<commit_before>---
title: UCP architecture
description: Learn about the architecture of Docker Universal Control Plane.
keywords: ucp, architecture
---

Universal Control Plane is a containerized application that runs on
[Docker Enterprise Edition](/ee/index.md), extending its functionality
to simplify the deployment, configuration, and monitoring of your applications at scale.

UCP also secures Docker with role-based access control so that only authorized
users can make changes and deploy applications to your Docker cluster.

![](images/ucp-architecture-1.svg){: .with-border}

Once Universal Control Plane (UCP) instance is deployed, developers and IT
operations no longer interact with Docker Engine directly, but interact with
UCP instead. Since UCP exposes the standard Docker API, this is all done
transparently, so that you can use the tools you already know and love, like
the Docker CLI client and Docker Compose.


## Under the hood

Docker UCP leverages the clustering and orchestration functionality provided
by Docker.

![](images/ucp-architecture-2.svg){: .with-border}

A swarm is a collection of nodes that are in the same Docker cluster.
[Nodes](/engine/swarm/key-concepts.md) in a Docker swarm operate in one of two
modes: Manager or Worker. If nodes are not already running in a swarm when
installing UCP, nodes will be configured to run in swarm mode.

When you deploy UCP, it starts running a globally scheduled service called
`ucp-agent`. This service monitors the node where it's running and starts
and stops UCP services, based on whether the node is a
[manager or a worker node](/engine/swarm/key-concepts.md).

If the node is a:

* **Manager**: the `ucp-agent` service automatically starts serving all UCP
  components, including the UCP web UI and data stores used by UCP. The
  `ucp-agent` accomplishes this by
  [deploying several containers](#ucp-components-in-manager-nodes)
  on the node. By promoting a node to manager, UCP automatically becomes
  highly available and fault tolerant.
* **Worker**: on worker nodes, the `ucp-agent` service starts serving a proxy
  service that ensures only authorized users and other UCP services can run
  Docker commands in that node. The `ucp-agent` deploys a
  [subset of containers](#ucp-components-in-worker-nodes) on worker nodes.

## UCP internal components

The core component of UCP is a globally-scheduled service called `ucp-agent`.
When you install UCP on a node, or join a node to a swarm that's being managed
by UCP, the `ucp-agent` service starts running on that node.

Once this service is running, it deploys containers with other UCP components,
and it ensures they keep running. The UCP components that are deployed
on a node depend on whether the node is a manager or a worker.

> OS-specific component names
>
> Some UCP component names depend on the node's operating system. For example,
> on Windows, the `ucp-agent` component is named `ucp-agent-win`.
> [Learn about architecture-specific images](admin/install/architecture-specific-images.md).

Internally, UCP uses the following components:

* Calico v3.5
* Kubernetes v1.11.5

### UCP components in manager nodes

Manager nodes run all UCP services, including the web UI and data stores that
persist the state of UCP. These are the UCP services running on manager nodes:

| UCP component                   | Description                                                                                                                                                                                                                                                                                                                                                     |
|:--------------------------------|:----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| k8s_calico-kube-controllers     | A cluster-scoped Kubernetes controller used to coordinate Calico networking. Runs on one manager node only.                                                                                                                                                                                                                                                     |
| k8s_calico-node                 | The Calico node agent, which coordinates networking fabric according to the cluster-wide Calico configuration. Part of the `calico-node` daemonset. Runs on all nodes. Configure the CNI plugin by using the `--cni-installer-url` flag. If this flag isn't set, UCP uses Calico as the default CNI plugin.                                                     |
| k8s_install-cni_calico-node     | A container that's responsible for installing the Calico CNI plugin binaries and configuration on each host. Part of the `calico-node` daemonset. Runs on all nodes.                                                                                                                                                                                            |
| k8s_POD_calico-node             | Pause container for the `calico-node` pod.                                                                                                                                                                                                                                                                                                                      |
| k8s_POD_calico-kube-controllers | Pause container for the `calico-kube-controllers` pod.                                                                                                                                                                                                                                                                                                          |
| k8s_POD_compose                 | Pause container for the `compose` pod.                                                                                                                                                                                                                                                                                                                          |
| k8s_POD_kube-dns                | Pause container for the `kube-dns` pod.                                                                                                                                                                                                                                                                                                                         |
| k8s_ucp-dnsmasq-nanny           | A dnsmasq instance used in the Kubernetes DNS Service. Part of the `kube-dns` deployment. Runs on one manager node only.                                                                                                                                                                                                                                        |
| k8s_ucp-kube-compose            | A custom Kubernetes resource component that's responsible for translating Compose files into Kubernetes constructs. Part of the `compose` deployment. Runs on one manager node only.                                                                                                                                                                            |
| k8s_ucp-kube-dns                | The main Kubernetes DNS Service, used by pods to [resolve service names](https://v1-8.docs.kubernetes.io/docs/concepts/services-networking/dns-pod-service/). Part of the `kube-dns` deployment. Runs on one manager node only. Provides service discovery for Kubernetes services and pods. A set of three containers deployed via Kubernetes as a single pod. |
| k8s_ucp-kubedns-sidecar         | Health checking and metrics daemon of the Kubernetes DNS Service. Part of the `kube-dns` deployment. Runs on one manager node only.                                                                                                                                                                                                                             |
| ucp-agent                       | Monitors the node and ensures the right UCP services are running.                                                                                                                                                                                                                                                                                               |
| ucp-auth-api                    | The centralized service for identity and authentication used by UCP and DTR.                                                                                                                                                                                                                                                                                    |
| ucp-auth-store                  | Stores authentication configurations and data for users, organizations, and teams.                                                                                                                                                                                                                                                                              |<commit_msg>Update ucp-architecture.md<commit_after>---
title: UCP architecture
description: Learn about the architecture of Docker Universal Control Plane.
keywords: ucp, architecture
---

Universal Control Plane is a containerized application that runs on
[Docker Enterprise Edition](/ee/index.md), extending its functionality
to simplify the deployment, configuration, and monitoring of your applications at scale.

UCP also secures Docker with role-based access control so that only authorized
users can make changes and deploy applications to your Docker cluster.

![](images/ucp-architecture-1.svg){: .with-border}

Once Universal Control Plane (UCP) instance is deployed, developers and IT
operations no longer interact with Docker Engine directly, but interact with
UCP instead. Since UCP exposes the standard Docker API, this is all done
transparently, so that you can use the tools you already know and love, like
the Docker CLI client and Docker Compose.


## Under the hood

Docker UCP leverages the clustering and orchestration functionality provided
by Docker.

![](images/ucp-architecture-2.svg){: .with-border}

A swarm is a collection of nodes that are in the same Docker cluster.
[Nodes](/engine/swarm/key-concepts.md) in a Docker swarm operate in one of two
modes: Manager or Worker. If nodes are not already running in a swarm when
installing UCP, nodes will be configured to run in swarm mode.

When you deploy UCP, it starts running a globally scheduled service called
`ucp-agent`. This service monitors the node where it's running and starts
and stops UCP services, based on whether the node is a
[manager or a worker node](/engine/swarm/key-concepts.md).

If the node is a:

* **Manager**: the `ucp-agent` service automatically starts serving all UCP
  components, including the UCP web UI and data stores used by UCP. The
  `ucp-agent` accomplishes this by
  [deploying several containers](#ucp-components-in-manager-nodes)
  on the node. By promoting a node to manager, UCP automatically becomes
  highly available and fault tolerant.
* **Worker**: on worker nodes, the `ucp-agent` service starts serving a proxy
  service that ensures only authorized users and other UCP services can run
  Docker commands in that node. The `ucp-agent` deploys a
  [subset of containers](#ucp-components-in-worker-nodes) on worker nodes.

## UCP internal components

The core component of UCP is a globally-scheduled service called `ucp-agent`.
When you install UCP on a node, or join a node to a swarm that's being managed
by UCP, the `ucp-agent` service starts running on that node.

Once this service is running, it deploys containers with other UCP components,
and it ensures they keep running. The UCP components that are deployed
on a node depend on whether the node is a manager or a worker.

> OS-specific component names
>
> Some UCP component names depend on the node's operating system. For example,
> on Windows, the `ucp-agent` component is named `ucp-agent-win`.
> [Learn about architecture-specific images](admin/install/architecture-specific-images.md).

Internally, UCP uses the following components:

* Calico v3.5
* Kubernetes v1.11.5

### UCP components in manager nodes

Manager nodes run all UCP services, including the web UI and data stores that
persist the state of UCP. These are the UCP services running on manager nodes:

| UCP component                   | Description                                                                                                                                                                                                                                                                                                                                                     |
|:--------------------------------|:----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| k8s_calico-kube-controllers     | A cluster-scoped Kubernetes controller used to coordinate Calico networking. Runs on one manager node only.                                                                                                                                                                                                                                                     |
| k8s_calico-node                 | The Calico node agent, which coordinates networking fabric according to the cluster-wide Calico configuration. Part of the `calico-node` daemonset. Runs on all nodes. Configure the CNI plugin by using the `--cni-installer-url` flag. If this flag isn't set, UCP uses Calico as the default CNI plugin.                                                     |
| k8s_install-cni_calico-node     | A container that's responsible for installing the Calico CNI plugin binaries and configuration on each host. Part of the `calico-node` daemonset. Runs on all nodes.                                                                                                                                                                                            |
| k8s_POD_calico-node             | Pause container for the `calico-node` pod.                                                                                                                                                                                                                                                                                                                      |
| k8s_POD_calico-kube-controllers | Pause container for the `calico-kube-controllers` pod.                                                                                                                                                                                                                                                                                                          |
| k8s_POD_compose                 | Pause container for the `compose` pod.                                                                                                                                                                                                                                                                                                                          |
| k8s_POD_kube-dns                | Pause container for the `kube-dns` pod.                                                                                                                                                                                                                                                                                                                         |
| k8s_ucp-dnsmasq-nanny           | A dnsmasq instance used in the Kubernetes DNS Service. Part of the `kube-dns` deployment. Runs on one manager node only.                                                                                                                                                                                                                                        |
| k8s_ucp-kube-compose            | A custom Kubernetes resource component that's responsible for translating Compose files into Kubernetes constructs. Part of the `compose` deployment. Runs on one manager node only.                                                                                                                                                                            |
| k8s_ucp-kube-dns                | The main Kubernetes DNS Service, used by pods to [resolve service names](https://v1-11.docs.kubernetes.io/docs/concepts/services-networking/dns-pod-service/). Part of the `kube-dns` deployment. Runs on one manager node only. Provides service discovery for Kubernetes services and pods. A set of three containers deployed via Kubernetes as a single pod. |
| k8s_ucp-kubedns-sidecar         | Health checking and metrics daemon of the Kubernetes DNS Service. Part of the `kube-dns` deployment. Runs on one manager node only.                                                                                                                                                                                                                             |
| ucp-agent                       | Monitors the node and ensures the right UCP services are running.                                                                                                                                                                                                                                                                                               |
| ucp-auth-api                    | The centralized service for identity and authentication used by UCP and DTR.                                                                                                                                                                                                                                                                                    |
| ucp-auth-store                  | Stores authentication configurations and data for users, organizations, and teams.                                                                                                                                                                                                                                                                              |
{'fraction_non_alphanumeric': 0.07942803465191525, 'fraction_numerical': 0.0022440246320843335, 'mean_word_length': 0.8872365570218633, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 13, 'https://': 2, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 331, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '7526783', 'n_tokens_mistral': 3200, 'n_tokens_neox': 3037, 'n_words': 1473}