Understanding Containers through their Runtimes

Exploring the technology and standards behind containers, diving deep into container runtime, and using containerd daemon to bring up containers to explain the inner workings.

Transcript

1. Understanding Containers
   through their Runtimes
   Siddharth Balyan
   1
   1
   

   View Slide

2. ❯ whoami
   2
   2
   

   View Slide

3. Student aspiring to be security researcher / engineer
   Part of null’s Cloud Security Study Group
   Have been diving into Cloud and Cloud Native as a
   result
   3
   3
   

   View Slide

4. Topics covered
   Docker and Containers
   Technologies behind a container
   ( cgroups ; namespaces ; OCI; Container Runtime )
   Container Runtime & containerd
   Hands-on on containerd using CLI and Golang API
   4
   4
   

   View Slide

5. Picture this
   Docker → Docker Engine → docker & dockerd →
   Containers → cgroups / namespaces → containerd
   → runC →
   Ever tried to explore and understand what
   containers are, how docker works, how containers
   are made and then having terms like these confuse
   you?
   5
   5
   

   View Slide

6. What are containers and where have you
   seen them
   6
   6
   

   View Slide

7. Docker ~= Containers
   Docker almost synonymous with Containers.
   Containers are their own technology.
   Docker has abstracted them to making them usable
   for packaging applications.
   7
   7
   

   View Slide

8. Docker Architecture
   8
   8
   

   View Slide

9. So how does Docker work?
   9
   9
   

   View Slide

10. Your docker run -it ubuntu bash command is
    Docker CLI.
    It communicates to dockerd , the Docker Daemon
    which is what pulls the image and spawns the
    container.
    10
    10
    

    View Slide

11. View Slide

12. Let’s try to get a better understanding
    On to the documentation we go.
    12
    12
    

    View Slide

13. We’ve found new rabbit holes!
    “The Docker daemon relies on an OCI compliant
    runtime (invoked via the containerd daemon) as
    its interface to the Linux kernel namespaces ,
    cgroups , and SELinux .”
    13
    13
    

    View Slide

14. That is one loaded sentence. Let’s break it down then.
    Not this kind of breakdown, although this truly was me
    when I was first trying to understand it.
    14
    14
    

    View Slide

15. Topic Breakdown
    The statement can be broken into 3 topics
    cgroups and namespaces
    OCI - Open Containers Initiative
    Container Runtimes
    15
    15
    

    View Slide

16. cgroups
    Linux kernel feature that allow processes to be
    organized into hierarchical groups whose usage of
    resources can be monitored or controlled.
    16
    16
    

    View Slide

17. View Slide

18. namespaces
    Linux kernel feature that partitions the kernel
    resources so that one set of resources can only view
    a specific set of resources.
    18
    18
    

    View Slide

19. View Slide

20. cgroups : Control the usage of resources
    namespaces : Control the visibility of resources
    You can make your own container from scratch using
    cgroups and namespaces !
    20
    20
    

    View Slide

21. Coming back to the explanation
    Let’s do OCI next
    “The Docker daemon relies on a OCI compliant
    runtime (invoked via the containerd daemon) as
    its interface to the Linux kernel namespaces ,
    cgroups , and SELinux .”
    21
    21
    

    View Slide

22. OCI (Open Container Initiative)
    It’s an open governance structure (formed by Docker,
    CoreOS etc.) to decide on container formats and
    runtimes.
    Designed to set standards and specifications so
    that;
    # Running an image
    
    ❯ docker run example.com/org/app:v1.0.0
    
    ❯ rkt run example.com/org/app:v1.0.0
    
    ❯ some-random-engine run example.com/org/app:v1.0.0
    
    22
    22
    

    View Slide

23. Runtime Specification: Defines how exactly does
    your container start and run when you run docker
    run .
    Image Specification: Defines the standard format of
    a container image.
    23
    23
    

    View Slide

24. So, OCI has defined a runtime standard which is to
    be followed by software programs which run the
    containers…
    24
    24
    

    View Slide

25. "The Docker daemon relies on a OCI compliant
    runtime (invoked via the containerd daemon) as
    its interface to the Linux kernel namespaces ,
    cgroups , and SELinux .”
    25
    25
    

    View Slide

26. Container Runtime
    Container Runtimes: This is the software component
    that executes the containers on the host system.
    dockerd
    containerd
    cri-o
    26
    26
    

    View Slide

27. View Slide

28. View Slide

29. runC ???
    29
    29
    

    View Slide

30. OCI ⇾ runC ⇾ containerd ⇾ dockerd ⇾ docker
    CLI ⇾ docker run -it ubuntu bash
    30
    30
    

    View Slide

31. View Slide

32. Hands on with containerd
    containerd is a Go-native way to bring up and
    spawn containers.
    You can use control containerd manually too!
    ctr : containerd CLI tool
    Go APIs
    32
    32
    

    View Slide

33. View Slide

34. containerd with ctr
    Pull and import images
    Create containers
    Start processes in containers
    Kill containers and images
    34
    34
    

    View Slide

35. containerd with Golang
    Using containerd Go APIs to:
    Pull an image
    Create, start and exit a task
    35
    35
    

    View Slide

36. References
    Ivan Velichko’s blogs: https://iximiuz.com/en/posts/oci-
    containers/
    containerd Documentation:
    https://pkg.go.dev/github.com/containerd/containerd#se
    readme
    containerd Getting Started Page:
    https://containerd.io/docs/getting-started/
    Demystifying Containers Series:
    https://github.com/saschagrunert/demystifying-containe
    36
    36
    

    View Slide