Docker Datacenter on Docker 1.13: Secrets, Security Scanning, Content Cache, and More

Originally published February 2017. Source: docker.com. This article summarises the Docker Datacenter release built on Docker Engine 1.13.

Docker Datacenter (DDC) received a significant update alongside Docker Engine 1.13, bringing enterprise-grade features across secrets management, image security, networking, application deployment, image distribution, and platform usability. Below is a detailed breakdown of each major feature area.

Integrated Secrets Management

DDC 1.13 includes first-class, integrated secrets management that spans the full application lifecycle — from development through to production. Teams can store sensitive data such as passwords, API keys, and TLS certificates securely on the cluster, then inject those secrets directly into services at runtime without embedding them in images or environment variables.

Developers reference secrets using the familiar Docker Compose file format, making handoff to operations teams straightforward. On the enterprise side, DDC adds:

• Lifecycle management via the UI: Create, update, and delete secrets through the Universal Control Plane (UCP) dashboard.
• Label-based access control: Granular permissions allow you to restrict which users and services can access a given secret.
• Audit logging: All access to secrets is logged via syslog, providing a clear audit trail for compliance requirements.

Image Security Scanning and Vulnerability Monitoring

Building on the existing Docker Content Trust feature, DDC 1.13 adds Docker Security Scanning — binary-level scanning of images and all their constituent layers. The scanner works as follows:

1. Bill of Materials (BOM) generation: Each image is analysed and a complete list of packages and their versions is recorded.
2. CVE database cross-reference: The BOM is checked against multiple Common Vulnerabilities and Exposures (CVE) databases to flag known issues.
3. Ongoing monitoring: The stored BOM is rechecked regularly. If a new vulnerability is published against an already-scanned package, affected users can be notified without needing to re-push an image.

System administrators can also connect their CI pipelines and build systems to the scanning service through the new registry webhooks feature (covered below), enabling automated vulnerability gating before images are promoted to production.

HTTP Routing Mesh (HRM) — Now Production-Ready

Previously experimental, the HTTP Routing Mesh (HRM) graduates to production status in this release. HRM extends Docker’s existing swarm-mode network routing mesh by enabling hostname-based routing of HTTP traffic to the correct backend service — similar in concept to a Layer 7 load balancer or ingress controller.

New capabilities in this release include:

• UI-based HRM management: Configure hostname routing rules for a service directly from the DDC admin dashboard.
• HTTPS pass-through via SNI: Route TLS traffic without terminating the connection at the mesh, preserving end-to-end encryption.
• Multiple HRM networks: Isolate different applications using separate HRM networks.
• Sticky sessions: Route repeated requests from the same client to the same backend service instance.

Compose for Services (Stack Deployment)

DDC 1.13 significantly expands support for stacks — multi-service applications defined as groups of services, networks, and volumes. Using Docker Compose file format version 3.1 (.yml), teams can:

• Define multi-service applications in a single Compose file, including secrets references introduced in Compose v3.1.
• Deploy stacks via both the UCP UI and the Docker CLI (docker stack deploy).
• Manage the full lifecycle of a stack — and its individual services, tasks, networks, and volumes — directly from the UCP dashboard after deployment.

This workflow closes the gap between developer and operations tooling: developers author the Compose file, and operations teams deploy it into production without translation or reformatting.

Content Cache (Satellite Registry Caching)

For organisations with engineering teams spread across multiple geographic locations, pulling images from a central registry thousands of miles away introduces latency and consumes significant bandwidth. DDC 1.13 addresses this with satellite registry content caches.

Key characteristics of the content cache feature:

• Per-user or location-based assignment: Caches can be assigned to individual users, or users can select the nearest cache themselves.
• High availability support: Caches can be configured in HA mode to eliminate a single point of failure.
• Cache chaining: For complex, multi-tier datacenter environments, caches can be chained together — a regional cache pulling from a central cache rather than the origin registry directly.

Registry Webhooks

DDC 1.13 adds a comprehensive webhook system to Docker Trusted Registry (DTR), enabling integration with external systems and CI/CD pipelines. Webhook events include:

• Image push and pull events on specific repositories
• Security scanning completion events (pass or fail)
• Repository creation and deletion
• System-level events such as garbage collection

By triggering on scan events, teams can build automated pipelines that block promotion of a vulnerable image to a production repository, or notify on-call engineers when a newly published CVE affects an image already running in production.

Usability Improvements

Beyond the headline features, this release delivers a number of quality-of-life improvements for both developers and platform administrators:

• Cluster and node metrics: CPU, memory, and disk usage are now visible at both the cluster level (dashboard summary) and per-node level. Nodes can be sorted by resource usage to quickly identify contention or failures.
• Rolling update improvements: Services can now be rolled back automatically during a failed rolling update, and status notifications keep operators informed throughout the process.
• Simplified DTR installation: The UCP UI now provides a copyable Docker Trusted Registry install command, reducing configuration errors during initial setup.
• Expanded LDAP/AD support: Additional LDAP and Active Directory configuration options are available directly within the UCP UI, reducing reliance on CLI-only configuration.
• Cloud deployment templates: One-click deployment templates for AWS and Azure allow organisations to stand up a DDC cluster in minutes.

Demo Video Series

Docker published a Docker Datacenter demo video series walking through these new features in detail. The playlist covers secrets management, security scanning, HRM configuration, stack deployment, and content caching in practical walkthroughs.

---

Note: Docker Datacenter has since been superseded by Docker Enterprise and subsequently Mirantis Kubernetes Engine (MKE) following Mirantis’s acquisition of Docker Enterprise in 2019. The features described here — secrets, security scanning, HRM, and stack deployment — have evolved significantly in later versions. Refer to current Mirantis documentation for up-to-date guidance.