Pilot: the core component of Istio's service mesh.
10K+
ubuntu/istio-pilot is a rock for pilot maintained by Canonical.
pilot is the Istio Pilot Discovery service that provides mesh-wide traffic management, security, and policy capabilities for the Istio Service Mesh.
NOTE: These tags follow a specific naming convention that respects the concept of channels.
| Tags | Supported until | Version | Base | Architectures | |
|---|---|---|---|---|---|
1-26.04_stable | aliases1-26.04, 1-26.04_beta, 1-26.04_candidate, 1-26.04_edge, 1.29-26.04_edge | 08/2026 | 1 | 26.04 | amd64 |
1.30-26.04_stable | aliases1.30-26.04, 1.30-26.04_beta, 1.30-26.04_candidate, 1.30-26.04_edge | 08/2026 | 1.30 | 26.04 | amd64 |
1-24.04_stable | aliases1-24.04, 1-24.04_beta, 1-24.04_candidate, 1-24.04_edge | 07/2026 | 1 | 24.04 | amd64 |
1.29-24.04_stable | aliases1.29-24.04, 1.29-24.04_beta, 1.29-24.04_candidate, 1.29-24.04_edge | 09/2026 | 1.29 | 24.04 | amd64 |
| Tags | Support ended on | Upgrade Path | |
|---|---|---|---|
1.24-24.04_stable | aliases1.24-24.041.24-24.04_beta1.24-24.04_candidate1.24-24.04_edge | 08/2025 | - |
This rock's entrypoint is Pebble, a container-optimized init process that enables the orchestration of a collection of local service processes as an organized set.
To view the Pebble services and checks defined in this rock:
docker run --rm ubuntu/istio-pilot:1.24-24.04_stable plan
To run this rock, use any of the usual container runtimes, for example, docker:
docker run --name istio-pilot-container \
-e TZ=UTC -p 8080:8080 -p 15017:15017 -p 15010:15010 -p 15012:15012 -p 15014:15014 \
ubuntu/istio-pilot:1.24-24.04_stable
Pilot Discovery starts and exposes service endpoints. Access the service locally at:
To view the logs of the running container, run:
docker exec istio-pilot-container pebble logs
Or, for a specific service:
docker exec istio-pilot-container pebble logs <service>
Rocks may have predefined health checks that you can list by running:
docker exec istio-pilot-container pebble checks
The overall health of your container can be inspected via:
docker exec istio-pilot-container pebble health
| Option | Description | Default |
|---|---|---|
| TZ | Set container timezone. | UTC |
| Option | Description | Default |
|---|---|---|
pilot-discovery discovery | Launch the Istio Pilot Discovery service with default values. | None |
--caCertFile <path> | File containing the x509 Server CA Certificate. | None |
--clusterAliases <key1=value1,key2=value2> | Alias names for clusters, provided as comma-separated key=value pairs. | [] |
--clusterID <cluster-id> | The ID of the cluster that this Istiod instance resides in. | Kubernetes |
--clusterRegistriesNamespace <namespace> | Namespace for the ConfigMap that stores cluster configurations. | istio-system |
--cniNamespace <namespace> | Namespace where the istio-cni resides. Uses POD_NAMESPACE if not set. | istio-system |
--configDir <path> | Directory to watch for updates to config YAML files, used as the config source instead of a CRD client. | None |
--ctrlz_address <address> | IP address for the ControlZ introspection facility; use '*' for all addresses. | localhost |
--ctrlz_port <port> | Port for the ControlZ introspection facility. | 9876 |
--domain <domain> | DNS domain suffix for the service mesh. | cluster.local |
--grpcAddr <address> | gRPC address for the discovery service. | :15010 |
--httpAddr <address> | HTTP address for the discovery service. | :8080 |
--httpsAddr <address> | HTTPS address for the injection and validation service. | :15017 |
--keepaliveInterval <duration> | Interval with no activity after which a keepalive ping is sent. | 30s |
--keepaliveMaxServerConnectionAge <duration> | Maximum duration a connection is kept open on the server before a graceful close. | 2562047h47m16.854775807s |
--keepaliveTimeout <duration> | Duration to wait after a keepalive ping before closing the connection if no activity is detected. | 10s |
--kubeconfig <path> | Path to a Kubernetes configuration file for out-of-cluster access. | None |
--kubernetesApiBurst <int> | Maximum burst for throttling when communicating with the Kubernetes API. | 160 |
--kubernetesApiQPS <int> | Maximum QPS when communicating with the Kubernetes API. | 80 |
--log_as_json | Format log output as JSON instead of plain text. | false |
--log_caller <scopes> | List of scopes for which to include caller information in logs. | None |
--log_output_level <scope:level> | Minimum logging level per scope for output, in the format :. | None |
--log_stacktrace_level <scope:level> | Minimum logging level per scope at which stack traces are captured. | default:none |
--log_target <targets> | Paths where log output is sent (for example stdout, stderr, or file paths). | [stdout] |
--meshConfig <path> | File name for the Istio mesh configuration. | ./etc/istio/config/mesh |
--monitoringAddr <address> | HTTP address for Pilot self-monitoring information. | :15014 |
--namespace <namespace> | Namespace where the controller resides; defaults to POD_NAMESPACE if not set. | istio-system |
--networksConfig <path> | File name for the Istio mesh networks configuration. | ./etc/istio/config/meshNetworks |
--profile | Enable profiling via the web interface at /debug/pprof. | true |
--registries <registries> | Comma separated list of service registries to read from. | [Kubernetes] |
--secureGRPCAddr <address> | Secured gRPC address for the discovery service. | :15012 |
--shutdownDuration <duration> | Duration the discovery server needs to terminate gracefully. | 10s |
--tls-cipher-suites <suites> | Comma-separated list of TLS cipher suites for the istiod TLS server. If omitted, default Go cipher suites are used. | None |
--tlsCertFile <path> | File containing the x509 Server Certificate. | None |
--tlsKeyFile <path> | File containing the x509 private key matching --tlsCertFile. | None |
--vklog <level> | Global log verbosity level (similar to the -v flag). | None |
Canonical is the provider of this container image. It is the user's responsibility to ensure that any use of this image complies with any relevant licenses for all software contained within, as well as with Canonical’s IP Policy.
Content type
Image
Digest
sha256:d85606754…
Size
73.7 MB
Last updated
about 2 months ago
docker pull ubuntu/istio-pilot:1.30-26.04_stablePulls:
259
Last week