Rust at CoreOS

Transcript

1. Luca BRUNO @lucabruno | luca.bruno@coreos.com | github.com/lucab Rust at CoreOS: Why, what and how Slides at https://speakerdeck.com/lucab
2. “Computer Engineer, Debian Developer and enthusiast FLOSS supporter” • OS Software Engineer • CoreOS/RedHat, Berlin office • PoliTo graduate • Previously: security researcher/engineer $ whoami
3. “Infrastructure with autopilot: improve reliability and security regarding critical updates, machine failures, networking outages” • YC’13 startup • FLOSS-centric company • Offices in SF, NYC, Berlin • Recently acquired by RedHat Inc. CoreOS Inc.
4. ContainerLinux GNU/Linux distribution for containerized workloads • Targeted at cloud and bare-metal servers • Single OS image, no package management • Cross-building SDK for development • Based on ChromeOS (Gentoo)
5. ContainerLinux • Auto-updating, active-passive partition scheme • Updates and rollback via GPT metadata
6. Rust
7. Why
8. Why Our goals: • Improve system security and reliability → memory safety, data ownership • Minimize surface for human mistakes → static typing, inference • Avoid code bloating → generics, cargo, crates.io
9. How First-class SDK integration of Rust projects within OS scope, build-machinery based on cargo and portage. cargo (Rust project builder): • dependencies management (source resolution) • rustc + linking coreos-cargo (based on cargo.eclass): • dependencies setup (source fetching + unpacking) • cross-compilation setup
10. # Compile for the built-in target, using SDK cross-tools. export RUST_TARGET=$(rust_builtin_target "${CHOST}") cat <<- EOF >> "${ECARGO_HOME}/config" [build] target = "${RUST_TARGET}" [target.${RUST_TARGET}] ar = "${TARGET_AR}" linker = "${TARGET_CC}" EOF How Cross-compilation via SDK specific target tuples
11. What Several system-level projects, major categories: • personal experiments • internal machinery • native libraries and bindings • host components Open-source projects on GitHub with Apache-2 licenses.
12. What - libraries Rust libraries (crates) • caps ◦ Native Linux capabilities(7) library • yubihsm ◦ Bindings for Yubico HSM • rust-uefi ◦ UEFI runtime environment, no-std • pretty-good ◦ Parsers and structures for OpenPGP packets • openssh-keys ◦ Parsers and structures for OpenSSH pubkeys
13. What - experiments CLI applications (standalone binaries) • rkt-volo ◦ Chroot-based stage1 for rkt • pazi ◦ Directory jumper • kubox ◦ Debug helper for kubernetes
14. What - host components Part of ContainerLinux stable releases • coreos-metadata ◦ Cloud-introspection for systemd services • update-ssh-keys ◦ SSH pubkeys consumers for cloud nodes
15. What - internal machinery Used for internal processes/chores at CoreOS • marker ◦ Markdown linter • tailor ◦ Bot for PRs/commits style validation • coreos-pages-sync ¹ ◦ Builder for doc-pages on coreos.com • picker ² ◦ UEFI boot selector w/ tries and rollbacks • fero ² ◦ Signing server for OS artifacts ¹ currently on a private infra repo, not yet open-sourced ² on-going internship project, not yet open-sourced
16. coreos-metadata [Unit] Requires=coreos-metadata.service After=coreos-metadata.service [Service] EnvironmentFile=/run/metadata/coreos ExecStart=/usr/bin/myraftd \ --client-urls=http://${COREOS_EC2_IPV4_PUBLIC}:2379 \ --peer-urls=http://${COREOS_EC2_IPV4_LOCAL}:2380 \ A simple cloud metadata agent, designed as an helper for systemd service units
17. marker Markdown linter, wired into CI pipelines • Validate CommonMark flavour • Mostly used for checking references in docs This is a [broken reference]. This [won't load](http://www.acrawford.com/404). [A subtle URL typo](http:://example.com) [This file](not_here.md) doesn't exist. This is an [absolute path](/root.md). Found broken url (404 -> http://www.acrawford.com/404) in ./example.md: 404 Not Found Found malformed URL (malformed url -> http:://example.com) in ./example.md: empty host Found broken path (bad path -> not_here.md) in ./example.md Found absolute path (absolute path -> /root.md) in ./example.md
18. pazi Faster implementation of `z`, without bash-scripts spaghetti
19. rkt-volo A stage1 for rkt, akin to stage1-fly • single-app pod • chroot only rkt (stage0) pod (stage1) bash/systemd/kubelet... (invoking process) app1 (stage2) app2 (stage2)
20. kubox Fooling around with Kubernetes and Linux namespaces
21. Questions? - Thank you!