--- title: "Canal brings fine-grained policy to DC/OS and Apache Mesos via CNI" source: "https://wordpress-1075849-4005834.cloudwaysapps.com/blog/canal_brings_fine-grained_policy_to_dcos_and_apache_mesos_via_cni/" --- [Technical Blog](https://wordpress-1075849-4005834.cloudwaysapps.com/category/technical-blog/) # Canal brings fine-grained policy to DC/OS and Apache Mesos via CNI By [Andrew Randall](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/author/andrewrandall/) on Jun 01, 2016 • 3 min read When we [launched Canal](http://dev-project-calico.pantheonsite.io/canal-tigera/) at CoreOS Fest last month, we indicated that this was the start of something bigger than just the constituent projects (Calico and Flannel). Today, at Mesoscon, we unveiled another big step forward for Canal – support for Apache Mesos, bringing fine-grained network policy to the Mesos and DC/OS communities. **Didn’t Calico already support Apache Mesos and DC/OS?** Well, yes we did! (See demos [here](http://dev-project-calico.pantheonsite.io/mesos-networking-leaps-forward-with-calico/) and [here](http://dev-project-calico.pantheonsite.io/calico-dcos-demo-security-speed-and-no-more-port-forwarding/), for example). In fact, Calico was the first networking solution to implement the “IP per container” model. But we did so through the net-modules interface, which was specific to that platform. That means that the work we did on Canal, to combine Calico and Flannel via the Container Network Interface (CNI) that is used by Kubernetes, would not translate to Apache Mesos and DC/OS. That is why we were excited to work with the team that has taken the CNI specification and [implemented it](http://github.com/apache/mesos/blob/master/docs/cni.md) for Apache Mesos. A huge shout-out here to the development team behind this leap forward, including Avinash Sridharan, Jie Yu and Qian Zhang, who are [speaking today](http://mesosconna2016.sched.org/event/6jtd/container-network-interface-cni-support-in-apache-mesos-jie-yu-avinash-sridharan-mesosphere-qian-zhang-ibm) at Mesoscon about their work. **Why should I care about this?** First, **an ever-growing community is now embracing CNI** as the de facto standard interface for cloud-native networking, and all the goodness of Canal (dynamic, fine-grained policy with the broadest choice of connectivity options) is now available to an even wider group of users. The consensus and momentum behind a simple, secure model for cloud-native network is growing, and we’re proud to be part of this movement! Second, it means that, as a Mesos or DC/OS user, **you now have access to the powerful network policy capabilities developed in the Kubernetes community** (see the [Kubernetes Networking SIG blog post](http://blog.kubernetes.io/2016/04/Kubernetes-Network-Policy-APIs.html) on this topic). Simply apply labels to tasks when launching them via Marathon, define the policies that apply to those labels (in the same way as you would with the new Kubernetes API – but passing them into Calico rather than Kubernetes), and sit back and watch Calico automagically maintain dynamic, distributed firewalls around every task. It’s that simple! **Awesome. When can I get it?** Support for CNI (and hence for Canal and Calico via CNI) will be generally available along with the upcoming Apache Mesos 1.0 release. As always, there is still work to do – including integration with workloads running under Docker Engine (today just the Unified Containerizer is supported) and the Marathon UI for seamless operation in DC/OS – but we are excited at this milestone and hope you will be too. We look forward to hearing your thoughts over on Slack ([get an invite](https://slack.projectcalico.org/) if you’re not already a member) – we have a dedicated [#Mesos](http://calicousers.slack.com/archives/mesos) channel for discussions of all things Apache Mesos and DC/OS related. **What about Docker?** If you’re wondering about CNI support for Docker… check out this [proof of concept](http://www.weave.works/cni-for-docker-containers/) we worked on with our friends over at Weaveworks!… but for those of you who are using our libnetwork integration – don’t worry, Calico will continue to support that. While we’re excited about the momentum behind CNI, we don’t believe there will ever be just one way of doing things – and we’re committed to our mission of bringing simple, secure networking to all the major cloud platforms. [Open Source](https://wordpress-1075849-4005834.cloudwaysapps.com/tags/open-source/)[Partner/Integration](https://wordpress-1075849-4005834.cloudwaysapps.com/tags/partner-integration/)[Project Calico](https://wordpress-1075849-4005834.cloudwaysapps.com/tags/project-calico/) Add Tigera as a preferred source on Google to see more of our content in your search results. [![Add as a preferred source on Google](https://wordpress-1075849-4005834.cloudwaysapps.com/app/themes/tigera2021/dist/img/google-preferred-source-light.png)](https://www.google.com/preferences/source?q=tigera.io) ## Related posts [![What’s New in Calico: Winter 2026 Release](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2026/03/What-is-new-in-Calico-winter-2026.png)](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/whats-new-in-calico-winter-2026-release/) [Company Blog](https://wordpress-1075849-4005834.cloudwaysapps.com/category/company-blog/) #### [What’s New in Calico: Winter 2026 Release](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/whats-new-in-calico-winter-2026-release/) By [Veronika Smolik](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/author/veronika-smolik/) on Mar 4, 2026 AI Powered Intelligence, Unified Traffic Observability and Scalable Infrastructure Management As anyone managing one or more Kubernetes clusters knows by now, scaling can introduce an exponentially growing number of problems. The sheer volume of metrics,... [Read more](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/whats-new-in-calico-winter-2026-release/) [![Join Calico at KubeCon Europe 2026: AI Agents, Silent Discos, and Dutch Delights!](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2026/02/Blog-Kubecon-Euro-2026-.png)](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/calico-at-kubecon-cloudnativecon-europe2026/) #### [Join Calico at KubeCon Europe 2026: AI Agents, Silent Discos, and Dutch Delights!](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/calico-at-kubecon-cloudnativecon-europe2026/) By [Tigera Team](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/author/marketingtigera-io/) on Feb 25, 2026 The cloud-native community is heading to the historic canals and vibrant tech scene of Amsterdam for KubeCon + CloudNativeCon Europe 2026! From March 23–26, Amsterdam will be buzzing with the latest in Kubernetes, platform engineering,... [Read more](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/calico-at-kubecon-cloudnativecon-europe2026/) [![Project Calico 3.30+ Hackathon: Show Us What You Can Build!](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2026/02/Blog-Hackathon-.png)](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/project-calico-3-30-hackathon-show-us-what-you-can-build/) #### [Project Calico 3.30+ Hackathon: Show Us What You Can Build!](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/project-calico-3-30-hackathon-show-us-what-you-can-build/) By [Tigera Team](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/author/marketingtigera-io/) on Feb 17, 2026 Build the Future of Cloud-Native Networking! 🚀 The Calico community moves fast. With the releases of Calico 3.30 and 3.31, brings improvements in scalability, network security, and visibility. Now, we want to see what YOU... [Read more](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/project-calico-3-30-hackathon-show-us-what-you-can-build/)