CoreOS rkt fly

CoreOS rkt fly: Pluggable container isolation.
https://coreos.com/rkt/
https://github.com/coreos/rkt/

(CoreOS SF meetup, Geekdom SF)

Transcript

1. CoreOS rkt and rkt fly Many ways to contain a container Josh Wood DocOps at CoreOS @joshixisjosh9
2. CoreOS is running the world’s containers We’re hiring: careers@coreos.com sales@coreos.com 90+ Projects on GitHub, 1,000+ Contributors coreos.com Support plans, training and more OPEN SOURCE ENTERPRISE
4. rkt A modern, secure container runtime Simple CLI tool - exorcism (no daemon) Implements AppC container spec
5. App Container (appc) github.com/appc appc-dev@googlegroups.com
6. appc spec in a nutshell - Image Format (ACI) - what does an application consist of? - Image Discovery - how can an image be located? - Pods - how can applications be grouped and run? - Executor (runtime) - what does the execution environment look like?
7. rkt run • Isolates containers with the linux container primitives, systemd-nspawn • Container apps in a machine slice PID namespace • Manage with standard init tools: systemd • Network isolation
8. $ rkt run quay.io/josh_wood/caddy rkt: using image from local store for image name coreos.com/rkt/stage1-coreos:0.15.0 rkt: using image from local store for image name quay.io/josh_wood/caddy [ 1161.330635] caddy[4]: Activating privacy features... done. [ 1161.333482] caddy[4]: :2015 $ rkt run
9. rkt fly • Leverages the packaging, discovery, distribution, and validation features of rkt/appc • Reduced isolation for privileged components • chroot file system isolation only • Has access to host-level mount, network, PID name spaces • Method for shipping k8s kubelet in CoreOS
10. $ rkt run \ --stage1-image=/usr/share/rkt/stage1-fly.aci \ quay.io/josh_wood/caddy rkt: using image from local store for image name coreos.com/rkt/stage1-fly:0.15.0 rkt: using image from local store for image name quay.io/josh_wood/caddy [ 1161.333482] caddy[4]: :2015 $ rkt run stage1=fly
11. $ rkt run presentation # everyone claps # drink a beer $
13. May 9 & 10, 2016 | Berlin, Germany • Early bird tickets • Sponsorships are still available • Submit a talk before February 29th! coreos.com/fest @coreosfest
14. j@coreos.com @joshixisjosh9 github.com/joshix QUESTIONS? Thanks! We’re hiring: coreos.com/careers Let’s talk! IRC More events: coreos.com/community LONGER CHAT?