
- arm64/linux (variant: v8)
- 386/linux
- ppc64le/linux
- s390x/linux
Image
Manifests
{
"schemaVersion": 2,
"mediaType": "application/vnd.docker.distribution.manifest.list.v2+json",
"manifests": [
{
"mediaType": "application/vnd.docker.distribution.manifest.v1+json",
"size": 2094,
"digest": "sha256:7820f9a86d4ad15a2c4f0c0e5479298df2aa7c2f6871288e2ef8546f3e7b6783",
"platform": {
"architecture": "ppc64le",
"os": "linux"
}
},
{
"mediaType": "application/vnd.docker.distribution.manifest.v1+json",
"size": 1922,
"digest": "sha256:ae1b0e06e8ade3a11267564a26e750585ba2259c0ecab59ab165ad1af41d1bdd",
"platform": {
"architecture": "amd64",
"os": "linux",
"features": [
"sse"
]
}
},
{
"mediaType": "application/vnd.docker.distribution.manifest.v1+json",
"size": 2084,
"digest": "sha256:e4c0df75810b953d6717b8f8f28298d73870e8aa2a0d5e77b8391f16fdfbbbe2",
"platform": {
"architecture": "s390x",
"os": "linux"
}
},
{
"mediaType": "application/vnd.docker.distribution.manifest.v1+json",
"size": 2084,
"digest": "sha256:07ebe243465ef4a667b78154ae6c3ea46fdb1582936aac3ac899ea311a701b40",
"platform": {
"architecture": "arm",
"os": "linux",
"variant": "armv7"
}
},
{
"mediaType": "application/vnd.docker.distribution.manifest.v1+json",
"size": 2090,
"digest": "sha256:fb2fc0707b86dafa9959fe3d29e66af8787aee4d9a23581714be65db4265ad8a",
"platform": {
"architecture": "arm64",
"os": "linux",
"variant": "armv8"
}
Index (Manifest List)
linux amd64
linux ppc64le
windows amd64
Manifests:
Manifest
linux arm64
Layers:
Config:
L0
L1
Ln
Root Filesystem
/usr
/bin
/dev
/etc
/home
/lib
C
OCI Runtime Spec
process
args
env
cwd
…
root
mounts
Status of multi-arch images
Official Docker images
Microsoft .NET Core
LinuxKit
Lots of ARM projects
DEMO: Build multi-arch images
Dockerfile maintenance
Same OS = probably same (or very
similar) Dockerfile
Different OS = probably different
Dockerfiles
FROM microsoft/nanoserver:10.0.14393.1770
RUN Invoke-WebRequest $Env:DOWNLOAD_URL -OutFile dotnet.zip;
Expand-Archive dotnet.zip -DestinationPath
$Env:ProgramFilesdotnet;
Remove-Item -Force dotnet.zip
RUN setx /M PATH $($Env:PATH + ';' + $Env:ProgramFiles + 'dotnet')
FROM microsoft/dotnet:2.0-runtime-deps-jessie
RUN apt-get update 
&& apt-get install -y --no-install-recommends 
curl 
&& rm -rf /var/lib/apt/lists/*
RUN curl -SL $DOWNLOAD_URL --output dotnet.tar.gz 
&& echo "$DOWNLOAD_SHA dotnet.tar.gz" | sha512sum -c - 
&& mkdir -p /usr/share/dotnet 
&& tar -zxf dotnet.tar.gz -C /usr/share/dotnet 
&& rm dotnet.tar.gz 
&& ln -s /usr/share/dotnet/dotnet /usr/bin/dotnet
Multiplatform CI Setup
git push
Container
Registry
Run Unit Tests
Build App
docker image build
Credit: Stefan Scherer
docker image push
docker manifest push
docker image push
Multi-architecture
Orchestration
Multiplatform Orchestration
> Requires arch-aware
orchestrator
● Images can continue to be CPU and/or OS
specific (for example: Windows or Linux-only
software; software not ported to multi-CPU)
● Even if images are multi-platform you may
choose to run particular workloads on
certain hardware/OS platforms
Image registry
Windows
Linux
x86_64
Linux
s390x
Multi-arch: Swarm support
> Placement Engine
● Reads manifest list’s platform
entries
● Matches engine nodes with
platforms supported
> Docker Compose
● Can specify manual
constraints in YAML
"Placement": {
"Constraints": [
"node.platform.arch == s390x"
],
"Platforms": [
{
"Architecture": "amd64",
"OS": "linux"
},
{
"Architecture": "arm",
"OS": "linux"
},
{
"Architecture": "arm64",
"OS": "linux"
},
{
"Architecture": "ppc64le",
"OS": "linux"
},
docker service inspect
DEMO: Orchestration
Docker
Enterprise
Edition
Conclusion
Take-aways
Container images are specific to the OS and
CPU they’re built on
Maintain Docker images? Making them
multi-arch takes effort (but it’s worth it)
Docker EE supports Linux, Windows, IBM Z and
Power with one pane of glass
Thanks!
Phil Estes
IBM Cloud @estesp
Michael Friis
Docker, Inc. @friism
Docker EE
Hosted Demo
Add picture
here
docker.com/trial
● Free 4 Hour Demo
● No Servers Required
● Full Docker EE
Cluster Access

Docker Multi-arch All The Things

  • 1.
    Docker: Multi-arch All The Things PhilEstes IBM Cloud @estesp Michael Friis Docker, Inc. @friism
  • 2.
    Agenda ● Docker Engineacross Multiple CPU and OS Platforms ● Container Images for Multiple Platforms and Architectures ● Multi-Architecture Orchestration linux/amd64 linux/arm64 linux/arm linux/s390x linux/ppc64le windows/amd64
  • 3.
    Multi-arch in action! $docker run golang go version Go version go1.9.1 <os/arch> $ * https://blog.docker.com/2017/09/docker-official-images-now-multi-platform/
  • 4.
    Docker Platform Expansion 20142015 2016 2017 2013-14 Docker on x86_64 April 2015: Docker client on Windows June 2015: Docker engine on Raspberry Pi (ARMv5), z13 (s390x mainframe), and Power Systems June 2016: Docker engine in Windows 10 Preview April 2017: Docker EE official support for IBM z/LinuxONE and Power Systems Go runtime porting to s390x, ppc64le, improvements to ARM/other embedded CPUs 2014-2015
  • 5.
    Why do wecare? > Docker runs across many operating environments/CPU architectures > Portability and ease of use are core Docker tenets Goal: Building and running applications on Docker should works the same anywhere!
  • 6.
  • 7.
    Containers != VMs Containers: ●Do not virtualize hardware or kernel ○ Great for performance and density ○ But, stuck with host CPU/kernel ● Can’t “emulate” CPU arch capability** ○ Can’t run Windows containers on Linux host ○ or z/Linux containers on x86_64 Linux host ** caveat: qemu “binfmt” support on Linux We must build multi-arch images Docker Hub nginx microsoft/iis
  • 8.
    Manifest lists Required: imagetype support for per-platform images ● The Docker v2.2 image spec met this requirement (Jan 2016) ● Included a new media type: “v2 manifest list” A manifest list contains platform segregated references to single-platform manifest entries $ docker run mplatform/mquery golang Image: golang * Manifest List: Yes * Supported platforms: - amd64/linux - arm/linux (variant: v7) - arm64/linux (variant: v8) - 386/linux - ppc64le/linux - s390x/linux
  • 9.
    Image Manifests { "schemaVersion": 2, "mediaType": "application/vnd.docker.distribution.manifest.list.v2+json", "manifests":[ { "mediaType": "application/vnd.docker.distribution.manifest.v1+json", "size": 2094, "digest": "sha256:7820f9a86d4ad15a2c4f0c0e5479298df2aa7c2f6871288e2ef8546f3e7b6783", "platform": { "architecture": "ppc64le", "os": "linux" } }, { "mediaType": "application/vnd.docker.distribution.manifest.v1+json", "size": 1922, "digest": "sha256:ae1b0e06e8ade3a11267564a26e750585ba2259c0ecab59ab165ad1af41d1bdd", "platform": { "architecture": "amd64", "os": "linux", "features": [ "sse" ] } }, { "mediaType": "application/vnd.docker.distribution.manifest.v1+json", "size": 2084, "digest": "sha256:e4c0df75810b953d6717b8f8f28298d73870e8aa2a0d5e77b8391f16fdfbbbe2", "platform": { "architecture": "s390x", "os": "linux" } }, { "mediaType": "application/vnd.docker.distribution.manifest.v1+json", "size": 2084, "digest": "sha256:07ebe243465ef4a667b78154ae6c3ea46fdb1582936aac3ac899ea311a701b40", "platform": { "architecture": "arm", "os": "linux", "variant": "armv7" } }, { "mediaType": "application/vnd.docker.distribution.manifest.v1+json", "size": 2090, "digest": "sha256:fb2fc0707b86dafa9959fe3d29e66af8787aee4d9a23581714be65db4265ad8a", "platform": { "architecture": "arm64", "os": "linux", "variant": "armv8" } Index (Manifest List) linux amd64 linux ppc64le windows amd64 Manifests: Manifest linux arm64 Layers: Config: L0 L1 Ln Root Filesystem /usr /bin /dev /etc /home /lib C OCI Runtime Spec process args env cwd … root mounts
  • 10.
    Status of multi-archimages Official Docker images Microsoft .NET Core LinuxKit Lots of ARM projects
  • 11.
  • 12.
    Dockerfile maintenance Same OS= probably same (or very similar) Dockerfile Different OS = probably different Dockerfiles
  • 13.
    FROM microsoft/nanoserver:10.0.14393.1770 RUN Invoke-WebRequest$Env:DOWNLOAD_URL -OutFile dotnet.zip; Expand-Archive dotnet.zip -DestinationPath $Env:ProgramFilesdotnet; Remove-Item -Force dotnet.zip RUN setx /M PATH $($Env:PATH + ';' + $Env:ProgramFiles + 'dotnet') FROM microsoft/dotnet:2.0-runtime-deps-jessie RUN apt-get update && apt-get install -y --no-install-recommends curl && rm -rf /var/lib/apt/lists/* RUN curl -SL $DOWNLOAD_URL --output dotnet.tar.gz && echo "$DOWNLOAD_SHA dotnet.tar.gz" | sha512sum -c - && mkdir -p /usr/share/dotnet && tar -zxf dotnet.tar.gz -C /usr/share/dotnet && rm dotnet.tar.gz && ln -s /usr/share/dotnet/dotnet /usr/bin/dotnet
  • 14.
    Multiplatform CI Setup gitpush Container Registry Run Unit Tests Build App docker image build Credit: Stefan Scherer docker image push docker manifest push docker image push
  • 15.
  • 16.
    Multiplatform Orchestration > Requiresarch-aware orchestrator ● Images can continue to be CPU and/or OS specific (for example: Windows or Linux-only software; software not ported to multi-CPU) ● Even if images are multi-platform you may choose to run particular workloads on certain hardware/OS platforms Image registry Windows Linux x86_64 Linux s390x
  • 17.
    Multi-arch: Swarm support >Placement Engine ● Reads manifest list’s platform entries ● Matches engine nodes with platforms supported > Docker Compose ● Can specify manual constraints in YAML "Placement": { "Constraints": [ "node.platform.arch == s390x" ], "Platforms": [ { "Architecture": "amd64", "OS": "linux" }, { "Architecture": "arm", "OS": "linux" }, { "Architecture": "arm64", "OS": "linux" }, { "Architecture": "ppc64le", "OS": "linux" }, docker service inspect
  • 18.
  • 19.
  • 20.
    Take-aways Container images arespecific to the OS and CPU they’re built on Maintain Docker images? Making them multi-arch takes effort (but it’s worth it) Docker EE supports Linux, Windows, IBM Z and Power with one pane of glass
  • 21.
    Thanks! Phil Estes IBM Cloud@estesp Michael Friis Docker, Inc. @friism
  • 22.
    Docker EE Hosted Demo Addpicture here docker.com/trial ● Free 4 Hour Demo ● No Servers Required ● Full Docker EE Cluster Access