Install Pando

Docker on several hosts

docker-hosts Runs apps as containers on several Docker hosts. Each app is placed on one host and stays there: a new app goes to the host with the most free memory that fits it. Pando reaches each host's apps through a forwarding agent it runs there, which accepts only Pando's certificate. Built images reach the hosts through the install's image registry.

Setup

  1. Open each host's Docker API

    1. Install Docker Engine on each host. Use hosts of one CPU architecture.
    2. For a tcp:// host, follow Use TLS (HTTPS) to protect the Docker daemon socket to run dockerd --tlsverify on port 2376, and paste ca.pem, cert.pem and key.pem below.
    3. For an ssh:// host, use rootful Docker: over SSH, Pando reaches only /var/run/docker.sock, not a rootless daemon's socket.
    4. For an ssh:// host, run ssh-keygen -t ed25519 -f pando-docker -N "".
    5. On each ssh:// host, add a user to the docker group with sudo usermod -aG docker <user> and add pando-docker.pub to its ~/.ssh/authorized_keys.
    6. Paste pando-docker below.

    Open Docker's install guideOpen Docker's TLS guide

    Settings docker_tls, ssh_key

  2. List the hosts

    1. On each host, allow port 7443 from the control host's address only.
    2. On each host, let Docker pull from the install's image registry: trust its certificate, or list it under insecure-registries in /etc/docker/daemon.json.
    3. Give each host a name and an endpoint: tcp://<host>:2376 or ssh://<user>@<host>.
    4. Mark the host Pando runs on with "control": true and give it an agent_address, such as 10.0.0.5:7443.
    5. For each ssh:// host, set ssh_host_key to its line from ssh-keyscan -t ed25519 <host>.

    Settings hosts

  3. Create the agent certificate authority

    1. On the host Pando runs on, run pando host-agent new-authority, or docker compose exec pando pando host-agent new-authority with Docker Compose.
    2. Paste its output below.

    Settings agent_authority

Settings (9)
hostsHostsRequired

The hosts as a JSON list. Each has a name; an endpoint (unix:///var/run/docker.sock, tcp://host:2376 with the Docker TLS credential, or ssh://user@host with the SSH key and the host's ssh_host_key); an agent_address where Pando reaches the host's agent; and optionally no_placement to keep new apps off it. Exactly one is "control": true, the host Pando runs on.

string · For example [{"name":"control","control":true,"agent_address":"10.0.0.5:7443"},{"name":"app-1","endpoint":"tcp://10.0.0.6:2376"}]

agent_authorityAgent certificate authorityRequiredCredential

The output of pando host-agent new-authority. Pando issues its own certificate and each agent's from it.

string

docker_tlsDocker TLS client certificateCredential

For tcp:// hosts: the CA (ca.pem), the client certificate (cert.pem) and its key (key.pem), pasted together.

string

ssh_keySSH private keyCredential

For ssh:// hosts: an unencrypted private key for a user in the docker group, or root.

string

agent_imageAgent imageAdvanced

The image of Pando each host's agent and each restricted app's egress gateway run. Every host must be able to pull it.

string · Default The image Pando's own container runs

agent_portAgent portAdvanced

The one port each host publishes, for its agent. Restrict it to the control host's address with the host's firewall.

int · Default 7443

network_poolApp network rangeAdvanced

The IPv4 range each host's app networks take their addresses from. Each host uses the whole range for its own apps. Cannot be "off" here.

string · Default 10.213.0.0/16

network_block_bitsApp network sizeAdvanced

The size of each app's private network, as a prefix length from 24 to 29.

int · Default 28

oci_runtimeContainer runtimeAdvanced

The runtime every host's Docker starts apps with, by the name it is registered under in daemon.json, such as runsc.

string · Default Docker's default, runc