Containers from Scratch

Transcript

1. Containers from Scratch Eric Chiang Software Engineer @erchiang | github.com/ericchiang
2. Agenda 1. Dive into containers! 2. Talk about the problems they solve.
5. Containers Like a mini virtual machine.
6. Virtual machines
7. OS OS OS Virtual machines
8. Virtual machines: Isolated operating systems.
9. Virtual machines: problems
10. Virtual machines: problems Expensive!
11. Like mini virtual machines. What’s a container?
12. Like mini virtual machines. Just an isolated process. No virtualizing a kernel. What’s a container?
13. Like mini virtual machines. What’s a container? Hypervisor VM (kernel) VM (kernel) VM (kernel) Kernel
14. Like mini virtual machines. What’s a container? Hypervisor VM (kernel) VM (kernel) VM (kernel) Kernel Kernel
15. $ sudo chroot rootfs /bin/bash # Containers: chroot
16. Containers: namespaces
17. $ sudo unshare -p -f \ --mount-proc=$PWD/rootfs/proc \ chroot rootfs /bin/bash # Containers: namespaces
18. $ sudo unshare -p -f \ --mount-proc=$PWD/rootfs/proc \ chroot rootfs /bin/bash # $ sudo nsenter --pid=/proc/7897/ns/pid \ chroot rootfs /bin/bash # Containers: namespaces
19. Containers: cgroups
20. $ ls /sys/fs/cgroup/ $ sudo # mkdir /sys/fs/cgroup/memory/demo # echo "100000000" > /sys/fs/cgroup/memory/demo/memory.limit_in_bytes # echo "0" > /sys/fs/cgroup/memory/demo/memory.swappiness # echo $$ > /sys/fs/cgroup/memory/demo/tasks (to clean up kill the process and run rmdir /sys/fs/cgroup/memory/demo) Containers: cgroups
21. Containers: security • Capabilities: limit the power of root ◦ sudo setcap CAP_NET_BIND_SERVICE+ep ./hello • seccomp: limit the syscalls you can make • SELinux: fine grained access control policies on processes
22. Container runtimes
23. Container runtimes
24. $ sudo rkt run \ quay.io/ericchiang/python:3.5.2 \ --exec=python3 -- -m http.server Container runtimes: rkt
25. Container runtimes • Metadata and tarball formats • Discovery of those tarballs ◦ rkt run quay.io/coreos/dex • Coordinates the underlying technologies
26. Why containers? Amazingly good at moving applications around.
27. $ tree . ├── bin │ └── my-awesome-app ├── server │ ├── app.py │ └── templates.py ├── public │ └── main.css └── README.md An app
28. $ tree . ├── bin │ └── my-awesome-app ├── server │ ├── app.py │ └── templates.py ├── public │ └── main.css └── README.md An app python3 bin/my-awesome-app \ --port 80 \ --db postgres://db.com/mydb
29. $ tree . ├── bin │ └── my-awesome-app ├── server │ ├── app.py │ └── templates.py ├── public │ └── main.css └── README.md An app python3 bin/my-awesome-app \ --port 80 \ --db postgres://db.com/mydb Additional code or resources.
30. $ tree . ├── bin │ └── my-awesome-app ├── server │ ├── app.py │ └── templates.py ├── public │ └── main.css └── README.md An app How to run it python3 bin/my-awesome-app \ --port 80 \ --db postgres://db.com/mydb Additional code or resources.
31. Problems: Dependencies Source code doesn’t tell us:
32. Problems: Dependencies Source code doesn’t tell us: • What version(s) of Python can run it? • What third-party Python packages does it import? • What system packages does it depend on?
33. Solutions: Package management Take your source code, add a bit of metadata, and put it on the internet.
34. from distutils.core import setup setup( name = 'my-awesome-app', scripts = ['bin/my-awesome-app'], version = '0.1', description = 'That thing I wrote', author = 'Eric Chiang', url = 'https://github.com/ericchiang/app', download_url = 'https://github.com/ericcchiang/app/tarball/0.1', keywords = ['webapp', 'awesome'], install_requires = ["flask", "jinja2", "Psycopg2"], ) A PyPI example
35. from distutils.core import setup setup( name = 'my-awesome-app', scripts = ['bin/my-awesome-app'], version = '0.1', description = 'That thing I wrote', author = 'Eric Chiang', url = 'https://github.com/ericchiang/app', download_url = 'https://github.com/ericcchiang/app/tarball/0.1', keywords = ['webapp', 'awesome'], install_requires = ["flask", "jinja2", "Psycopg2"], ) A PyPI example Package name How to run Where to download Dependencies
36. $ pip install my-awesome-app A PyPI example
37. Package management: problems Lots of potential conflicts: • What if two apps depend on different versions of the same package? • What if one app hogs memory or disk? • What if one gets hacked?
38. Containers: easy deployments • What kind of problems do you run into when it’s extremely easy to deploy an app? • How do you manage a high number of apps on a single machine?
39. Containers: easy deployments • What kind of problems do you run into when it’s extremely easy to deploy an app? • How do you manage a high number of apps on a single machine? (Hint: you should stay around for the next talk.)
40. eric.chiang@coreos.com @erchiang QUESTIONS? Thanks! We’re hiring: coreos.com/careers Let’s talk! IRC More events: coreos.com/community LONGER CHAT?