Merge pull request #3612 from thaJeztah/daemon_cluster_opts

remove documentation and completion for deprecated legacy overlay networks

cli/command/system/info.go

@@ -321,8 +321,6 @@ func prettyPrintServerInfo(dockerCli command.Cli, info types.Info) []error {
 	}
 
 	fmt.Fprintln(dockerCli.Out(), " Experimental:", info.ExperimentalBuild)
-	fprintlnNonEmpty(dockerCli.Out(), " Cluster Store:", info.ClusterStore)
-	fprintlnNonEmpty(dockerCli.Out(), " Cluster Advertise:", info.ClusterAdvertise)
 
 	if info.RegistryConfig != nil && (len(info.RegistryConfig.InsecureRegistryCIDRs) > 0 || len(info.RegistryConfig.IndexConfigs) > 0) {
 		fmt.Fprintln(dockerCli.Out(), " Insecure Registries:")

cli/command/system/info_test.go

@@ -98,8 +98,6 @@ var sampleInfoNoSwarm = types.Info{
 	Labels:            []string{"provider=digitalocean"},
 	ExperimentalBuild: false,
 	ServerVersion:     "17.06.1-ce",
-	ClusterStore:      "",
-	ClusterAdvertise:  "",
 	Runtimes: map[string]types.Runtime{
 		"runc": {
 			Path: "docker-runc",

contrib/completion/bash/docker

@@ -2523,9 +2523,6 @@ _docker_daemon() {
 		--bip
 		--bridge -b
 		--cgroup-parent
-		--cluster-advertise
-		--cluster-store
-		--cluster-store-opt
 		--config-file
 		--containerd
 		--containerd-namespace
@@ -2574,15 +2571,6 @@ _docker_daemon() {
 
 	__docker_complete_log_driver_options && return
 
- 	key=$(__docker_map_key_of_current_option '--cluster-store-opt')
- 	case "$key" in
- 		kv.*file)
-			cur=${cur##*=}
- 			_filedir
- 			return
- 			;;
- 	esac
-
  	local key=$(__docker_map_key_of_current_option '--storage-opt')
  	case "$key" in
  		dm.blkdiscard|dm.override_udev_sync_check|dm.use_deferred_removal|dm.use_deferred_deletion)
@@ -2609,16 +2597,6 @@ _docker_daemon() {
 			__docker_complete_plugins_bundled --type Authorization
 			return
 			;;
-		--cluster-store)
-			COMPREPLY=( $( compgen -W "consul etcd zk" -S "://" -- "$cur" ) )
-			__docker_nospace
-			return
-			;;
-		--cluster-store-opt)
-			COMPREPLY=( $( compgen -W "discovery.heartbeat discovery.ttl kv.cacertfile kv.certfile kv.keyfile kv.path" -S = -- "$cur" ) )
-			__docker_nospace
-			return
-			;;
 		--config-file|--containerd|--init-path|--pidfile|-p|--tlscacert|--tlscert|--tlskey|--userland-proxy-path)
 			_filedir
 			return

contrib/completion/zsh/_docker

@@ -2731,9 +2731,6 @@ __docker_subcommand() {
                 "($help -b --bridge)"{-b=,--bridge=}"[Attach containers to a network bridge]:bridge:_net_interfaces" \
                 "($help)--bip=[Network bridge IP]:IP address: " \
                 "($help)--cgroup-parent=[Parent cgroup for all containers]:cgroup: " \
-                "($help)--cluster-advertise=[Address or interface name to advertise]:Instance to advertise (host\:port): " \
-                "($help)--cluster-store=[URL of the distributed storage backend]:Cluster Store:->cluster-store" \
-                "($help)*--cluster-store-opt=[Cluster store options]:Cluster options:->cluster-store-options" \
                 "($help)--config-file=[Path to daemon configuration file]:Config File:_files" \
                 "($help)--containerd=[Path to containerd socket]:socket:_files -g \"*.sock\"" \
                 "($help)--containerd-namespace=[Containerd namespace to use]:containerd namespace:" \
@@ -2792,22 +2789,6 @@ __docker_subcommand() {
                 "($help)--validate[Validate daemon configuration and exit]" && ret=0
 
             case $state in
-                (cluster-store)
-                    if compset -P '*://'; then
-                        _message 'host:port' && ret=0
-                    else
-                        store=('consul' 'etcd' 'zk')
-                        _describe -t cluster-store "Cluster Store" store -qS "://" && ret=0
-                    fi
-                    ;;
-                (cluster-store-options)
-                    if compset -P '*='; then
-                        _files && ret=0
-                    else
-                        opts=('discovery.heartbeat' 'discovery.ttl' 'kv.cacertfile' 'kv.certfile' 'kv.keyfile' 'kv.path')
-                        _describe -t cluster-store-opts "Cluster Store Options" opts -qS "=" && ret=0
-                    fi
-                    ;;
                 (users-groups)
                     if compset -P '*:'; then
                         _groups && ret=0

docs/reference/commandline/dockerd.md

@@ -1052,41 +1052,6 @@ Be careful setting `nproc` with the `ulimit` flag as `nproc` is designed by Linu
 set the maximum number of processes available to a user, not to a container. For details
 please check the [run](run.md) reference.
 
-### Node discovery
-
-The `--cluster-advertise` option specifies the `host:port` or `interface:port`
-combination that this particular daemon instance should use when advertising
-itself to the cluster. The daemon is reached by remote hosts through this value.
-If you  specify an interface, make sure it includes the IP address of the actual
-Docker host. For Engine installation created through `docker-machine`, the
-interface is typically `eth1`.
-
-The daemon uses [libkv](https://github.com/docker/libkv/) to advertise
-the node within the cluster. Some key-value backends support mutual
-TLS. To configure the client TLS settings used by the daemon can be configured
-using the `--cluster-store-opt` flag, specifying the paths to PEM encoded
-files. For example:
-
-```console
-$ sudo dockerd \
-    --cluster-advertise 192.168.1.2:2376 \
-    --cluster-store etcd://192.168.1.2:2379 \
-    --cluster-store-opt kv.cacertfile=/path/to/ca.pem \
-    --cluster-store-opt kv.certfile=/path/to/cert.pem \
-    --cluster-store-opt kv.keyfile=/path/to/key.pem
-```
-
-The currently supported cluster store options are:
-
-| Option                | Description                                                                                                                                                                                                                   |
-|:----------------------|:------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| `discovery.heartbeat` | Specifies the heartbeat timer in seconds which is used by the daemon as a `keepalive` mechanism to make sure discovery module treats the node as alive in the cluster. If not configured, the default value is 20 seconds.    |
-| `discovery.ttl`       | Specifies the TTL (time-to-live) in seconds which is used by the discovery module to timeout a node if a valid heartbeat is not received within the configured ttl value. If not configured, the default value is 60 seconds. |
-| `kv.cacertfile`       | Specifies the path to a local file with PEM encoded CA certificates to trust.                                                                                                                                                 |
-| `kv.certfile`         | Specifies the path to a local file with a PEM encoded certificate. This certificate is used as the client cert for communication with the Key/Value store.                                                                    |
-| `kv.keyfile`          | Specifies the path to a local file with a PEM encoded private key. This private key is used as the client key for communication with the Key/Value store.                                                                     |
-| `kv.path`             | Specifies the path in the Key/Value store. If not configured, the default value is 'docker/nodes'.                                                                                                                            |
-
 ### Access authorization
 
 Docker's access authorization can be extended by authorization plugins that your
@@ -1274,9 +1239,6 @@ This is a full example of the allowed configuration options on Linux:
   "bip": "",
   "bridge": "",
   "cgroup-parent": "",
-  "cluster-advertise": "",
-  "cluster-store": "",
-  "cluster-store-opts": {},
   "containerd": "/run/containerd/containerd.sock",
   "containerd-namespace": "docker",
   "containerd-plugin-namespace": "docker-plugins",
@@ -1402,8 +1364,6 @@ This is a full example of the allowed configuration options on Windows:
   "allow-nondistributable-artifacts": [],
   "authorization-plugins": [],
   "bridge": "",
-  "cluster-advertise": "",
-  "cluster-store": "",
   "containerd": "\\\\.\\pipe\\containerd-containerd",
   "containerd-namespace": "docker",
   "containerd-plugin-namespace": "docker-plugins",
@@ -1471,9 +1431,6 @@ if there are conflicts, but it won't stop execution.
 The list of currently supported options that can be reconfigured is this:
 
 - `debug`: it changes the daemon to debug mode when set to true.
-- `cluster-store`: it reloads the discovery store with the new address.
-- `cluster-store-opts`: it uses the new options to reload the discovery store.
-- `cluster-advertise`: it modifies the address advertised after reloading.
 - `labels`: it replaces the daemon labels with a new set of labels.
 - `live-restore`: Enables [keeping containers alive during daemon downtime](https://docs.docker.com/config/containers/live-restore/).
 - `max-concurrent-downloads`: it updates the max concurrent downloads for each pull.
@@ -1491,15 +1448,6 @@ The list of currently supported options that can be reconfigured is this:
 - `shutdown-timeout`: it replaces the daemon's existing configuration timeout with a new timeout for shutting down all containers.
 - `features`: it explicitly enables or disables specific features.
 
-Updating and reloading the cluster configurations such as `--cluster-store`,
-`--cluster-advertise` and `--cluster-store-opts` will take effect only if
-these configurations were not previously configured. If `--cluster-store`
-has been provided in flags and `cluster-advertise` not, `cluster-advertise`
-can be added in the configuration file without accompanied by `--cluster-store`.
-Configuration reload will log a warning message if it detects a change in
-previously configured cluster configurations.
-
-
 ### Run multiple daemons
 
 > **Note:**

docs/reference/commandline/network_create.md

@@ -51,34 +51,24 @@ $ docker network create -d bridge my-bridge-network
 
 Bridge networks are isolated networks on a single Engine installation. If you
 want to create a network that spans multiple Docker hosts each running an
-Engine, you must create an `overlay` network. Unlike `bridge` networks, overlay
-networks require some pre-existing conditions before you can create one. These
-conditions are:
+Engine, you must enable Swarm mode, and create an `overlay` network. To read more
+about overlay networks with Swarm mode, see ["*use overlay networks*"](https://docs.docker.com/network/overlay/).
 
-* Access to a key-value store. Engine supports Consul, Etcd, and ZooKeeper (Distributed store) key-value stores.
-* A cluster of hosts with connectivity to the key-value store.
-* A properly configured Engine `daemon` on each host in the cluster.
-
-The `dockerd` options that support the `overlay` network are:
-
-* `--cluster-store`
-* `--cluster-store-opt`
-* `--cluster-advertise`
-
-To read more about these options and how to configure them, see ["*Get started
-with multi-host network*"](https://docs.docker.com/engine/userguide/networking/get-started-overlay).
-
-While not required, it is a good idea to install Docker Swarm to
-manage the cluster that makes up your network. Swarm provides sophisticated
-discovery and server management tools that can assist your implementation.
-
-Once you have prepared the `overlay` network prerequisites you simply choose a
-Docker host in the cluster and issue the following to create the network:
+Once you have enabled swarm mode, you can create a swarm-scoped overlay network:
 
 ```console
-$ docker network create -d overlay my-multihost-network
+$ docker network create --scope=swarm --attachable -d overlay my-multihost-network
 ```
 
+By default, swarm-scoped networks do not allow manually started containers to
+be attached. This restriction is added to prevent someone that has access to
+a non-manager node in the swarm cluster from running a container that is able
+to access the network stack of a swarm service.
+
+The `--attachable` option used in the example above disables this restriction,
+and allows for both swarm services and manually started containers to attach to
+the oerlay network.
+
 Network names must be unique. The Docker daemon attempts to identify naming
 conflicts but this is not guaranteed. It is the user's responsibility to avoid
 name conflicts.
@@ -121,9 +111,9 @@ disconnect` command.
 ### Specify advanced options
 
 When you create a network, Engine creates a non-overlapping subnetwork for the
-network by default. This subnetwork is not a subdivision of an existing
-network. It is purely for ip-addressing purposes. You can override this default
-and specify subnetwork values directly using the `--subnet` option. On a
+network by default. This subnetwork is not a subdivision of an existing network.
+It is purely for ip-addressing purposes. You can override this default and
+specify subnetwork values directly using the `--subnet` option. On a
 `bridge` network you can only create a single subnet:
 
 ```console
@@ -221,6 +211,43 @@ $ docker network create -d overlay \
   my-ingress-network
 ```
 
+### Run services on predefined networks
+
+You can create services on the predefined docker networks `bridge` and `host`.
+
+```console
+$ docker service create --name my-service \
+  --network host \
+  --replicas 2 \
+  busybox top
+```
+
+### Swarm networks with local scope drivers
+
+You can create a swarm network with local scope network drivers. You do so
+by promoting the network scope to `swarm` during the creation of the network.
+You will then be able to use this network when creating services.
+
+```console
+$ docker network create -d bridge \
+  --scope swarm \
+  --attachable \
+  swarm-network
+```
+
+For network drivers which provide connectivity across hosts (ex. macvlan), if
+node specific configurations are needed in order to plumb the network on each
+host, you will supply that configuration via a configuration only network.
+When you create the swarm scoped network, you will then specify the name of the
+network which contains the configuration.
+
+
+```console
+node1$ docker network create --config-only --subnet 192.168.100.0/24 --gateway 192.168.100.115 mv-config
+node2$ docker network create --config-only --subnet 192.168.200.0/24 --gateway 192.168.200.202 mv-config
+node1$ docker network create -d macvlan --scope swarm --config-from mv-config --attachable swarm-network
+```
+
 ## Related commands
 
 * [network inspect](network_inspect.md)

man/dockerd.8.md

@@ -12,9 +12,6 @@ dockerd - Enable daemon mode
 [**-b**|**--bridge**[=*BRIDGE*]]
 [**--bip**[=*BIP*]]
 [**--cgroup-parent**[=*[]*]]
-[**--cluster-store**[=*[]*]]
-[**--cluster-advertise**[=*[]*]]
-[**--cluster-store-opt**[=*map[]*]]
 [**--config-file**[=*/etc/docker/daemon.json*]]
 [**--containerd**[=*SOCKET-PATH*]]
 [**--data-root**[=*/var/lib/docker*]]
@@ -154,17 +151,6 @@ $ sudo dockerd --add-runtime runc=runc --add-runtime custom=/usr/local/bin/my-ru
   Set parent cgroup for all containers. Default is "/docker" for fs cgroup
   driver and "system.slice" for systemd cgroup driver.
 
-**--cluster-store**=""
-  URL of the distributed storage backend
-
-**--cluster-advertise**=""
-  Specifies the 'host:port' or `interface:port` combination that this
-  particular daemon instance should use when advertising itself to the cluster.
-  The daemon is reached through this value.
-
-**--cluster-store-opt**=""
-  Specifies options for the Key/Value store.
-
 **--config-file**="/etc/docker/daemon.json"
   Specifies the JSON file path to load the configuration from.
 
@@ -780,29 +766,6 @@ cannot be smaller than **btrfs.min_space**.
 
 Example use: `docker daemon -s btrfs --storage-opt btrfs.min_space=10G`
 
-# CLUSTER STORE OPTIONS
-
-The daemon uses libkv to advertise the node within the cluster.  Some Key/Value
-backends support mutual TLS, and the client TLS settings used by the daemon can
-be configured using the **--cluster-store-opt** flag, specifying the paths to
-PEM encoded files.
-
-#### kv.cacertfile
-
-Specifies the path to a local file with PEM encoded CA certificates to trust
-
-#### kv.certfile
-
-Specifies the path to a local file with a PEM encoded certificate.  This
-certificate is used as the client cert for communication with the Key/Value
-store.
-
-#### kv.keyfile
-
-Specifies the path to a local file with a PEM encoded private key.  This
-private key is used as the client key for communication with the Key/Value
-store.
-
 # Access authorization
 
 Docker's access authorization can be extended by authorization plugins that

man/src/container/create-example.md

@@ -24,8 +24,8 @@ our container needs access to a character device with major `42` and
 any number of minor number (added as new devices appear), the
 following rule would be added:
 
-```
-docker create --device-cgroup-rule='c 42:* rmw' -name my-container my-image
+```console
+$ docker create --device-cgroup-rule='c 42:* rmw' -name my-container my-image
 ```
 
 Then, a user could ask `udev` to execute a script that would `docker exec my-container mknod newDevX c 42 <minor>`

man/src/container/diff.md

@@ -14,7 +14,7 @@ You can use the full or shortened container ID or the container name set using
 
 Inspect the changes to an `nginx` container:
 
-```bash
+```console
 $ docker diff 1fdfd1f54c1b
 
 C /dev

man/src/container/logs.md

@@ -29,7 +29,7 @@ container.
 
 In order to retrieve logs before a specific point in time, run:
 
-```bash
+```console
 $ docker run --name test -d busybox sh -c "while true; do $(echo date); sleep 1; done"
 $ date
 Tue 14 Nov 2017 16:40:00 CET