--- title: "Canal brings fine-grained policy to DC/OS and Apache Mesos via CNI" source: "https://www.tigera.io/blog/canal_brings_fine-grained_policy_to_dcos_and_apache_mesos_via_cni/" --- [Technical Blog](https://www.tigera.io/category/technical-blog/) # Canal brings fine-grained policy to DC/OS and Apache Mesos via CNI By [Andrew Randall](https://www.tigera.io/blog/author/andrewrandall/) on Jun 01, 2016 • 3 min read When we launched Canal at CoreOS Fest last month, we indicated that this was the start of something bigger than just the constituent projects (Calico and Flannel). Today, at Mesoscon, we unveiled another big step forward for Canal – support for Apache Mesos, bringing fine-grained network policy to the Mesos and DC/OS communities. **Didn’t Calico already support Apache Mesos and DC/OS?** Well, yes we did! (See demos [here](https://www.tigera.io/blog/mesos-networking-leaps-forward-with-calico/) and [here](https://www.tigera.io/blog/calico-dcos-demo-security-speed-and-no-more-port-forwarding/), for example). In fact, Calico was the first networking solution to implement the “IP per container” model. But we did so through the net-modules interface, which was specific to that platform. That means that the work we did on Canal, to combine Calico and Flannel via the Container Network Interface (CNI) that is used by Kubernetes, would not translate to Apache Mesos and DC/OS. That is why we were excited to work with the team that has taken the CNI specification and [implemented it](http://github.com/apache/mesos/blob/master/docs/cni.md) for Apache Mesos. A huge shout-out here to the development team behind this leap forward, including Avinash Sridharan, Jie Yu and Qian Zhang, who are [speaking today](http://mesosconna2016.sched.org/event/6jtd/container-network-interface-cni-support-in-apache-mesos-jie-yu-avinash-sridharan-mesosphere-qian-zhang-ibm) at Mesoscon about their work. **Why should I care about this?** First, **an ever-growing community is now embracing CNI** as the de facto standard interface for cloud-native networking, and all the goodness of Canal (dynamic, fine-grained policy with the broadest choice of connectivity options) is now available to an even wider group of users. The consensus and momentum behind a simple, secure model for cloud-native network is growing, and we’re proud to be part of this movement! Second, it means that, as a Mesos or DC/OS user, **you now have access to the powerful network policy capabilities developed in the Kubernetes community** (see the [Kubernetes Networking SIG blog post](http://blog.kubernetes.io/2016/04/Kubernetes-Network-Policy-APIs.html) on this topic). Simply apply labels to tasks when launching them via Marathon, define the policies that apply to those labels (in the same way as you would with the new Kubernetes API – but passing them into Calico rather than Kubernetes), and sit back and watch Calico automagically maintain dynamic, distributed firewalls around every task. It’s that simple! **Awesome. When can I get it?** Support for CNI (and hence for Canal and Calico via CNI) will be generally available along with the upcoming Apache Mesos 1.0 release. As always, there is still work to do – including integration with workloads running under Docker Engine (today just the Unified Containerizer is supported) and the Marathon UI for seamless operation in DC/OS – but we are excited at this milestone and hope you will be too. We look forward to hearing your thoughts over on Slack ([get an invite](https://slack.projectcalico.org/) if you’re not already a member) – we have a dedicated [#Mesos](http://calicousers.slack.com/archives/mesos) channel for discussions of all things Apache Mesos and DC/OS related. **What about Docker?** If you’re wondering about CNI support for Docker… check out this [proof of concept](http://www.weave.works/cni-for-docker-containers/) we worked on with our friends over at Weaveworks!… but for those of you who are using our libnetwork integration – don’t worry, Calico will continue to support that. While we’re excited about the momentum behind CNI, we don’t believe there will ever be just one way of doing things – and we’re committed to our mission of bringing simple, secure networking to all the major cloud platforms. [Open Source](https://www.tigera.io/tags/open-source/)[Partner/Integration](https://www.tigera.io/tags/partner-integration/)[Project Calico](https://www.tigera.io/tags/project-calico/) ## Related posts [![What’s new in Calico: Spring 2026 Release](https://www.tigera.io/app/uploads/2026/06/Whats-New-in-Calico-NEW-TEMPLATE-2026.png)](https://www.tigera.io/blog/whats-new-in-calico-spring-2026-release/) [Company Blog](https://www.tigera.io/category/company-blog/) #### [What’s new in Calico: Spring 2026 Release](https://www.tigera.io/blog/whats-new-in-calico-spring-2026-release/) By [Veronika Smolik](https://www.tigera.io/blog/author/veronika-smolik/) on Jun 2, 2026 Kubernetes has come a long way since its debut in 2014. It’s gone from running a couple of containerized microservices to orchestrating fleets of production workloads spanning everything from AI agents to full scale VMs... [Read more](https://www.tigera.io/blog/whats-new-in-calico-spring-2026-release/) [![Kubernetes Operational Maturity: Secure and Resilient Cluster Federation with Cluster Mesh](https://www.tigera.io/app/uploads/2026/05/Kubernetes-Operational-Maturity-Secure-and-Resilient-Cluster-Federation-with-Cluster-Mesh.png)](https://www.tigera.io/blog/kubernetes-operational-maturity-secure-and-resilient-cluster-federation-with-cluster-mesh/) #### [Kubernetes Operational Maturity: Secure and Resilient Cluster Federation with Cluster Mesh](https://www.tigera.io/blog/kubernetes-operational-maturity-secure-and-resilient-cluster-federation-with-cluster-mesh/) By [Veronika Smolik](https://www.tigera.io/blog/author/veronika-smolik/) on May 25, 2026 Practically no one runs a single Kubernetes cluster in production these days. Maybe that’s how it started but data sovereignty requirements, acquisitions, AI initiatives and the need for edge servers, among other considerations, have pulled... [Read more](https://www.tigera.io/blog/kubernetes-operational-maturity-secure-and-resilient-cluster-federation-with-cluster-mesh/) [![What’s New in Calico v3.32](https://www.tigera.io/app/uploads/2026/05/Green-Please-use-a-different-background-color-alternately-1.png)](https://www.tigera.io/blog/whats-new-in-calico-v3-32/) #### [What’s New in Calico v3.32](https://www.tigera.io/blog/whats-new-in-calico-v3-32/) By [Reza Ramezanpour](https://www.tigera.io/blog/author/rezar/) on May 13, 2026 We’re excited to announce the release of Calico Open Source v3.32! 🎉 This release corresponds with Kubernetes v1.36 (Codename Haru) and it goes beyond just sharing a cat as the mascot of the release, it... [Read more](https://www.tigera.io/blog/whats-new-in-calico-v3-32/)