docker/ucp install

This topic applies to Docker Enterprise.

The Docker Enterprise platform business, including products, customers, and employees, has been acquired by Mirantis, inc., effective 13-November-2019. For more information on the acquisition and how it may affect you and your business, refer to the Docker Enterprise Customer FAQ.

Install UCP on a node

Usage

docker container run \
    --rm \
    --interactive \
    --tty \
    --name ucp \
    --volume /var/run/docker.sock:/var/run/docker.sock \
    docker/ucp \
    install [command options]

Description

This command initializes a new swarm, turns anode into a manager, and installs Docker Universal Control Plane (UCP).

When installing UCP you can customize:

• The UCP web server certificates. Create a volume named ucp-controller-server-certs and copy the ca.pem, cert.pem, and key.pem files to the root directory. Then run the install command with the --external-server-cert flag.
• The license used by UCP, which you can accomplish by bind-mounting the file at /config/docker_subscription.lic in the tool. For example, -v /path/to/my/config/docker_subscription.lic:/config/docker_subscription.lic or by specifying the --license $(cat license.lic) option.

If you’re joining more nodes to this swarm, open the following ports in your firewall:

• 443 or the --controller-port
• 2376 or the --swarm-port
• 12376, 12379, 12380, 12381, 12382, 12383, 12384, 12385, 12386, 12387
• 4789 (udp) and 7946 (tcp/udp) for overlay networking

SELinux

If you are installing UCP on a manager node with SELinunx enabled at the daemon and operating system level, you will need to pass --security-opt label=disable in to your install command. This flag will disable SELinux policies on the installation container. The UCP installation container mounts and configures the Docker Socket as part of the UCP installation container, therefore the UCP installation will fail with a permission denied error if you fail to pass in this flag.

FATA[0000] unable to get valid Docker client: unable to ping Docker daemon: Got
permission denied while trying to connect to the Docker daemon socket at
unix:///var/run/docker.sock: Get http://%2Fvar%2Frun%2Fdocker.sock/_ping: dial
unix /var/run/docker.sock: connect: permission denied - If SELinux is enabled
on the Docker daemon, make sure you run UCP with "docker run --security-opt
label=disable -v /var/run/docker.sock:/var/run/docker.sock ..."

An installation command for a system with SELinux enabled at the daemon level would be:

docker container run \
    --rm \
    --interactive \
    --tty \
    --name ucp \
    --security-opt label=disable \
    --volume /var/run/docker.sock:/var/run/docker.sock \
    docker/ucp \
    install [command options]

Cloud Providers

If you are installing on a public cloud platform there is cloud specific UCP installation documentation:

• For Microsoft Azure this is mandatory
• For AWS this is optional.

Options