The Journey Continues

This blog has been silent for a while. Reason is that I moved into a different role at IBM, with more focus on Cloud solutions, and less focus on the mainframe. Therefore, the blog will remain silent. I will let the blog active, as I still see quite a number of hits from search engines, so some articles seem a good reference.

However, there is a now blog on the horizon, that continues the exciting topic how Mainframe and Cloud technologies are a great complement: Alice Frosi blogs at https://containersonibmz.com/. I strongly suggest to take a look there and follow Alice's blog, as she is right at the cutting edge of this journey.

Thank you for visiting this place, for your questions and feedback. Enjoy how the future is shaped.

Run containers in separate virtual machines

The high end version of IBM Blockchain Platform uses a combination of virtualization and containerization to crank up isolation attributes of business networks a bit. We have now released the underlying technology into Open Source: runq on github.

runq allows to start containers in a slightly different fashion in a Docker environment:

Handy Search Engine for Docker Hub Images

http://soaphub.org/imagehub/ provides a nice way to search Docker Hub. You can search for strings in name spaces, and the result also displays what architectures the image is backed by.

ClefOS is official

Or more precisely, ClefOS is an official image. Official image means, it is part of curated content on Docker Hub. It is also (AFAIK) the first official image that has no support yet for other platforms. Well, this might be a dubious comparison since it is actually an equivalent to CentOS which does not have any s390x backing. ClefOS can't be named CentOS, since Neale Ferguson and company at Sine Nomine Associates are not part of the CentOS organization. However, as you can see it is very closely following it:

$ docker run -ti clefos
Unable to find image 'clefos:latest' locally
latest: Pulling from library/clefos
26dbd8e1d5ff: Pull complete
Digest: sha256:8e89216b23e7a5716a7e31de352ed777769738d258a1e20cc9cff06e39316717
Status: Downloaded newer image for clefos:latest
bash-4.2# cat /etc/os-release
NAME="CentOS Linux"
VERSION="7 (Core)"
ID="centos"
ID_LIKE="rhel fedora"
VERSION_ID="7"
PRETTY_NAME="CentOS Linux 7 (Core)"
ANSI_COLOR="0;31"
CPE_NAME="cpe:/o:centos:centos:7"
HOME_URL="https://www.centos.org/"
BUG_REPORT_URL="https://bugs.centos.org/"

CENTOS_MANTISBT_PROJECT="CentOS-7"
CENTOS_MANTISBT_PROJECT_VERSION="7"
REDHAT_SUPPORT_PRODUCT="centos"
REDHAT_SUPPORT_PRODUCT_VERSION="7"

bash-4.2#

This gives you a great option for enabling CentOS (or RHEL) based images on IBM Z. The identification above is technically very sane, since some projects check the distribution, and for some reason do not know ClefOS, but know CentOS.

ELK Revisited, Version 6

A previous post showed how the Elastic Stack can be used on Linux on Z. It based on version 5.5.2 these days. If you are looking at using the latest version 6.0.0, read on...

Portainer, Supported

The previous post showed that portainer is now available for s390x. Today, the project announced a support offering which can also apply to IBM Z.
This is 22 days from the first PR to the project releasing for s390x and announcing support! Thanks, portainer.io-Team, this is amazing.

Portainer -- Revisited

A previous post described how to run portainer on z. Starting today, s390x support is part of their Docker Hub image. This makes the task a bit easier. Enter

docker run -d -p 9000:9000 -v /var/run/docker.sock:/var/run/docker.sock -v /opt/portainer:/data portainer/portainer

and point your browser to port 9000. Done.
Kudos to the portainer.io team for integrating s390x support so quickly!

Next Step: Alpine is multi-arch

As of today, the multi-arch manifest of alpine points to several architectures, including s390x. This means, you can now re-use all the Dockerfiles saying "FROM alpine" without changes (no "s390x/"). Or, of course, things like "docker run -ti alpine sh" work without an s390x/.

Portainer

Portainer is one of the major Open Source tools for graphically managing Docker environments. You can use portainer on any machine and direct it to a Docker API endpoint to manage s390x.

Update 2017/11/08: starting today, portainer/portainer comes with s390x support. Check out containerz.blogspot.com/2017/11/portainer-revisited.html for details; the steps below are not required anymore to run portainer.

If you prefer running it on s390x, there are some steps needed, as long as portainer doesn't build it for s390x:

Docker and Kubernetes. Kubernetes and Docker.

Kubernetes has become the trending orchestration solution for containers. All big Cloud providers bet on it, and even in smaller companies, k8s (written that way as there are 8 letters between k and s) is what all the hip developers go for.
Docker is still used to build all the images, and they have made it to a commercial product used by many customers.
Kubernetes has focused on being an extensible and scalable framework, and is still growing fast; it has a credible reputation for managing data center scale with best possible control. In fact, control is IMHO the word that describes its nature best.
Docker has chosen to put user experience first: it provides rich functionality with sane defaults, but users don't have to think about it -- Docker simply and quickly does what you mean. User experience is (IMHO) Docker's core characteristics.

Docker CE 17.09 available

Docker, Inc. has released a new version of their Community Edition engine: 17.09. It includes IBM Z support and is available on Docker Store as builds for their preferred CE distributions (Ubuntu at this time), or as statically linked binary for all distributions. The same considerations for installation as for 17.06 (Ubuntu/static) apply for 17.09.

IBM Z images on Docker Store

As mentioned in a previous post, an increasing number of Docker "official images" include s390x binaries. This is now also marked accordingly on Docker Store. If you search for containers, there is an "IBM Z" checkbox. Activating it filters for s390x images.

Elastic Stack on Z

The Elastic Stack, also known as ELK stack, is a popular choice to manage logs. ELK is an acronym for its three main components Elasticsearch, Logstash and Kibana; Elastic Stack is the more recent name for it. ELK is written in Java and maintained by Elastic. The three building blocks have a clear separation of duty:

• Elasticsearch is a database for storing
• Logstash ingests logs in various formats and can transform them for efficient processing with Elasticsearch
• Kibana is a graphical, web-based front end to Elasticsearch

E, L and K can operate in a Linux on IBM Z environment. IBM's Common Data Provider can even handle z/OS logs like SMF data. Here's how to run ELK on the mainframe -- of course in containers:

Docker Official Images Go Multi-Arch

Starting today, all Docker official images (on Docker Hub and soon easily identifiable on Docker Store) are multi-arch images. Official images are credibly curated images that are maintained by Docker, the Docker community or the projects behind individual images.

That does not mean that all these images are available for s390x yet, but the infrastructure is in place to several architectures into official images, i.e. all official images are manifest lists. An earlier post explained multi-arch images and how to use it.

At this time, quite some official images are not just multi-arch enabled, but also carry s390x binaries.

Book about Docker on Z

IBM has published a very nice document about Docker on the mainframe.

It is available as PDF download as well as via Knowledge Center. You can read one of the best container/Docker introductions I've seen on the Internet, as well as a good coverage of basic concepts around containers and Docker in the context of Z.
Chapter overiew:

Docker Enterprise Edition available for IBM Z

It has been signaled earlier this year, now it has been announced: Docker Enterprise Edition is available for Z. Version 17.06.1 has now been made available, and not only is it a new version for x86, but it also supports Z as "managed-to" platform. A lot of work went into this, and this is what the journey starts with:

• the engine of Docker Enterprise Edition will run on Linux on z Systems
• Docker Trusted Registry (DTR) can handle s390x images (while DTR runs on x86)
• Docker Universal Control Plane (UCP) can manage s390x nodes (while the UCP UI runs on x86)

So what exactly do these components provide? Here are more details (and some screenshots that may show the function set much better):

Registry Option: SUSE Portus

An Open Source alternative to Docker Trusted Registry is Portus from SUSE. This is a front end to a private Open Source registry that allows for fine grained control of registry access and content: it can manage users, teams, and namespaces (no, not the kernel ones). It can integrate with LDAP for authentication and offers an audit trail, and can be extended for security scanning.

Portus dashboard with activity log

To play with Portus, we need:

1. docker-compose.
2. a private registry
3. Portus

New Docker Engine in SLES 12 Containers Module

A couple of days ago, SUSE published a major update to the Docker engine. The Containers Module now offers version 17.04-CE of the engine (docker-17.04.0_ce-98.2.s390x.rpm).

An Overview on s390x Base Images

For s390x, quite a few options for base images are available on Docker Hub/Docker Store these days. They vary from enterprise environments over community distributions to minimal images. This post gives an overview on what is provided by various sources.

Docker CE for all distributions

The previous post mentioned that Docker provides CE packages for Ubuntu. For users of Debian, SLES, RHEL, Fedora, ClefOS, openSUSE, and Alpine, there is still an option to get the latest Docker CE version to their environment: