How to securely share your personal docker registry credentials in Azure container service with Mesos & Marathon

Question

I have an Azure Container Service setup using DC / OS + Marathon to deploy Docker containers. It still looks good, I can connect to the master node using the SSH tunnel and access the Mesos and Marathon WebUI, and also click the REST API.

Next, I'm trying to deploy a docker container from my private docker repository, and I found the following article on the Marathon website.

https://mesosphere.imtqy.com/marathon/docs/native-docker-private-registry.html

See the "Note" section above the URL -

Note The URI must be accessible to all nodes that can run your application. Approaches may include distributing a file to the local file system of all nodes, for example via RSYNC / SCP, or storing it on a shared network drive, such as Amazon S3. Consider the implications for your chosen approach to security.

What options does Azure provide for sharing the docker.tar.gz file on all nodes?

thanks

Answer 1

Put your docker.tar.gz in Azure Storage and create a signed URL. I used Azure Storage Explorer to create it.

Exit;

https://xyzds.file.core.windows.net/docker/docker.tar.gz?...url-params

You need to add the file extension to extract it from the marathon.

x=.tar.gz

"uris": [ "https://xyzds.file.core.windows.net/docker/docker.tar.gz?...url-params&x=.tar.gz" ]

You will go well.

Answer 2

the way we did this is to use parallel-scp to push the file to all of our mesoa agents, something like:

 parallel-scp -h ~/pssh_all_ips ./docker.tar.gz /etc/docker.tar.gz 

Where pssh_all_ips is a separate file of internal IP addresses ( 10.0.*.* Or 10.32.*.* In our case).

Your agent IPs can be found in localhost:2000/mesos/#/slaves if you are tunneling into your cluster).

This makes the file available in file:///etc/docker.tar.gz for all agents, from there you can use the marathon URI field to make it available to the dockerer system.

Answer 3

One method is to use a script to move agents in your cluster. Take a look at https://github.com/rgardler/acs-cli for some experiments with this.