How to securely share private docker repo login credentials in Azure container service with Mesos & Marathon

Question

I have setup Azure Container Service using DC/OS + Marathon for deploying Docker containers. So far looks good, I can connect to master node using SSH tunnel and access Mesos and Marathon WebUI as well as hit REST API.

Next, I am trying to deploy a docker container from my private docker repository and I found following article on Marathon website.

https://mesosphere.github.io/marathon/docs/native-docker-private-registry.html

Please see the "Note" section from above URL -

Note: The URI must be accessible by all nodes that may start your application. Approaches may include distributing the file to the local filesystem of all nodes, for example via RSYNC/SCP, or storing it on a shared network drive, for example Amazon S3. It is worth considering the security implications of your chosen approach.

What options does Azure provides for sharing the docker.tar.gz file across all nodes?

Thanks

Answer 1

Put your docker.tar.gz to Azure Storage and create a signed url. I have used Azure Storage Explorer to create one.

Output;

https://xyzds.file.core.windows.net/docker/docker.tar.gz?...url-params

You need to add file extension in order to marathon extract it.

x=.tar.gz

"uris": [ "https://xyzds.file.core.windows.net/docker/docker.tar.gz?...url-params&x=.tar.gz" ]

You are good to go.

Answer 2

One method is to use a script to walk the agents in your cluster. Take a look at https://github.com/rgardler/acs-cli for some experiments in doing this.

Answer 3

the way we did it is use parallel-scp to push the file to all our mesos agents, something like:

parallel-scp -h ~/pssh_all_ips ./docker.tar.gz /etc/docker.tar.gz

Where pssh_all_ips is a newline separated file of internal IP addresses (10.0.*.* or 10.32.*.* in our case).

You can find your agent IPs at localhost:2000/mesos/#/slaves if you're tunneled into your cluster).

This makes the file available at file:///etc/docker.tar.gz on all agents, from there you can use marathon's URI field to make it available to the docker pull system.