Repository navigation
Add isolation option to docker service #31616
Description
Proposal
Add --isolation as a parameter to docker service create
Background
Windows supports running containers with two different levels of isolation - process (shared kernel), and hyperv (separate kernel per container). Customers are deploying a mix of these based on their security needs. For example, trusted internal apps may be run with process level isolation to favor higher density, while others may require a separate kernel. Therefore this setting should be service-specific and not host-wide.
I mentioned this at #25209 (comment) but want to track this as a separate specific ask.
Activity
carlfischer1 commentedon Apr 4, 2017
@PatrickLang when #32339 is complete can you piggyback a PR on that?
cc @friism @ehazlett @jhowardmsft
Techwolfy commentedon Aug 3, 2017
Are there any updates on this? I've been running into deployment issues on a mixed-version Windows cluster. While I do have a workaround, I'd prefer to be able to specify all of my deployment settings in a single Compose file. #32339 was merged a few months ago.
Reposting my comment from #34375 (duplicate) for convenience:
It is currently impossible to specify a container isolation mode when configuring a swarm service. This isn't relevant for Linux containers, but Windows containers can run with either
process(shared kernel) orhyperv(VM) isolation. When usingdocker swarmto deploy to a mixed-version Windows cluster, it is possible for a container to be scheduled on a node with a different kernel version [1]. A container kernel mismatch isn't significant when running withhypervisolation but will cause containers usingprocessisolation to fail to start.As the default isolation mode is
process, deployments to mixed-version Windows clusters currently fail if a mismatch occurs. Even if a cluster initially consists of a single version, mixed-version support is necessary to support online upgrades. Setting"exec-opts":["isolation=hyperv"]inC:\ProgramData\docker\config\daemon.jsonon each node resolves the issue at the cost of additional overhead.The Docker CLI supports an
isolationparameter to control the setting when starting containers locally, but not for Swarm services. Docker-Compose supported this option in versions 2.1-2.3 but dropped it with v3.0's Swarm integration, presumably due to this issue. I've opened issues in each to reinstate the option but neither can proceed unless it is added to the Swarm Service API [2].[1]: I had trouble finding a concrete answer for this, but MSDN indicates that labels should be used to constrain deployment.
[2]: Related issues: docker/cli#414, docker/compose#5069
clawrenceks commentedon Nov 5, 2017
I see there has been no activity on this thread since August. Is there any update available, even just to specify whether this is being considered? I have just run into this issue today and I suspect lots more people are going to as container hosts are moved to Windows Server release 1709.
thaJeztah commentedon Nov 6, 2017
@clawrenceks see;
First two have been merged, last one is currently being reviewed
clawrenceks commentedon Nov 7, 2017
@thaJeztah Fantastic, thanks for the update. Looks very promising and I will keep my eye on docker/cli#426
simonferquel commentedon Nov 17, 2017
All 3 PRs are now merged in master :)
vdemeester commentedon Nov 17, 2017
Thus, I think we can close ! 👍
Good work @simonferquel 🎉
PatrickLang commentedon Nov 17, 2017
Thanks all!