docker ee

Configure Custom CIDR Ranges in Docker EE

I recently worked with a customer to customize all of the default Classless Interdomain Routing (CIDR) ranges used for IP address allocation by Docker Enterprise Edition 3.0 (Docker EE 3.0). The customer primarily wanted to document the customization process for future use. However, there is often a real need to change some of the default CIDR ranges to avoid conflicts with existing private IP addresses already in use within a customer’s network. Typically such a conflict will make it impossible for applications running in containers or pods to access external hosts in the conflicting CIDR range.

Are you expected to own innovation? Our IT solutions team can share your challenges. We empower businesses to evolve, release projects faster, and enhance performance. Tell us how we can help.

    Attack of the Kubernetes Clones

    One of the customers I support is using Kubernetes under Docker EE UCP (Enterprise Edition Universal Control Plane) and has been very impressed with its stability and ease of management. Recently, however, a worker node that had been very stable for months started evicting Kubernetes pods extremely frequently, reporting inadequate CPU resources. Our DevOps team was still experimenting with determining resource requirements for many of their containerized apps, so at first, we thought the problem was caused by resource contention between pods running on the node.

    Building Images in a Heterogeneous Cluster

    Recently I was troubleshooting a customer problem in their on-premise cluster. But I was not sure where the problem lay. So I switched over to using my colleagues Docker Enterprise demo cluster that is running in Azure. In this heterogeneous cluster are 1 Universal Control Plan (UCP) manager, 1 Docker Trusted Registry (DTR), 2 Windows workers, and 1 Linux worker.

    Building Images in a Heterogeneous Cluster

    I was attempting to reproduce my customer’s problem. However, what should have been easy turned into a problem; or else I wouldn’t be writing about it. I could not even get to my customer’s problem until I resolved an issue with simply building a linux image against a heterogeneous (Windows and Linux workers) cluster. At the time, it felt rather silly and frustrating all at the same time. All I could do was wring my hands and groan.

    I had downloaded my client bundle and sourced it in my bash shell.

    $ source

    The next thing I needed was to build the docker image from my custom Dockerfile. The Dockerfile was based on nginx and had a custom nginx.conf loaded into the image.

    $ cd ~/my-pp
    $ docker build -t my-app:1.0 .
    Sending build context to Docker daemon  4.096kB
    worker-win-2: Step 1/3 : FROM nginx:1.15.2 
    worker-win-2: Pulling from library/nginx
    Failed to build image: no matching manifest for unknown in the manifest list entries

    Ok, based on the last line of the log output it is not obvious what the issue is. However, if you look at the machine name that the build command was sent to, it becomes quite obvious what the problem is. I cannot build a linux based image on a windows machine. But how do I specify the target operating system on the command line?

    I knew my friend Chuck had already encountered this problem. So this is what he told me to do; add the following option –build-arg ‘constraint:ostype==linux’ to my build command.

    $ cd ~/my-app
    $ docker build --build-arg 'constraint:ostype==linux' -t my-app .
    Sending build context to Docker daemon  4.096kB
    worker-linux-1: Step 1/3 : FROM nginx:1.15.2
    worker-linux-1: Pulling from library/nginx
    worker-linux-1: Pull complete 
    worker-linux-1: Digest: sha256:d85914d547a6c92faa39ce7058bd7529baacab7e0cd4255442b04577c4d1f424
    worker-linux-1: Status: Downloaded newer image for nginx:1.15.2
    worker-linux-1:  ---> c82521676580
    worker-linux-1: Step 2/3 : EXPOSE 8443 
    worker-linux-1:  ---> Running in 88e99ace1e12
    worker-linux-1: Removing intermediate container 88e99ace1e12
    worker-linux-1:  ---> bd98a77c3b6b
    worker-linux-1: Step 3/3 : COPY nginx.conf /etc/nginx/ 
    worker-linux-1:  ---> 62b9f978af24
    worker-linux-1: Successfully built 62b9f978af24
    worker-linux-1: Successfully tagged my-app:latest

    That’s it folks. Plain and simple.

    $ docker build –build-arg ‘constraint:ostype==linux’ -t my-app .

    In a heterogeneous cluster my builds are now targeting linux machines and not windows. Of course you can alternate the ostype to windows if that is your goal. Good luck and contact us at

    Mark Miller
    Solutions Architect
    Docker Accredited Consultant

    Kubernetes NetworkPolicies in Docker Enterprise Edition

    Kubernetes running under Docker UCP uses the Calico CNI plugin so that you can use Kubernetes NetworkPolicies to control pod to pod communication as well as communication between pods and other network endpoints.

    This blog post will walk you through an example of configuring Kubernetes NetworkPolicies. We will block traffic from one namespace into another namespace, while still allowing external traffic to access the “restricted” namespace. As a high-level use case, we will consider the situation where a development team is working on multiple branches of a project, and the pods in the different branches should not be able to communicate with each other. If you are not familiar with the basic concepts of NetworkPolicies, see the Kubernetes documentation here.