微众银行正式开源容器平台Dockin

{"type":"doc","content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"近年来，云原生（Cloud Native）可谓是 IT 界最火的概念之一，且随着云计算普及进程的不断加深，有愈演愈烈的趋势。云原生已经不是少数几个大企业的专属，越来越多的企业正在拥抱它，享受它带来的红利。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":"br"}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"Dockin是微众银行开源的生产级容器平台，提供了一整套私有云容器化的落地方案。涵盖Kubernetes集群管理、应用管理、网络、运维工具、开放 API 等组件，用户可以自由搭配使用，定制自己的容器平台。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"Dockin着力于生产级、高可用、安全性、云原生一体化、可定制，适用于传统IT向云原生转型。期待大家加入一起共建，向云原生出发。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"image","attrs":{"src":"https:\/\/static001.geekbang.org\/infoq\/73\/73831718f86613980cc8795fb71f7290.png","alt":"图片","title":null,"style":[{"key":"width","value":"75%"},{"key":"bordertype","value":"none"}],"href":null,"fromPaste":true,"pastePass":true}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"heading","attrs":{"align":null,"level":2},"content":[{"type":"text","text":"云原生下容器化的价值"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"足业务发展的需要。金融应用的典型特点为体量大、部署慢、难升级、难扩展，如何及时响应业务的需求、如何快速支持新业务上线是基础架构的优化方向。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":" "}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"容器作为一种新兴的虚拟化技术，跟传统的虚拟化方式相比具有众多的优势。其核心价值在于三点："}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"bulletedlist","content":[{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"strong"}],"text":"敏捷性"}]}]}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"据业界统计，使用容器技术可以实现 3~10 倍的交付效率提升，大大加速新产品迭代的效率，并降低试错成本。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"bulletedlist","content":[{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"strong"}],"text":"弹性"}]}]}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"通过容器技术可以充分发挥云的弹性，优化计算成本。一般情况下，通过容器技术可以降低 50% 的计算成本。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"bulletedlist","content":[{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"strong"}],"text":"可移植性"}]}]}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"容器已经成为了应用分发和交付的标准，可以应用于底层运行环境的结构。实现一次构建处处部署。"}]},{"type":"heading","attrs":{"align":null,"level":2},"content":[{"type":"text","text":"Dockin的诞生&微众银行私有云容器化的探索"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"Kubernetes是让容器应用进入大规模工业生产环境的开源系统，也是集群调度领域的事实标准，目前已被业界广泛接受并得到了大规模的应用。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":" "}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"微众银行的生产业务大多跑在私有机房上，无法使用腾讯云、阿里云等公有云提供的容器服务。而且有完善的基础运维工具，要在我们私有云上要落地一套 Kubernetes不是一件简单的事情，离线安装和升级、与未容器化的 VM 应用实例网络打通、稳定运营等都是非常复杂的，而且有很多潜藏的隐患如 Docker 安全漏洞、内核 BUG 等。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"image","attrs":{"src":"https:\/\/static001.geekbang.org\/infoq\/a4\/a43b8c46d7b6d3cf4dca3cca21a8bfde.png","alt":"图片","title":null,"style":[{"key":"width","value":"75%"},{"key":"bordertype","value":"none"}],"href":null,"fromPaste":true,"pastePass":true}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"Dockin实现了 Kubernetes 在微众银行私有云落地，同时收敛了 kubernetes 粗放的管理模式，定位是公司级的容器平台服务，所有功能都提供API，供上下游管理工具和基础软件接入，在应用管理上保持了和 VM 一致的用户体现。容器化与基础设施环境相关，对整个运维体系改变很大，关乎到应用的稳定性，原生的 Kubernetes 不能满足我们的要求。容器团队研发的Dockin，用了两年多的时间，经过一系列探索与实践现阶段现已实现应用的全面容器化，当然这个过程也遇到过很多问题，如："}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":"br"}},{"type":"bulletedlist","content":[{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"内网环境在线安装和升级 kubernetes 失败"}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"开发测试人员不懂 kubernetes 的 yaml 编写"}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"云原生产品的管理流程和公司内部运维系统不适配"}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"kubernetes 证书过期"}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"master节点扩缩容问题"}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"内核内存暴涨导致容器 OOM Killed"}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"容器重启后IP变化"}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"用户在容器里执行大内存命令导致容器挂掉"}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"用户主动修改容器里系统文件导致不可预期的错误"}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"应用做日志归档导致母机 IP 过高"}]}]}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"类似上面的问题还有很多，相信其他公司的容器团队也会深有感触，后面可以做成一个专题给大家分享。通过团队的专研，解决了很多操作系统底层适配的问题，同时通过研发一系列的 Kubernetes 之上的管理系统，解决容器应用资源管理、运维编排的问题。在实践中，容器团队将传统IT向容器云原生转型的坑基本都踩了一遍，最终形成了一整套完整的企业容器平台。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"image","attrs":{"src":"https:\/\/static001.geekbang.org\/infoq\/fa\/fad73c9e86611682aeda2256812899c8.png","alt":"图片","title":null,"style":[{"key":"width","value":"75%"},{"key":"bordertype","value":"none"}],"href":null,"fromPaste":true,"pastePass":true}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"目前，我们生产环境容器平台已承载了超过 50% 的应用实例，其中包括核心的金融交易系统，能实现核心系统容器化在业界都是少数。Dockin支持业务系统容器化，提高资源池弹性，提高应用交付效率，将各式各样的系统通过容器的方式进行标准化，实现统一的监控、统一的调度、自动化和智能化运维。平台所有系统基于开源产品自研，到目前为止，从应用管理、运行监控、到运维自动化都研发了对应的解决方案和系统。随着业务对平台的要求越来越高，Dockin 还将不断的迭代，也通过开源的方式让有共同兴趣的朋友一起参与，共同完善。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"image","attrs":{"src":"https:\/\/static001.geekbang.org\/infoq\/6c\/6cd4f46968396ed405d81ec27e5f1659.png","alt":"图片","title":null,"style":[{"key":"width","value":"75%"},{"key":"bordertype","value":"none"}],"href":null,"fromPaste":true,"pastePass":true}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"根据我们的实践，Dockin 解决了应用容器化的问题，优化了资源的使用效率，降低了硬件成本。同时还提升了应用的交付效率，推动了 IaaS 层的服务化，新业务上线周期更短。全量容器化后，未来Dockin会支持更多的云原生产品，实现智能化的调度，优化镜像和应用SDK，向Serverless方向发展。"}]},{"type":"heading","attrs":{"align":null,"level":2},"content":[{"type":"text","text":"Dockin能带来什么？"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"Dockin容器平台从我们生产环境中剥离出来，经过了金融级生产环境的严格验证，是私有化部署的较好方案。现在将 Dockin 开源贡献给社区，希望为大家带来帮助，也希望得到更多的检验。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"image","attrs":{"src":"https:\/\/static001.geekbang.org\/infoq\/3f\/3f5e64bf5e8b5eecaad894e64f7588de.png","alt":"图片","title":null,"style":[{"key":"width","value":"75%"},{"key":"bordertype","value":"none"}],"href":null,"fromPaste":true,"pastePass":true}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"Dockin 旨在打造一站式，可拓展的容器应用云原生管理平台。在首期开源的组件中，提供 kubernetes、docker、os版本组合建议，同时实现了etcd、kubernetes 的高可用部署；支持容器内命令执行过滤，网络支持了固定IP和多网卡。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"对于企业用户而言，Dockin 可以支持快速搭建生产级的kubernetes，提供将应用从VM平滑迁移到容器管理系统；提供经典网络下的IP固定的方案和网络插件；提供更加稳定性的、安全的容器运维功能。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":" "}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"strong"}],"text":"已开源组件"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"strong"}],"text":"1、Dockin-CNI"},{"type":"text","text":"，一款支持固定IP的网络插件"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"基于 kubernetes 的 CNI 网络插件，支持固定IP，支持多网卡。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"strong"}],"text":"2、Dockin-Ops，一套安全的运维编排服务"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"Dockin运维管理系统是安全的运维管理服务，优化 exec 执行性能，支持命令权限管理。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"strong"}],"text":"3、Dockin-Installer，一套离线Kubernetes集群安装器"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"Dockin平台安装器，快速部署Docker、高可用 kubernetes 集群、ETCD 集群，生产级参数调优。全离线安装，不需要连外网，支持十年的证书续订、ETCD备份恢复。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"strong"}],"text":"4、Dockin-RM，一款应用资源管理系统"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"Dockin 容器项目资源管理器，是应用定义和容器实例管理的核心模块，提供容器分配、回收、查询等功能。（具体安装流程请访问仓库地址获取 ）"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":" "}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"更详细的实践我们会在未来的文章中为大家带来，欢迎各位持续关注！"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"strong"}],"text":"项目仓库"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"https:\/\/github.com\/WeBankFinTech\/Dockin"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"https:\/\/gitee.com\/WeBankFinTech\/Dockin"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"strong"}],"text":"社区联络"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"项目负责人 Townchen  WeChatID：wxid_cgz"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"strong"}],"text":"未来还有更多..."}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"bulletedlist","content":[{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"静态应用管理方案"}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"镜像管理系统"}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"平台管理台"}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"高可用监控服务"}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"统一API网关"}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"智能调度系统"}]}]},{"type":"listitem","attrs":{"listStyle":null},"content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"通用Operator套件"}]}]}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":" "}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"strong"}],"text":"写在最后"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"Dockin 是微众银行云生产的基础设施，我们会长期的维护更新，并希望为大家的私有云服务提供一个更稳妥的选择。"}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":"br"}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"因此，诚邀关注云原生，容器开发的你一同参与到 Dockin  开源项目中来，我们欢迎任何形式的贡献，有各种建议或意见可在 GitHub\/ gitee \/ 微信群中提 issue。同时，Dockin 团队也在扩招中，感兴趣的同学尽情来聊吧。"}]}]}