Using Containerizers

Using containerizers with Docker Engine and Universal Container Runtime

A containerizer provides a containerization and resource isolation abstraction around a specific container runtime. DC/OS containerizers support the following container runtimes:

The advantages of Universal Container Runtime (UCR) are:

  • Removes your dependency on the Docker Engine. If the Docker Engine is not responsive, restarting the Engine causes all containers on the host to stop. In addition, Docker must be installed on each of your agent nodes and you must upgrade Docker on the agent nodes each time a new version of Docker is released.
  • Is more stable and allows deployment at scale
  • Offers features not available in the Docker Engine, such as GPU and CNI support
  • Allows you to take advantage of continuing innovation within both the Mesos and DC/OS, including features such as IP per container, strict container isolation, and more. Refer to the features matrix for additional information.
  • Supports collection of container image garbage either automatically or manually

In summary, using the UCR instead of the Docker Engine:

  • Reduces service downtime
  • Improves on-the-fly upgradability
  • Increases cluster stability

Container Runtime Features

The tables below list the features available with each of the supported container runtimes, which products support the features, and where the feature can be configured.

DC/OS Features

FeatureUCRDockerComments
CommandYesYes
Container ImagesYesYes
Image Garbage CollectionYesYes
PodsYesNo
GPUsYesNo
URIsYesYes
Docker OptionsNoYes
Force PullYesYes
SecretsYesYesDC/OS Enterprise only
File-based SecretsYesNoDC/OS Enterprise only
Debugging with execYesNoCLI only
All Security ModesYesYesDC/OS Enterprise only

Container Backend

FeatureUCRDocker
OverlayFSYesYes
AufsYesYes
BindYesN/A

Storage

FeatureUCRDockerComments
Local Persistent VolumesYesYes
Host VolumesYesYesCLI only
External VolumesYesYes

Service Endpoints

FeatureUCRDocker
Named PortsYesYes
Numbered PortsYesYes

Networking

FeatureUCRDockerComments
Host NetworkingYesYes
Bridge NetworkingYesYes
CNIYesN/A
CNMN/AYesDocker 1.11+
L4LBYesYesRequires defined service endpoints. TCP health checks do not work with L4LB.

Private Registry

FeatureUCRDocker
Token-based Container AuthNoYes
Token-based Cluster AuthYesYes
Basic Container AuthNoYes
Basic Cluster AuthYesYes

Health Checks

FeatureUCRDockerComments
TCPYesYesCLI only
HTTP/HTTPSYesYesCLI only
CommandYesYes
Local TCPYesYesCLI only
Local HTTP/HTTPSYesYes

[

Universal Container Runtime (UCR)

Launching Mesos containers using the Universal Container Runtime

]($a77b0810449ed768.md)[

Docker Engine

Launching Docker containers from Docker images

]($c4e13291ad80651c.md)