$30 off During Our Annual Pro Sale. View Details »

Understanding Containers through their Runtimes

Understanding Containers through their Runtimes

Exploring the technology and standards behind containers, diving deep into container runtime, and using containerd daemon to bring up containers to explain the inner workings.

Siddharth Balyan

January 23, 2022

More Decks by Siddharth Balyan

Other Decks in Technology


  1. Understanding Containers through their Runtimes Siddharth Balyan 1 1

  2. ❯ whoami 2 2

  3. Student aspiring to be security researcher / engineer Part of

    null’s Cloud Security Study Group Have been diving into Cloud and Cloud Native as a result 3 3
  4. Topics covered Docker and Containers Technologies behind a container (

    cgroups ; namespaces ; OCI; Container Runtime ) Container Runtime & containerd Hands-on on containerd using CLI and Golang API 4 4
  5. Picture this Docker → Docker Engine → docker & dockerd

    → Containers → cgroups / namespaces → containerd → runC → Ever tried to explore and understand what containers are, how docker works, how containers are made and then having terms like these confuse you? 5 5
  6. What are containers and where have you seen them 6

  7. Docker ~= Containers Docker almost synonymous with Containers. Containers are

    their own technology. Docker has abstracted them to making them usable for packaging applications. 7 7
  8. Docker Architecture 8 8

  9. So how does Docker work? 9 9

  10. Your docker run -it ubuntu bash command is Docker CLI.

    It communicates to dockerd , the Docker Daemon which is what pulls the image and spawns the container. 10 10
  11. 11 11

  12. Let’s try to get a better understanding On to the

    documentation we go. 12 12
  13. We’ve found new rabbit holes! “The Docker daemon relies on

    an OCI compliant runtime (invoked via the containerd daemon) as its interface to the Linux kernel namespaces , cgroups , and SELinux .” 13 13
  14. That is one loaded sentence. Let’s break it down then.

    Not this kind of breakdown, although this truly was me when I was first trying to understand it. 14 14
  15. Topic Breakdown The statement can be broken into 3 topics

    cgroups and namespaces OCI - Open Containers Initiative Container Runtimes 15 15
  16. cgroups Linux kernel feature that allow processes to be organized

    into hierarchical groups whose usage of resources can be monitored or controlled. 16 16
  17. 17 17

  18. namespaces Linux kernel feature that partitions the kernel resources so

    that one set of resources can only view a specific set of resources. 18 18
  19. 19 19

  20. cgroups : Control the usage of resources namespaces : Control

    the visibility of resources You can make your own container from scratch using cgroups and namespaces ! 20 20
  21. Coming back to the explanation Let’s do OCI next “The

    Docker daemon relies on a OCI compliant runtime (invoked via the containerd daemon) as its interface to the Linux kernel namespaces , cgroups , and SELinux .” 21 21
  22. OCI (Open Container Initiative) It’s an open governance structure (formed

    by Docker, CoreOS etc.) to decide on container formats and runtimes. Designed to set standards and specifications so that; # Running an image ❯ docker run example.com/org/app:v1.0.0 ❯ rkt run example.com/org/app:v1.0.0 ❯ some-random-engine run example.com/org/app:v1.0.0 22 22
  23. Runtime Specification: Defines how exactly does your container start and

    run when you run docker run . Image Specification: Defines the standard format of a container image. 23 23
  24. So, OCI has defined a runtime standard which is to

    be followed by software programs which run the containers… 24 24
  25. "The Docker daemon relies on a OCI compliant runtime (invoked

    via the containerd daemon) as its interface to the Linux kernel namespaces , cgroups , and SELinux .” 25 25
  26. Container Runtime Container Runtimes: This is the software component that

    executes the containers on the host system. dockerd containerd cri-o 26 26
  27. 27 27

  28. 28 28

  29. runC ??? 29 29

  30. OCI ⇾ runC ⇾ containerd ⇾ dockerd ⇾ docker CLI

    ⇾ docker run -it ubuntu bash 30 30
  31. 31 31

  32. Hands on with containerd containerd is a Go-native way to

    bring up and spawn containers. You can use control containerd manually too! ctr : containerd CLI tool Go APIs 32 32
  33. 33 33

  34. containerd with ctr Pull and import images Create containers Start

    processes in containers Kill containers and images 34 34
  35. containerd with Golang Using containerd Go APIs to: Pull an

    image Create, start and exit a task 35 35
  36. References Ivan Velichko’s blogs: https://iximiuz.com/en/posts/oci- containers/ containerd Documentation: https://pkg.go.dev/github.com/containerd/containerd#se readme

    containerd Getting Started Page: https://containerd.io/docs/getting-started/ Demystifying Containers Series: https://github.com/saschagrunert/demystifying-containe 36 36