Quickstart containers Understand the architecture

Installation on Mac OS X Installation on Windows

Installation on Ubuntu Installation on Red Hat Enterprise Linux Installation on CentOS Installation on Fedora Installation on Debian Installation on Arch Linux Installation on CRUX Linux Installation on FrugalWare Installation on Gentoo Installation on Oracle Linux Installation on openSUSE and SUSE Linux Enterprise

Choose how to install Example: Manual install on cloud provider Example: Use Docker Machine to provision cloud hosts

Installation from binaries

Introduction

Hello world in a container Run a simple application Build your own images Network containers Manage data in containers Store images on Docker Hub

Best practices for writing Dockerfiles Create a base image Image management

Understand images, containers, and storage drivers Select a storage driver AUFS storage driver in practice Btrfs storage in practice Device mapper storage in practice OverlayFS storage in practice ZFS storage in practice

Docker container networking Work with network commands Get started with multi-host networking Configure container DNS in user-defined networks Default bridge network

Apply custom metadata

Automatically start containers Control and configure Docker with systemd PowerShell DSC Usage Process management with CFEngine Using Chef Using Puppet Using Supervisor with Docker Configuring and running Docker Runtime metrics Link via an ambassador container

Configuring Logging Drivers Amazon CloudWatch Logs logging driver Log tags for logging driver Fluentd logging driver Splunk logging driver journald logging driver

Run a local registry mirror

Docker security Protect the Docker daemon socket Using certificates for repository client verification

Content trust in Docker Automation with content trust Deploying Notary Manage keys for content trust Play in a content trust sandbox

AppArmor security profiles for Docker Seccomp security profiles for Docker

Access authorization plugin Extending Engine with plugins Docker network driver plugins Volume plugins Plugins API

Dockerizing MongoDB Dockerizing PostgreSQL Dockerizing a CouchDB service Dockerizing a Couchbase service Dockerizing a Node.js web app Dockerizing a Redis service Dockerizing a Riak service Dockerizing an SSH service Dockerizing an apt-cacher-ng service

Dockerfile reference Docker run reference

Use the Docker command line daemon attach build commit cp create diff events exec export history images import info inspect kill load login logout logs network connect network create network disconnect network inspect network ls network rm pause port ps pull push rename restart rm rmi run save search start stats stop tag top unpause update version volume create volume inspect volume ls volume rm wait

Remote API Remote API v1.22 Remote API v1.21 Remote API v1.20 Remote API v1.19 Remote API v1.18 Remote API v1.17 Remote API v1.16 Remote API v1.15 Remote API v1.14 Remote API client libraries docker.io accounts API

Migrate to Engine 1.10 Breaking changes Deprecated Engine Features FAQ

Swarm Overview How to get Swarm Evaluate Swarm in a sandbox Plan for Swarm in production Build a Swarm cluster for production

Learn the application architecture Deploy network infrastructure Setup cluster resources Deploy the application Troubleshoot the application

High availability in Swarm Swarm and container networks Discovery Provision with Machine

Filters Strategies

Overview Docker Swarm with TLS Configure Docker Swarm for TLS

create help join list manage swarm

Docker Swarm API

Overview of Docker Compose Install Compose Getting Started Using Compose with Swarm Quickstart: Compose and Django Quickstart: Compose and Rails Quickstart: Compose and WordPress Extending Services in Compose Networking in Compose Using Compose in Production Compose File Reference

Overview of docker-compose CLI CLI Environment Variables build config create down events help kill logs pause port ps pull restart rm run scale start stop unpause up

Command-line Completion Link Environment Variables Controlling startup order Frequently Asked Questions

Introducing Docker Hub Your Docker Hub account Teams & Organizations Repositories on Docker Hub Automated Builds Webhooks for automated builds Automated Builds with Bitbucket Automated Builds from GitHub Official Repositories on Docker Hub

Overview Trusted Registry

Install Docker Subscription for AWS (BYOL)) Install Docker Engine for AWS AMI (BDS) Install Trusted Registry for AWS AMI (BDS) Install on Microsoft Azure Install the Trusted Registry offline Manually Install the CS Docker Engine Manually install Trusted Registry Upgrade Trusted Registry and the CS Engine

Configuration overview Configure general settings Security configuration Storage configuration Auth configuration

Quick-start: Basic Workflow User guide Admin tasks Account and repository management Remove an image and garbage collection Trusted Registry License Support

Overview v1.3.3 API v1.4.0 API

Trusted Registry release notes Prior Trusted Registry release notes CS Engine release notes Prior CS Engine release notes

Release Notes

Introducing Docker Cloud Link to a Cloud Service Provider Link your Amazon Web Services account Link your DigitalOcean account Link your Microsoft Azure account Link your Packet account Link your SoftLayer account Set up self-hosted nodes Deploy your first node Deploy your first service

Learn about Dockerfiles and Docker Cloud Back up data volumes Create a proxy or load balancer Install the Deploy to Docker Cloud button Integrate with Slack Push images to Docker Cloud SSHing into a Docker Cloud-managed node Upgrade Docker Engine on a node Use the Docker Cloud Agent Using the Docker Cloud CLI

Introduction to deploying a Golang app Set up Prepare the app Push a Docker image to Docker Cloud's Registry Deploy the app as a Docker Cloud service Define environment variables Scale the service View logs Load-balance the service Provision a data backend for your service

Deploy a Python app Set up Python application Prepare the Python application Push an image to Docker Cloud's Registry Deploy the app as a Docker Cloud service Define environment variables Scale the service View logs Load-balance a Python service Provision a data backend for a Python service Data management with Volumes Python service stacks

Autodestroy Automated build Automated repository tests Automatic Container Restart Autoredeploy Deployment tags Manage service stacks Publish and expose service or container ports Redeploy running services Schedule a deployment Service API Roles Service discovery Spawn new containers Stack YAML reference Use triggers Work with data volumes

Known Issues in Docker Cloud Using Docker Cloud and Packet.net Using Docker Cloud on AWS

API reference

Machine Overview Install Machine Get started with a local VM Provision hosts in the cloud

Provision Digital Ocean Droplets Provision AWS EC2 Instances

Machine concepts and help Migrate from Boot2Docker to Machine

active config create env help inspect ip kill ls provision regenerate-certs restart rm scp ssh start status stop upgrade url

Driver options and operating system defaults Amazon Web Services Digital Ocean Generic Google Compute Engine IBM Softlayer Microsoft Azure Microsoft Hyper-V OpenStack Oracle VirtualBox Rackspace VMware Fusion VMware vCloud Air VMware vSphere exoscale

Command-line Completion

Docker Universal Control Plane Evaluation installation Plan a production installation Install UCP for production Upgrade UCP Deploy an application Integrate with Trusted Registry Set up container networking Set up high availability UCP Key/Value Store Backends

Monitor and troubleshoot UCP Manage and authorize users

dump-certs engine-discovery fingerprint help images install join uninstall upgrade

Get support Release Notes

Toolbox Overview

Kitematic User Guide: Intro & Overview Set up an Nginx web server Set up a Minecraft Server Creating a Local RethinkDB Database for Development Frequently Asked Questions Known Issues

Registry Overview Understanding the Registry Deploying a registry server Configuring a registry Working with notifications Recipes

HTTP API V2 Storage Drivers Token Authentication Implementation Token Authentication Specification

Getting help

Getting started with Notary Use the Notary client Understand the service architecture Running a Notary service

Server Configuration Signer Configuration Client Configuration Common Server and Signer Configurations

Notary Changelog

Quickstart contribution

README first Get the required software Set up for development on Windows Configure Git for contributing Work with a development container Run tests and test documentation

Understand how to contribute Find and claim an issue Work on your issue Create a pull request (PR) Participate in the PR review Advanced contributing Coding style checklist

Organize a Docker Meetup Organize our issues Support the community Testing contributions

Get started Find an issue Set up for Kitematic development Develop in Kitematic (work on an issue) Create a pull request (PR) Where to learn more

Docker Governance Advisory Board Board member profiles Code of conduct

FAQ for contributors Where to chat or get help Style guide for Docker documentation

Docker Release Notes Docker Glossary

Version 1.9 Version 1.8 Version 1.7 Version 1.6 Version 1.5 Version 1.4

Plan a production installation

This article gives you an overview of the Docker Universal Control Plane (UCP) architecture and its components. Here you’ll also find all the information you need to plan a UCP installation on a production environment.

The following topics are covered:

UCP architecture
The UCP installation
Understand your installation options
Installation checklist

UCP architecture

Docker UCP is a cluster with multiple nodes, each running the Commercially Supported (CS) Docker Engine. In this cluster, there are 3 different types of nodes:

UCP controller node: the node that handles user requests,
UCP replica nodes: replicas of the controller node, for high-availability,
UCP nodes: the nodes that run your own containers.

UCP controller node

This is the node that handles user requests to UCP. Users interact with UCP using a web browser, or a CLI client.

Below is a list of the containers that are deployed to the controller node, when running the ucp install command:

Name	Description
`ucp-kv`	This container runs the key-value store used by UCP. Don’t use this key-value store in your applications, since it’s for internal use only.
`ucp-swarm-manager`	This Swarm manager uses the replicated KV store for leader election and cluster membership tracking.
`ucp-controller`	This container runs the UCP server, using the replicated KV store for configuration state.
`ucp-swarm-join`	Runs the `swarm join` command to periodically publish this node existence to the KV store. If the node goes down, this publishing stops, and the registration times out, and the node is automatically dropped from the cluster.
`ucp-proxy`	Runs a local TLS proxy for the docker socket to enable secure access of the local docker daemon.
`ucp-cluster-root-ca`	Run the Swarm CA used for admin certificate bundles, and adding new nodes.
`ucp-client-root-ca`	Run the (optional) UCP CA used for signing user bundles.

UCP replica nodes

Docker UCP has support for high availability. You can configure replica nodes for:

Load-balancing user requests across the controller and replica nodes,
Maintain a copy of the system configuration, in case the controller fails.

A cluster with N controller and replica nodes can only tolerate (N-1)/2 node failures. So be sure to set up at least two replicas, when installing UCP for production.

Below is a list of the containers that are deployed to the controller node, when running the ucp join --replica command:

Name	Description
`ucp-kv`	This container runs the key-value store used by UCP. Don’t use this key-value store in your applications, since it’s for internal use only.
`ucp-swarm-manager`	This Swarm manager uses the replicated KV store for leader election and cluster membership tracking.
`ucp-controller`	This container runs the UCP server, using the replicated KV store for configuration state.
`ucp-swarm-join`	Runs the `swarm join` command to periodically publish this node existence to the KV store. If the node goes down, this publishing stops, and the registration times out, and the node is automatically dropped from the cluster.
`ucp-proxy`	Runs a local TLS proxy for the docker socket to enable secure access of the local docker daemon.

In UCP v1.0 the controller serves as root CA, and no other nodes are able to sign certificates. If the controller fails, it might not be possible to add new nodes to the cluster. Learn more about high availability

UCP nodes

These are the nodes that run your own containers. When you deploy your containers using UCP, it spreads the load across these nodes. You can configure the strategies used by UCP to deploy the containers across multiple nodes.

Below is a list of the containers that are deployed to the controller node, when running the ucp join command:

Name	Description
`ucp-swarm-join`	Runs the `swarm join` command to periodically publish this node existence to the KV store. If the node goes down, this publishing stops, and the registration times out, and the node is automatically dropped from the cluster.
`ucp-proxy`	Runs a local TLS proxy for the docker socket to enable secure access of the local docker daemon.

The UCP installation

The UCP installation consists of using the Docker Engine CLI to run the ucp tool. The ucp tool is a Docker image that can run subcommands like install to install UCP on a node, or join to join a node to a UCP cluster.

The general format of these commands is:

Docker client	run command with options	ucp image	Subcommand with options
`docker`	`run --rm -it`	`docker/ucp`	`install --help`
`docker`	`run --rm -it`	`docker/ucp`	`join --help`
`docker`	`run --rm -it`	`docker/ucp`	`uninstall --help`

You can use the ucp tool interactively, by passing them the -i option, or non-interactively, by passing command-line options.

To list all the possible subcommands for the ucp tool, use:

$ docker run --rm -it docker/ucp  --help

You can also find more information about the ucp command at the UCP tool reference page.

The ucp tool pulls several images from Docker Hub, and runs them in containers. The only change the ucp tool makes to your system, is creating certificates under the data volumes you create when installing.

Understand your installation options

The best way to test-drive UCP is to install and run it on a sandbox. The default options of the ucp install command, make it easy to test UCP. Learn how to install UCP on your local machine.

When installing UCP for production, you’ll want to ensure your installation scales and is secure. You’ll need to:

Set up UCP for high availability,
Customize some of the ports used,
Customize the data volumes used,
Use your own certificates.

Learn how to install UCP in production.

Installation checklist

Before installing UCP, make sure you have the following requirements:

Hardware and sofware requirements
Ports used
IP addresses and fully-qualified domain names
Subject alternative names (SANs)
Data volumes used

Hardware and software requirements

You can install UCP on-premises or on a cloud provider such AWS or Digital Ocean. To install UCP, all nodes must have:

1.50 GB of RAM
3.00 GB of available disk space
One of the supported operating systems installed:
- RHEL 7.0, 7.1
- Ubuntu 14.04 LTS
- CentOS 7.1
Kernel version 3.10 or higher
CS Docker Engine installed

If the ucp tool detects that your system doesn’t have these requirements, it displays a warning message.

Ports used

The following ports are using on UCP installation:

Hosts	Direction	Port	Purpose
controller, replicas	in	443 (configurable)	Web app and CLI client access to UCP.
controller, replicas	in	2376 (configurable)	Swarm manager accepts requests from UCP controller.
controller, replicas, nodes	in	2375	Heartbeat for nodes, to ensure they are running.
controller, replicas, nodes	in	12376	Proxy for TLS, provides access to UCP, Swarm, and Engine.
controller, replicas	in	12379	Internal node configuration, cluster configuration, and HA.
controller, replicas	in	12380	Internal node configuration, cluster configuration, and HA.
controller	in	12381	Proxy for TLS, provides access to UCP.
controller	in	12382	Manages TLS and requests from swarm manager.
controller, replicas	out	443	Send anonymous usage reports to Docker.

UCP collects anonymous usage metrics, to help us improve it. These metrics are entirely anonymous, don’t identify your company, users, applications, or any other sensitive information. You can disable this at any time on the UCP settings screen.

IP addresses and fully-qualified domain names

The ucp install command tries to use your network configurations to find the fully-qualified domain names (FQDN) of your hosts.

If you haven’t set up your network with FQDNs, the installer might not be able to find the FQDN for the host. If that happens, you’ll be prompted for an accessible host address. You can also use the --host-address option to specify the FQDN to the install command.

If you’re installing UCP on a cloud provider such as AWS or Digital Ocean, you might need to create a private network for you UCP installation. In that case, make sure all nodes of the cluster can communicate using their private IPs.

Subject alternative names (SANs)

All the communication between the nodes is protected by mutual TLS. The UCP installation configures TLS for you automatically.

For that, UCP requires that all clients, including the Docker Engine, use a Swarm TLS certificate chain signed by the UCP Swarm Root CA. You provide the certificate system with subject alternative names or SANs. The SANs are used to set up individual “leaf certificates.”

When using the ucp install or ucp join commands interactively, you are prompted for the subject alternative names of the host. This can be a public IP address, or fully-qualified domain name. You can also send the --san option to specify the SANs for a host.

Data volumes used

UCP uses named volumes for persistence of data. When installing UCP for production, you need to create the following volumes:

Volume name	Data
ucp-root-ca	The certificate and key for the UCP root CA. Do not create this volume if you are using your own certificates.
ucp-swarm-root-ca	The certificate and key for the Swarm root CA.
ucp-server-certs	The controller certificates for the UCP controllers web server.
ucp-swarm-node-certs	The Swarm certificates for the current node (repeated on every node in the cluster).
ucp-swarm-kv-certs	The Swarm KV client certificates for the current node (repeated on every node in the cluster).
ucp-swarm-controller-certs	The UCP Controller Swarm client certificates for the current node.
ucp-kv	Key value store persistence.

If you don’t create these volumes, the ucp install command creates them for you with the default volume driver and flags.

Where to go next

On this page: