$ whoami

Lorenzo Fontana

Software Engineer at Facile.it

https://github.com/fntlnz

https://twitter.com/fntlnz

http://fntlnz.wtf

http://engineering.facile.it

http://jobs.facile.it

What are Docker plugins ?

What kind of capabilities?

Authorization

VolumeDriver

Network

IPAM

What we did before plugins?

Wrap the Docker Remote API

Wrap the Docker Remote API

Wrap the Docker Remote API

Wrap the Docker Remote API

Ok but, how do they work?

The plugin implements an HTTP server which can be discovered by Docker

The HTTP server exposes a set of RPCs issued as HTTP POSTs with JSON payloads

Docker makes a request to the plugin whenever is needed

Plugin discovery

Docker will always first check for unix sockets first (*.sock) by looking in the /run/docker/plugins folder

Then it will check for specifications files like *.spec and *.json in /etc/docker/plugins or /usr/lib/docker/plugins

JSON Specification *.json

/etc/docker/plugins/example-plugin.json

{
  "Name": "example-plugin",
  "Addr": "https://fntlnz.wtf/example-plugin",
  "TLSConfig": {
    "InsecureSkipVerify": false,
    "CAFile": "/usr/shared/docker/certs/example-ca.pem",
    "CertFile": "/usr/shared/docker/certs/example-cert.pem",
    "KeyFile": "/usr/shared/docker/certs/example-key.pem",
  }
}

Text files containing an URL *.spec

/etc/docker/plugins/example-plugin.spec

tcp://[::]:8080

unix:///path/to/my/plugin.sock

Plugin API

Handshake:

POST /Plugin.Activate

Response:

{
    "Implements": ["VolumeDriver"]
}

Available protocols are:

• authz
• NetworkDriver
• VolumeDriver
• IpamDriver

Each protocol provides its own set of RPC calls in addition to the activation call

Error handling

Is done via the response error form

{
    "Err": string
}

That should be used along with the HTTP error statuses 400 and 500

VolumeDriver Plugins

VolumeDriver plugin protocol

Plugins that provide volume capabilities must register themselves as VolumeDriver during the Handshake

{
    "Implements": ["VolumeDriver"]
}

A VolumeDriver plugin is expected to provide writable paths on the host filesystem

A volume plugin makes use of the flags:

-v : to specify the volume name

--volume-driver : to specify the driver

docker run -ti \
  -v volumename:/folder \
  --volume-driver=myplugin \
alpine sh

VolumeDriver protocol

/VolumeDriver.Create

/VolumeDriver.Remove

/VolumeDriver.Mount

/VolumeDriver.Path

/VolumeDriver.Unmount

/VolumeDriver.Get

/VolumeDriver.List

WAIT!

There's nothing from Docker that can help me implementing this?

Yay! github.com/docker/go-plugins-helpers

Demo

hope that everything works as expected

Some useful volume plugins

Flocker:

GlusterFS plugin:

IPFS plugin:

OpenStorage plugin:

NetworkDriver plugins

NetworkDriver plugin protocol

Plugins that provide network capabilities must register themself as NetworkDriver during the Handshake

{
    "Implements": ["NetworkDriver"]
}

This indicates that the plugin should be registered with LibNetwork as driver

Container Network Model

Network

/NetworkDriver.CreateNetwork

/NetworkDriver.DeleteNetwork

Endpoint

/NetworkDriver.CreateEndpoint

/NetworkDriver.EndpointOperInfo

/NetworkDriver.DeleteEndpoint

Sandbox

/NetworkDriver.Join

/NetworkDriver.Leave

Some useful network plugins

Weave:

Onion:

Contiv Networking: