Microsoft and Docker Collaborate to Bring Cloud Native Application Bundle

Microsoft and Docker partnered and announced open source, the cloud-agnostic specification for packaging and running distributed applications called Cloud Native Application Bundle (CNAB). Docker, HashiCorp, and Bitnami will also offer CNAB bundles that customers would be able to host or download from DockerHub, GitHub, etc.

Why CNAB?

As industry moved toward the cloud environment, legacy and new edge modern applications followed the trend to run on cloud computing infrastructure and leverage different cloud capabilities such as elasticity, high availability, and resiliency. However, organizations are moving towards the hybrid cloud strategies that demand on-premise as well as off-premise or public/remote cloud environments.

Tools like Terraform for the infrastructure, Helm charts, and Docker Compose files for the applications, and CloudFormation or ARM templates for the cloud-services needs to be managed separately. And there was a need to define a specification for packaging these multi-service, multi-format distributed applications and this is where Microsoft and Docker came together to release Cloud Native Application Bundle (CNAB).

How CNAB helps?

CNAB specification helps in unifying the management of multi-service, distributed applications across different toolchains into a single all-in-one packaging format. It defines resources that can be deployed to any combination of runtime environments and tooling including Docker Engine, Kubernetes, Helm, automation tools and cloud services.

Docker is the first company to implement CNAB specification and docker-app experimental tool for building, packaging and managing cloud-native applications

According to the Docker announcement, "Docker lets you package CNAB bundles as Docker images, so you can distribute and share through Docker registry tools including Docker Hub and Docker Trusted Registry. Additionally, Docker will enable organizations to deploy and manage CNAB-based applications in Docker Enterprise in the upcoming months."

Microsoft in their CNAB announcement noted below features that CNAB tries to address:

• Manage discrete resources as a single logical unit that comprises an app.
• Use and define operational verbs for lifecycle management of an app (install, upgrade, uninstall).
• Sign and digitally verify a bundle, even when the underlying technology doesn’t natively support it.
• Attest (or attach a signature to any moment in the lifecycle of that bundle) and digitally verify that the bundle has achieved that state to control how the bundle can be used.
• Enable the export of the bundle and all dependencies to reliably reproduce in another environment, including offline environments (IoT edge, air-gapped environments).
• Store bundles in repositories for remote installation.

Snip from duffle.sh

Microsoft has also released a tool called Duffle. It is an open source CNAB client reference implementation. Duffle client can help in installing, upgrading, and uninstalling CNAB bundles. Its other useful capabilities include creating new bundles, cryptographically signing bundles with PGP, and verify their integrity.

CNAB draft specification is available at cnab.io