Upgrade to Pro — share decks privately, control downloads, hide ads and more …

クラウド・Webホスティングサービスのセキュリティと運用技術の研究

 クラウド・Webホスティングサービスのセキュリティと運用技術の研究

クラウド・Webホスティングサービスのセキュリティと運用技術の研究

セキュリティ・キャンプ2018 全国大会
セキュリティ・ミニキャンプ2019 福岡

2019/03/03
さくらインターネット株式会社
さくらインターネット研究所

上級研究員松本亮介 / @matsumotory / まつもとりー

MATSUMOTO Ryosuke

March 03, 2019
Tweet

More Decks by MATSUMOTO Ryosuke

Other Decks in Technology

Transcript

  1. ͘͞ΒΠϯλʔωοτגࣜձࣾ
    (C) Copyright 1996-2019 SAKURA Internet Inc
    ͘͞ΒΠϯλʔωοτݚڀॴ
    Ϋϥ΢υɾWebϗεςΟϯάαʔϏεͷ
    ηΩϡϦςΟͱӡ༻ٕज़ͷݚڀ
    2019/03/03 ্ڃݚڀһ দຊ ྄հ
    ηΩϡϦςΟɾϛχΩϟϯϓ2019@෱Ԭ

    View full-size slide

  2. 2
    ɾ͘͞ΒΠϯλʔωοτݚڀॴ ্ڃݚڀһ
    ɾגࣜձࣾGrooves Forkewll ٕज़ސ໰
    ɾϖύϘݚڀॴ ٬һݚڀһ ݚڀސ໰
    ɾηΩϡϦςΟɾΩϟϯϓߨࢣ
    ɾ৘ใॲཧֶձ Πϯλʔωοτͱӡ༻ٕज़ݚڀձ ֤छҕһ
    ɾژ౎େֶത࢜ʢ৘ใֶʣ
    দຊ྄հ / ·ͭ΋ͱΓʔ / @matsumotory

    View full-size slide

  3. 1. ͸͡Ίʹ
    2. WebαʔόͷηΩϡϦςΟͱӡ༻ٕज़ͷഎܠ
    3. WebαʔόͱWebϗεςΟϯάγεςϜͷجૅ஌ࣝ
    4. ηΩϡϦςΟͱϦιʔε෼཭
    5. ηΩϡϦςΟͱੑೳ
    3
    ໨࣍

    View full-size slide

  4. 6. ηΩϡϦςΟͱӡ༻ٕज़
    7. େن໛WebαʔόͷTLSূ໌ॻ؅ཧ
    8. ͓ΘΓʹ
    ext. ߃ৗੑͷ͋ΔγεςϜΞʔΩςΫνϟʹؔ͢Δݚڀಈ޲
    4
    ໨࣍

    View full-size slide

  5. • େن໛Ϋϥ΢υɾϗεςΟϯάαʔϏεͷઃܭʹج͍࣮ͮͯફతͳηΩϡϦ
    ςΟɾԾ૝ԽɾϦιʔε؅ཧɾӡ༻ٕज़ΛֶͿ͜ͱ͕Ͱ͖Δ
    • ౰֘෼໺Λઐ໳ͱͨ͠ΤϯδχΞͰ͋ΓݚڀऀͰ΋͋Δদຊ͕ɺؔ࿈ݚڀ΍ج
    ૅ֓೦Λ௨ͯؔ͡࿈ٕज़Λ੔ཧͯ͠ղઆ͠ɺ࠷৽ͷݚڀಈ޲ʹ͍ͭͯ΋ड़΂Δ
    • ࣮ࡍͷαʔϏε΍ݱ৔ʹ͍ۙ࠷৽ͷݚڀಈ޲Λ஌Δ͜ͱͰɺཧ࿦ͱ࣮ફΛཱ྆
    ͠ɺࡢࠓͷഎܠΛ൓өͨ͠ମܥతͰ࣮ޮੑͷ͋Δ஌ࣝΛֶͿ͜ͱ͕Ͱ͖Δ
    • ಛʹOS΍ϛυϧ΢ΣΞʹؔ͢Δ஌ࣝΛशಘ͢ΔͨΊʹେن໛ϗεςΟϯά
    αʔϏεͷΞʔΩςΫνϟʹண໨͢Δ
    7
    ࣮ફతͳηΩϡϦςΟͱӡ༻ٕज़ΛֶͿ

    View full-size slide

  6. • ӡ༻ٕज़΍౰֘෼໺ʹ͓͍ͯɼ޿ൣғʹ౉ͬͨجૅ஌ࣝͷத͔Βٕज़ॻ੶౳Ͱ
    ॏཁͳϙΠϯτ΍࣮ફతͳྖҬΛબ୒ͯ͠ूதతʹֶश͢Δ͜ͱ͸೉͍͠
    • ຊߨٛΛ௨ͯ͡ʮ࣮ࡍʹαʔϏε΍γεςϜΛӡ༻͍ͯ͠ͳ͍͔Βࣗ৴Λ࣋ͯ
    ͳ͍ʯͱ͍͏ؾ࣋ͪΛͰ͖Δ͚ͩݮΒ͢Α͏ʹ͍ͨ͠
    • ຊߨ͔ٛΒ࣮ફతͳٕज़ͱඞཁʹԠͨ͡جૅ஌ࣝͷֶशʹΑͬͯɺຊ͔ΒֶͿ
    ཧ࿦ͱɼݱ৔Ͱ஌Δ࣮ફతͳ஌ࣝΛͰ͖Δཱ͚ͩ྆ͯ͠शಘͰ͖ΔΑ͏ʹ͢Δ
    • ຊߨٛޙʹෆ҆ͳ࣮͘ફతͳྖҬΛ࣠ʹɺࣗ৴Λ΋ͬͯߋͳΔਂ͍஌ࣝ΍෯޿
    ͍ཧ࿦ͷशಘʹؾ࣋ͪΑ͘ઐ೦Ͱ͖ΔΑ͏ʹͳΔͱ޾͍Ͱ͋Δ
    8
    ࢀߟॻ΍ٕज़ॻ੶Ͱ͸ֶͼʹ͍͘ྖҬΛղઆ

    View full-size slide

  7. • দຊͷത࢜࿦จ
    • WebαʔόͷߴूੵϚϧνςφϯτΞʔΩςΫνϟʹؔ͢Δݚڀ
    • ࿦จʹམͱ͠ࠐΉ͜ͱͰɺਖ਼͠͞ͷٞ࿦͕࣌ͱͯ͠ෆ໌ྎʹͳΔ։ൃɾӡ༻
    ٕज़Λਖ਼͘͠ɺఆྔత͔ͭܧଓతʹֶձͱݕূՄೳʹͳΔ
    • ࿦จΛಡΊ͹ݕূՄೳͳঢ়ଶʹݴޠԽ͢Δ͜ͱ͕ඇৗʹॏཁ
    • ݴޠԽͱ͍͏ํ๏࿦ʹΑͬͯ޻ֶ͸ൃల͖ͯͨ͠ͱ΋͍͑Δ
    • ʮӡ༻ʯͱ͍͏ݴ༿Λ۩ମԽ͠ਖ਼͠͞ͱ޿͕ΓΛݕূ͠վળ͠ଓ͚Δ
    9
    ։ൃɾӡ༻ٕज़͸ݚڀʹͳΔɿݴޠԽͷॏཁੑ

    View full-size slide

  8. ٕज़ͷݴޠԽΛ৴པ͠׆༻ͨ͠ݕূͱվળͷαΠΫϧ
    10
    ݕূલͷ։ൃӡ༻ٕज़
    w ݕূ͕ᐆດͳঢ়ଶ
    w ಛఆ؀ڥͰͷᐆດͳఆੑධՁ
    w ಛఆ؀ڥґଘͰมԽ΍޿͕Γʹऑ͍
    w ίετʹରͯ͠ͷޮՌ͕ݟ͑ͣਖ਼͠͞
    ΋ෆ໌ྎ
    ࿦จԽ
    w ਖ਼͘͠ݕূՄೳͳঢ়ଶ΁
    w ៛ີͰਖ਼֬ͳݴޠԽ͕ඞਢ
    w લఏͷҰகɾαʔϕΠɾఆྔධ
    Ձɾ༗ޮੑ
    ֶձʹΑΔݕূ
    w ҉໧ͷલఏΛ࣋ͨͳ͍ୈࡾऀػؔ
    ʹΑͬͯݕূͱϑΟʔυόοΫ
    w ࠪಡऀʹΑΔࠪಡ݁Ռ΋࿦จͱಉ
    ༷Ҏ্ͷݴޠԽ͕લఏ
    w ࿦จࣥචऀʹΑͬͯݕূ
    ݕূޙͷ։ൃӡ༻ٕज़
    w ਖ਼͠͞ͱ޿͕Γ͕ݕূࡁΈ
    w ීวԽɾந৅Խ͕ਐΜͩ૊Έ
    ߹Θͤ΍͍ٕ͢ज़΁
    w มԽʹڧ͘ਐԽͤ͞΍͍ٕ͢
    ज़΁
    ٕज़ͷݴޠԽʹج͍ͮͯ
    Կ౓΋ݕূͱվળΛճ͢
    τοϓΧϯϑΝϨϯεͷΑ͏ͳ
    ੈքج४ͰͷϨϕϧͷߴ͍ݕূ
    Ͱ͋Δ΄͏͕ͳ͓ྑ͍
    ࣗ෼͚ͨͪͩͰ৽ٕज़Λݕূ͢
    Δͷ͸Կ΋ແ͍େւʹ์Γग़͞
    Εͯ৽छͷڕΛ୳͢Α͏ͳ΋ͷ
    ݴޠԽ ٕज़Խ
    ٕज़ͷݕূՄೳͳݴޠԽ͸܇࿅
    ͕ඞཁ

    View full-size slide

  9. • ։ൃӡ༻ٕज़΍γεςϜ։ൃͷ৽نੑɾ༗ޮੑɾ৴པੑͷࣔ͠ํ΋஌Δ
    • ٕज़ͷ࿦จԽͱֶձൃදͷαΠΫϧΛճ͠ͳ͕Βٕज़ΛҭͯΔํ๏Λ஌Δ
    • ੈʹଘࡏ͠ͳ͍ٕज़Ͱ͋ͬͯ΋ࣗΒಓΛ੾Γ։͖ղܾ͢Δࣗ৴Λ࣋ͭ
    • ղܾ͠ଓ͚ΔͨΊʹ΋ɺֶज़ͱຽؒͱͰ্खʹ࿈ܞٕͯ͠ज़ΛҭͯΔ
    • ৽ٕज़ͷਖ਼͠͞ͱ޿͕ΓΛੈքج४Ͱݕূ͠ීวతͳٕज़ʹҭ͍ͯͯ͘
    • ͦͷͨΊʹ΋࿦จͱτοϓΧϯϑΝϨϯεͷΑ͏ͳࠃࡍձٞʹ௅ઓ͢Δ
    • ීวతͳٕज़͸૊Έ߹ΘͤʹΑͬͯมԽʹڧ͘ਐԽͤ͞΍͍͢
    11
    ຊߨٛΛ௨ͯ͜͡ͷ෼໺ͷݚڀ։ൃͷํ๏࿦΋஌Δ

    View full-size slide

  10. • ։ൃɾӡ༻ٕज़ΛݴޠԽ͠ମܥԽͯ͠੔ཧ͢Δ͜ͱͰ౔୆͕Ͱ͖Δ
    • ᐆດʹ͍ٕͯͨ͠ज़ྖҬΛ࠶౓ݕ౼͢Δख͕ؒඇৗʹগͳ͘ͳΔ
    • ͦͷ౔୆ͷ্ʹཱͭ͜ͱͰɼ৽ͨͳྖҬ΁ͷࢹ࠲͕ߴ͘ͳΔ
    • ୔ࢁͷ੔ཧ͞Εͨ৘ใ͔Βɼ͋Δ࣌૑ൃతʹݟ͑ͳ͔ͬͨΞΠσΞ͕ੜ·ΕΔ
    • ͦͷΞΠσΞ͕࣭ͱͳΔ
    12
    ྔ͔Β࣭΁

    View full-size slide

  11. ߨٛͷਐΊํ

    View full-size slide

  12. 1. ͸͡Ίʹ
    2. WebαʔόͷηΩϡϦςΟͱӡ༻ٕज़ͷഎܠ
    3. WebαʔόͱWebϗεςΟϯάγεςϜͷجૅ஌ࣝ
    4. ηΩϡϦςΟͱϦιʔε෼཭
    5. ηΩϡϦςΟͱੑೳ
    14
    ߨٛͷྲྀΕ

    View full-size slide

  13. 6. ηΩϡϦςΟͱӡ༻ٕज़
    7. େن໛WebαʔόͷTLSূ໌ॻ؅ཧ
    8. ͓ΘΓʹ
    ext. ߃ৗੑͷ͋ΔγεςϜΞʔΩςΫνϟʹؔ͢Δݚڀಈ޲
    15
    ໨࣍
    ֤ষͰ͸ՄೳͳݶΓ࠷৽ͷݚڀಈ޲ΛؚΊͯݱ࣌఺ ೥
    ͷ࠷৽ٕज़Λ঺հ

    View full-size slide

  14. • ݚڀ։ൃྖҬɿΠϯλʔωοταʔϏεͷج൫ٕज़෼໺
    • OSɾϛυϧ΢ΣΞɾγεςϜΞʔΩςΫνϟɾγεςϜϓϩάϥϛϯά
    • ӡ༻ٕज़ɾϦιʔε؅ཧɾηΩϡϦςΟɾύϑΥʔϚϯεɾ෼ࢄ
    • ΤϯδχΞ͕ѻ͍΍͍͢γεςϜιϑτ΢ΣΞͷ࣮૷
    • ϓϩμΫτԽΛڧ͘ҙ࣮ࣝͨ͠ޮੑͷߴ͍ݚڀ։ൃͷࠃࡍԽʹऔΓ૊Ή
    • ژ౎େֶେֶӃ ৘ใֶݚڀՊ ത࢜࿦จ
    • WebαʔόͷߴूੵϚϧνςφϯτΞʔΩςΫνϟʹؔ͢Δݚڀ
    17
    দຊ྄հ / ·ͭ΋ͱΓʔ / @matsumotory

    View full-size slide

  15. • ~2008: τϥϑΟοΫಛ௃ྔͷ૬ؔؔ܎͔Βͷҟৗݕ஌ʢଔ࿦ʣ
    • 2008~2012: ϗεςΟϯάαʔϏεձࣾͰΠϯϑϥӡ༻ɾӡ༻ઃܭɾ։ൃ
    • 2012~2015: WebαʔόͷߴूੵϚϧνςφϯτΞʔΩςΫνϟͷݚڀʢത࿦ʣ
    • 2015~2016: ࣄۀΛࠩผԽ͢Δٕज़։ൃɾPM/POɾاըɾαʔϏε։ൃӡ༻
    • 2016~: ݚڀ։ൃɾڞಉݚڀɾݚڀऀҭ੒ɾݚڀ࣮੷ڧԽɾ׭ֶͱͷ࿈ܞʹઐ೦
    • 2018~: ٕज़ސ໰ɾݚڀސ໰ʹΑΔΤϯδχΞɾݚڀऀͷ੒௕ࢧԉͳͲ
    20
    ͜Ε·Ͱͷུྺ

    View full-size slide

  16. • ίϯϐϡʔλ΍Πϯλʔωοτʹؔ͢Δٕज़͸ൃల͕ͨ͠…
    • ࠓ΋೔ৗతʹ৮ΕΔγεςϜ͸༷ʑͳোนʹຬͪᷓΕ͍ͯΔ
    • োน(ΰπΰπ)ͷऔΓআ͔ΕͨະདྷͷγεςϜΛ࣮ݱ͍ͨ͠
    • ͳΊΒ͔ͳγεςϜ
    • ௒ݸମܕσʔληϯλʔ
    21
    দຊͷݚڀςʔϚ: ίϯϐϡʔλͷൃలͱোน

    View full-size slide

  17. • Ϟοτʔ
    • ໘ന͍ͱࢥ͏ςʔϚʹͲ͠Ͳ͠औΓ૊ΜͰ͍͘
    • ੱީతʹݚڀ։ൃΛઌճΓ͍ͯ͘͠
    • ʮ͘͞ΒΒ͠͞ʯ͕͋Ε͹ԿͰ΋OK
    • ίϯηϓτɾϏδϣϯ
    • ௒ݸମܕσʔληϯλʔ͓ΑͼOS
    22
    ͘͞ΒΠϯλʔωοτݚڀॴ

    View full-size slide

  18. 1. ݱࡏ͸σʔληϯλʔʹڊେͳίϯϐϡʔςΟϯάϦιʔε͕ଘࡏ͍ͯ͠·͕͢ɺ
    ࠓޙ͸ϨΠςϯγʗηΩϡϦςΟʗίετ౳ͷཁ͔݅Βɺ͋ΒΏΔ৔ॴ΍ࣾձɺ
    ૊৫ʹίϯϐϡʔςΟϯάϦιʔε༹͕͚ࠐΜͰ͍͘͜ͱʹͳΓ·͢ɻ
    2. ͦΕΒ෼ࢄͨ͠ίϯϐϡʔςΟϯάϦιʔε͸ɺ୯ಠͰίϯϐϡʔςΟϯάύϫʔ
    Λఏڙ͢Δʹཹ·Βͣɺͦͷ৔ॴ΍ࣾձͷཁٻʹԠͯ͡ɺࣗ཯తʹɺ෼ࢄ͋Δ͍
    ͸༗ػతʹ݁߹͠ɺݱ৔ɾΫϥ΢υͦΕͧΕ͕ॎԣʹ݁ͼ͍ͭͨϋΠϒϦουߏ
    ଄Λ࠾ΔΑ͏ʹػೳ͠·͢ɻ
    3. ͜ͷΑ͏ͳγεςϜʹΑΓ࣮ݱ͞ΕΔ΋ͷ͸ɺਓʑͷ਎ۙʹଘࡏ͠ɺϦΞϧλΠϜ
    ͔ͭΠϯςϦδΣϯεʹϢʔβΛࢧ͑ͳ͕Βɺ͔͠͠ಉ࣌ʹόοΫΤϯυଆ͕༗
    ػతʹ݁߹͢Δ͜ͱʹΑΓɺ͔ͭͯͳ͍ϚγϯύϫʔͱϦιʔεྔΛಈһ͢Δ͜
    ͱͰݱ৔࠷ద͔ͭશମ࠷దΛ΋࣮ݱ͢ΔSuper Organized WorldͰ͢ɻ
    23
    ௒ݸମܕσʔληϯλʔ͓ΑͼOS

    View full-size slide

  19. લఏɿ࣮ݱ͍ͨ͠ϓϩμΫτ͕ٕज़త՝୊ʹΑΓ࣮ݱͰ͖ͳ͍ঢ়گΛແ͘͢
    • ࣄۀΛࠩผԽ͢Δٕज़ͱͦͷબ୒ࢶ΍ଟ༷ੑΛ༻ҙ͢ΔͨΊʹ࿦จࣥච
    • ۀքͷٕज़Λ٬؍తʹධՁͯ͠੔ཧ͠ɺମܥతͳਖ਼͠͞ΛੵΈॏͶΔ
    • ۀքͷٕज़ΛͰ͖Δ͚ͩந৅Խ͠ɺ࠶ར༻Մೳͳ޿͕ΓΛҡ࣋͢Δ
    • ۀքͷٕज़Λάϩʔόϧͳج४ͰܧଓతʹධՁ͠ɺٕज़Λεέʔϧͤ͞Δ
    → ࿦จ͑͞ॻ͚͹͜ͷ࿮૊͕ར༻Մೳ (OSS͸࢖ΘΕͳ͍ͱ্هվળ͕೉͍͠)
    → ࿦จ΍ίʔυɼΞ΢τϓοτΛखஈʹձࣾ΍ࣾձʹՁ஋Λؐݩ͍ͯ͘͠
    24
    اۀʹ͓͚Δݚڀ։ൃͱ࿦จԽʹΑΔීวతͳߩݙ

    View full-size slide

  20. • ਓؒͷϓϩμΫτ΁ͷൃ૝Λࢧ͑ΒΕΔΠϯλʔωοταʔϏεج൫͕ඞཁ
    • ͜Ε·Ͱ͸֤छྖҬΛਓखͰΧόʔ͢Δ͜ͱ͕ଟ͔ͬͨ
    • ੑೳɾηΩϡϦςΟɾϦιʔε؅ཧɾӡ༻ٕज़ͳͲ
    • ΠϯλʔωοταʔϏεج൫ΛػցͰࢧ͑ࣗಈԽ͠αʔϏεͷݶքΛ௒͑Δ
    • ਓؒͷൃ૝ͷݶքͱج൫ͷݶքͱͷউෛͷੈքͱ͍͑Δ
    25
    ج൫ٕज़ͷݶք͸αʔϏεͷݶք

    View full-size slide

  21. ਓؒͷൃ૝ vs ج൫ٕज़(ػց)ͱদຊͷݚڀ
    26
    ج൫ٕज़ ػց

    ϓϩμΫτ ਓؒͷൃ૝

    ਓͷମྗɾਫ਼ਆͷݶք
    ਓͷମྗɾਫ਼ਆͷݶք
    ਓྗͰࢧ͑ଓ͚Δ
    ਓྗͰ޿͛ଓ͚Δ
    ਓྗͰࢧ͑ଓ͚Δ
    ϓϩμΫτͷݶքͷ෯
    ج൫ٕज़ ػց

    ϓϩμΫτ ਓؒͷൃ૝

    ػցͰࢧ͑ଓ͚Δ
    ϓϩμΫτͷݶքͷ෯
    • ॎ࣠͸ϓϩμΫτ։ൃɾӡ༻ͷίετͱ΋ݴ͑Δ
    • ج൫ٕज़ͷݶքΛ௒͑Δ΂͘ਓͰΧόʔ͍ͯ͠Δ
    • ॎ࣠ͷίετΛ୹͘ɺԣ࣠ͷݶքͷ෯Λ޿͛Δͨ
    Ίͷݚڀ։ൃΛߦ͍ͬͯΔ
    দຊͷݚڀ

    View full-size slide

  22. • WebαʔϏεར༻ऀͷϢʔβʔମײ(User Sensation)ͷվળ
    • WebαʔϏεར༻ऀͷແҙࣝԼʹ͓͚Δշదͳײ֮ͷఏڙ
    • ౰ͨΓલʹී௨ʹҧ࿨ײͳ͘࢖͍ଓ͚ΒΕΔ͜ͱͷշద͞
    • WebαʔϏεఏڙଆͷٕज़ऀମײ(Engineer Sensation)ͷվળ
    • ౰ͨΓલʹγεςϜͷ҆ఆੑΛอͪɺਓͷڧ੍հೖΛ௿ݮ
    27
    দຊͷݚڀςʔϚ

    View full-size slide

  23. 2.
    Ϋϥ΢υɾWebϗεςΟϯάٕज़ͷ
    ηΩϡϦςΟͱӡ༻ٕज़ͷഎܠ

    View full-size slide

  24. ηΫγϣϯͷ֓ཁ

    View full-size slide

  25. 1. Ϋϥ΢υαʔϏεͱWebϗεςΟϯάͷ֓ཁ
    2. WebαʔόͷϚϧνςφϯτํࣜ
    3. ηΩϡϦςΟͱϦιʔε෼཭ͱӡ༻ٕज़ͷॏཁੑ
    30
    Ϋϥ΢υɾϗεςΟϯάͷηΩϡϦςΟͱӡ༻ٕज़

    View full-size slide

  26. Ϋϥ΢υͱWebϗεςΟϯάͷ֓ཁ

    View full-size slide

  27. • Ϋϥ΢υαʔϏε΍WebϗεςΟϯάαʔϏεͷීٴͱݸਓͷར༻
    • WebϗεςΟϯάαʔϏεʢϨϯλϧαʔόʣͷ௿Ձ֨Խͱ඼࣭ͷڝ૪
    • Ϋϥ΢υαʔϏεͷࣗ༝౓ͷߴ͞ͱITϦςϥγʔͷߴ·Γ
    • ϗεςΟϯάαʔϏεΑΓ΋ࣗ༝౓ͷߴ͍αʔϏε΁ͷཁٻ
    • ͱ͸͍͑ࣗ༝౓͕ߴ͘ͳΔͱݸਓͰͷӡ༻อक͕େม
    • ηΩϡϦςΟΠϯγσϯτͳͲʹ΋ͭͳ͕͍ͬͯ͘
    32
    Ϋϥ΢υɾWebϗεςΟϯάͷݸਓར༻

    View full-size slide

  28. • αʔϏεͷ௿Ձ֨Խͱ඼࣭ͷڝ૪
    • γεςϜͷج൫ٕज़΍ӡ༻ٕज़ͷݚڀ։ൃ΍҆ఆԽ͕՝୊
    • ࣗ༝౓ͱར༻ऀʹखؒΛ͔͚ͳ͍αʔϏεͷཱ͕྆໨ඪ
    • WebαʔόͷߴूੵϚϧνςφϯτํࣜʹ஫໨
    • ηΩϡϦςΟͷ୲อͱऩ༰ϗετͷओཁޮ཰޲্͕ॏཁ
    • ௿Ձ֨ͱӡ༻୅ߦΛ࣮ݱ҆͠ఆੑͷ͋ΔαʔϏεΛ໨ࢦ͢
    • ୅දతͳαʔϏεͱͯ͠ߴूੵWebϗεςΟϯάαʔϏε
    33
    Ϋϥ΢υɾWebϗεςΟϯάࣄۀऀͱͯ͠

    View full-size slide

  29. • ֤ϢʔβྖҬʹࣗ༝ʹར༻ऀ͕WebίϯςϯπΛ഑ஔՄೳ
    • ϗεςΟϯάαʔϏεࣄۀऀ͸OS΍ϛυϧ΢ΣΞͷج൫ٕज़ͷཧղ͕ඞཁ
    • Ϛϧνςφϯτ؀ڥʹ͓͚ΔηΩϡϦςΟ΍҆ఆੑͷ୲อ
    • Ϋϥ΢υαʔϏε΄Ͳࣗ༝౓͸ߴ͘ͳ͍
    • ϚωʔδυΫϥ΢υͱݺ͹ΕΔΫϥ΢υαʔϏεͱϗεςΟϯάͷྑ͍ͱ͜Ζ
    Λཱ྆͢ΔαʔϏε΋ϦϦʔε͞Ε࢝Ί͍ͯΔ
    • ๛෋ͳϛυϧ΢ΣΞ΍ݴޠͷબ୒ɾϦιʔεͷεέʔϦϯάͳͲ
    34
    WebϗεςΟϯάαʔϏεͷ֓ཁͱํ޲ੑ

    View full-size slide

  30. • Ϋϥ΢υαʔϏε΍ࣗ༝౓ͷߴ͍IaaSʹඞཁͳӡ༻ٕज़΍ηΩϡϦςΟΛαʔ
    Ϗεͱͯ͠ఏڙ͍ͯ͠ΔWebϗεςΟϯάαʔϏεͷΞʔΩςΫνϟΛ࣠ʹ࣮
    ફతͳηΩϡϦςΟͱԾ૝ԽɺϦιʔε؅ཧ΍ӡ༻ٕज़ʹ͍ͭͯड़΂Δ
    • Ϋϥ΢υαʔϏεΑΓ΋ΑΓOS΍ϛυϧ΢ΣΞͷιϑτ΢ΣΞ։ൃӡ༻ʹۙ
    ͍ϗεςΟϯάαʔϏεͷٕज़Λৄࡉʹ஌Δ͜ͱͰશྖҬʹ׆༻Ͱ͖Δମܥత
    ͳ஌ࣝΛ࣮ફతͳٕज़৘ใ͔Βशಘ͢Δ
    • ಛʹWebαʔόͷϚϧνςφϯτํࣜʹண໨ͯؔ͠࿈ٕज़ʹ͍ͭͯड़΂Δ
    35
    WebϗεςΟϯάαʔϏε͔ΒֶͿٕज़͸໘ന͍

    View full-size slide

  31. WebαʔόͷߴूੵϚϧνςφϯτํࣜ

    View full-size slide

  32. • ௿Ձ֨WebϗεςΟϯάαʔϏεͰඞཁͱ͞ΕΔํࣜʢΞʔΩςΫνϟʣ
    • ߴूੵͳϚϧνςφϯτํࣜΛ໨ࢦ͢͜ͱͰ௿Ձ֨ԽΛ࣮ݱ
    • WebαʔόͷઃఆΛऩ༰ϗετ਺ͷ૿Ճʹґଘ͠ͳ͍Α͏ʹ͢Δ
    • ϋʔυ΢ΣΞίετͷߋͳΔޮ཰Խͱӡ༻ޮ཰ͷվળΛ໨ࢦ͢
    • ߴूੵϚϧνςφϯτํࣜͷ৴པੑʹॏཁͳϙΠϯτ
    • ηΩϡϦςΟɾϦιʔε෼཭ɾӡ༻ٕज़ͷվળɾେྔͷυϝΠϯͷѻ͍
    37
    WebαʔόͷߴूੵϚϧνςφϯτํࣜ [8]
    <>দຊ྄հɼ8FCαʔόͷߴूੵϚϧνςφϯτΞʔΩςΫνϟʹؔ͢Δݚڀɼതֶ࢜Ґ࿦จIUUQT
    SFQPTJUPSZLVMJCLZPUPVBDKQETQBDFIBOEMF ژ౎େֶɼ.BZ

    View full-size slide

  33. • ηΩϡϦςΟ
    • ӡ༻ٕज़͕௿ݮ͗ͯ͢͠΋ɺੑೳ͕௿Լ͗ͯ͢͠΋͍͚ͳ͍
    • Ϧιʔε؅ཧ
    • ςφϯτؒͰϦιʔεׯবʹΑͬͯϢʔβମݧ͕௿Լͯ͠͸͍͚ͳ͍
    • ӡ༻ٕज़
    • Ϧιʔεׯবͷӡ༻ίετ͕ߴ·Γ݁Ռతʹίετ͕ߴ͘ͳͬͯ͸͍͚ͳ͍
    • ͦͷଞϛυϧ΢ΣΞͷฏқͳ֦ு΍େྔTLSূ໌ॻ΍υϝΠϯͷ؅ཧͳͲ
    38
    ߴूੵϚϧνςφϯτํࣜͷॏཁͳ؍఺

    View full-size slide

  34. • ϓϩηεͷηΩϡϦςΟ΍ੑೳɺϦιʔε؅ཧ΍ӡ༻ٕज़ͷๅݿ
    • OS΍ϛυϧ΢ΣΞɺγεςϜϓϩάϥϛϯάͷ஌͕ࣝඞཁ
    • WebΞϓϦέʔγϣϯΑΓ΋ൺֱత௿ϨΠϠʔͷ஌͕ࣝඞཁ
    • γεςϜίʔϧͷ؍఺ͰੑೳͷධՁ΍νϡʔχϯάΛߦ͏͜ͱ΋͋Δ
    • ࣮ફతͳ؍఺͔ΒLinuxͷηΩϡϦςΟ΍ӡ༻ٕज़ΛֶͿʹ͸౎߹͕ྑ͍
    39
    WebαʔόͷߴूੵϚϧνςφϯτํࣜͷٕज़

    View full-size slide

  35. ηΩϡϦςΟͱϦιʔε෼཭ͱӡ༻ٕज़

    View full-size slide

  36. • 1୆ͷαʔόʹ਺ສҎ্ͷϗετΛऩ༰͢ΔϨϕϧΛ૝ఆ
    • ऩ༰ϗετ਺ʹґଘͯ͠Ϧιʔε࢖༻ྔͷ૿Ճ΍ઃఆมߋʹ൐͏࠶ىಈ͕ۃ
    ୺ʹ૿Ճ͠ͳ͍Α͏ʹ͢΂͖
    • αʔϏεར༻ऀ͕֤ϗετʹࣗ༝ʹ༷ʑͳWebίϯςϯπΛ഑ஔՄೳ
    • ֤ʑͷϗετʹର͢ΔΞΫηε਺ͷ༧ଌ͸ࠔ೉
    • ಛఆͷϗετʹର͢ΔಥൃతͳΞΫηε͕αʔόશମʹӨڹΛ༩͑Δ͜ͱ΋
    41
    WebαʔόͷߴूੵϚϧνςφϯτํࣜͷ՝୊

    View full-size slide

  37. • ୯Ұͷαʔόϓϩηε܈ͰେྔͷϗετΛԾ૝తʹॲཧ͢Δ
    • ୯Ұͷαʔόϓϩηε܈ͱ͸αʔόͷ࣮૷ʹΑͬͯ਺े͔Β਺ඦϓϩηεى
    ಈʢॴҦmasterϓϩηεͱෳ਺ଘࡏ͢Δworkerϓϩηε܈ʣ
    • ऩ༰ϗετ਺ʹґଘͯ͠ϓϩηε਺Λ૿΍͢ඞཁ͸ͳ͍
    • ಉҰͷઃఆͷ··WebαʔόΛෳ਺୆ʹ૿΍͠ɺσʔλΛετϨʔδ౳Ͱ
    ·ͱΊΔ͜ͱͰεέʔϧΞ΢τܕͷෛՙ෼ࢄ΋Մೳ
    42
    ՝୊Λղܾ͢Δํ਑

    View full-size slide

  38. • ϗετͷηΩϡϦςΟΛHTTPϦΫΤετ୯ҐͰ୲อ
    • ֤ϗετʹର͢ΔϦΫΤετΛ୯Ұͷϓϩηε܈Ͱڞ༗ͯ͠ॲཧ͢ΔͨΊ
    • ϓϩηεͷػೳΛར༻ͯ͠ੑೳΛ࠷େԽ͢Δඞཁ͕͋Δ
    • ෳ਺ͷϗετؒͰੜ͡ΔϦιʔεڝ߹ͷ௿ݮ
    • ϗετؒͰϋʔυ΢ΣΞϦιʔε͕ڞ༗͞ΕΔͨΊ
    • ηΩϡϦςΟ΍Ϧιʔε؅ཧΛखؒΛ͔͚ͣʹ࣮ݱ͢Δ͔
    • ج൫ٕज़ͰࣗಈԽ͢Δ͜ͱͰγεςϜͷӡ༻ɾอकͷίετΛ௿ݮ
    43
    ηΩϡϦςΟɾϦιʔε෼཭ɾӡ༻ٕज़ͷվળ

    View full-size slide

  39. ηΫγϣϯͷ·ͱΊ

    View full-size slide

  40. 1. Ϋϥ΢υͱWebϗεςΟϯάͷ֓ཁ
    2. WebαʔόͷϚϧνςφϯτํࣜ
    3. ηΩϡϦςΟͱϦιʔε෼཭ͱӡ༻ٕज़
    45
    Ϋϥ΢υɾϗεςΟϯάͷηΩϡϦςΟͱӡ༻ٕज़

    View full-size slide

  41. 3.
    WebαʔόͱWebϗεςΟϯάγεςϜͷ
    جૅ஌ࣝ

    View full-size slide

  42. ηΫγϣϯͷ֓ཁ

    View full-size slide

  43. 1. Ϋϥ΢υαʔϏεͱϗεςΟϯάαʔϏε
    2. Webαʔόʹؔ͢ΔԾ૝Խٕज़ͷ෼ྨ
    3. Webαʔόʹ͓͚Δಈతίϯςϯπ
    4. ୅දతͳWebαʔόͷΞʔΩςΫνϟ
    48
    WebαʔόͱWebϗεςΟϯάγεςϜͷجૅ஌ࣝ

    View full-size slide

  44. Ϋϥ΢υαʔϏεͱϗεςΟϯάαʔϏε

    View full-size slide

  45. • Ϋϥ΢υίϯϐϡʔςΟϯά[9]
    • ωοτϫʔΫ΍αʔόͱ͍ͬͨίϯϐϡʔλϦιʔεͷϓʔϧ͔Βඞཁͳ࣌
    ʹඞཁͳྔ͚ͩΦϯσϚϯυʹར༻Մೳͱ͢ΔίϯϐϡʔςΟϯάϞσϧ
    • Ϋϥ΢υαʔϏε
    • Ϋϥ΢υίϯϐϡʔςΟϯάΛ֤छαʔϏεͱͯ͠ఏڙ͢ΔαʔϏε
    50
    Ϋϥ΢υαʔϏε
    <>1.FMM 5(SBODF 5IF/*45%FpOJUJPOPG$MPVE$PNQVUJOHz 64/BU`M*OTUPG4DJFODFBOE5FDIOPMPHZ
    IUUQDTSDOJTUHPWQVCMJDBUJPOTOJTUQVCT41QEG

    View full-size slide

  46. • SaaS
    • ιϑτ΢ΣΞαʔϏεͷఏڙʢGoogle AppsͳͲʣ
    • PaaS
    • γεςϜ։ൃखஈ΍ϓϥοτϑΥʔϜػೳΛఏڙʢGAEͳͲʣ
    • IaaS
    • OS΍ϛυϧ΢ΣΞΛؚΊͨΠϯϑϥػೳͷఏڙʢAWSͳͲʣ
    51
    Ϋϥ΢υαʔϏεͷ୅දతͳ෼ྨ

    View full-size slide

  47. • ෳ਺ͷϗετͰαʔόͷϦιʔεΛڞ༗
    • ΦϯσϚϯυͳఏڙ͸͜Ε·Ͱ͸͋·ΓͰ͖͍ͯͳ͔ͬͨ
    • ࠷ۙͰ͸ΦϯσϚϯυͳػೳ΋ఏڙ͞Ε࢝Ί͍ͯΔ
    • ֤ϗετͷ؅ཧऀͷυϝΠϯʹରͯ͠HTTPαʔόػೳΛఏڙ͢ΔαʔϏε
    • ຊߨٛʹ͓͚Δϗετͱ͸ʁ
    • WebϗεςΟϯάαʔϏεʹ͓͍ͯɺυϝΠϯ໊ʢFQDN)ʹΑͬͯࣝผ͞
    ΕɺରԠ͢ΔίϯςϯπΛ഑৴͢Δػೳ
    52
    WebϗεςΟϯάαʔϏε

    View full-size slide

  48. WebαʔόͷԾ૝Խɾִ཭ٕज़ͷ෼ྨ

    View full-size slide

  49. 1. Xen΍VMware౳ͷԾ૝ϚγϯͰϗετΛ෼͚Δํ๏
    2. FreeBSD jail΍LXCɺOpenVZ౳ͷίϯςφܕԾ૝ԽͷΑ͏ʹϑΝΠϧγες
    Ϝ΍໊લۭؒΛૢ࡞͢ΔγεςϜίʔϧʹΑͬͯOS্ʹෳ਺ͷԾ૝తͳִ཭
    ؀ڥΛ༻ҙ͠ϗετΛ෼͚Δํ๏
    3. IPΞυϨε΍ϙʔτ୯ҐͰWebίϯςϯπ͕഑ஔ͞Εͨෳ਺ͷϗετΛ෼཭
    ֤͠ϗετʹݸผͷϓϩηεΛ༻ҙͯ͠ىಈͤ͞Δख๏
    4. ୯Ұͷαʔόϓϩηε܈Ͱෳ਺ͷϗετΛԾ૝ϗετํࣜʹΑΓѻ͏ख๏
    54
    Ϋϥ΢υɾWebϗεςΟϯάͷϗετͷִ཭෼ྨ

    View full-size slide

  50. • ϗετ୯ҐͰ(1)VMϞσϧɺ(2)ίϯςφϞσϧɺ(3)୯७ϓϩηεϞσϧͰ෼཭
    • (1)͔Βॱʹִ཭Ϩϕϧ͕ߴ͘ίετ΍༻్ʹ߹Θܾͤͯఆ͢Δ
    • (2)ͷϞσϧͷయܕతͳߏ੒
    55
    αʔόͷӡ༻໘΍ηΩϡϦςΟΛॏࢹͨ͠৔߹

    View full-size slide

  51. • unshare(): IPCɺnetɺmountɺpidɺuserͳͲͷ໊લۭؒΛִ཭
    • chroot(): rootσΟϨΫτϦͷมߋ
    • Ծ૝Ϛγϯͱൺֱִͯ͠཭౓͸௿͍͕ऩ༰αʔό୯ҐͰͷऩ༰ޮ཰͸ߴ͍
    • OSͷγεςϜྖҬ͔ΒϑΝΠϧγεςϜɾ໊લۭؒͰִ཭Մೳ
    • chroot؀ڥʹϑΝΠϧϕʔεͰॆ࣮ͨ͠ϥΠϒϥϦ؀ڥΛߏஙՄೳ
    • ϗετ୯ҐͰෆඞཁͳίϚϯυ΍ϥΠϒϥϦΛ഑ஔ͠ͳ͍ͱ੍͍ͬͨޚ͕Մೳ
    56
    chroot()΍unshare()ͰϓϩηεΛִ཭͢ΔϞσϧ(2)

    View full-size slide

  52. • ϗετ୯ҐͰݸผͷJVMΛ༻ҙ
    • ΞϓϦέʔγϣϯαʔόʹΑΔ୯७ͳϓϩηε෼཭Ϟσϧ(3)ʹ֘౰
    • SteinʹΑΔख๏[10]
    • (3)ͷख๏ϕʔεͰҟͳΔϢʔβݖݶͰϓϩηεΛىಈ͢Δख๏
    • ෳ਺ͷαʔό΁εέʔϧΞ΢τ͢Δ͜ͱ͕ࠔ೉Ͱ͋Δ՝୊΋͋Δ
    57
    JavaServlet΍Ruby on RailsͷΑ͏ͳϞσϧ
    <>-4UFJO l4#09 QVU$(*TDSJQUTJOBCPY z64&/*9"OOVBM5FDIOJDBM$POGFSFODF (FOFSBM5SBDL
    QQr +VOF

    View full-size slide

  53. • (4)୯Ұͷαʔόϓϩηε܊Ͱෳ਺ͷϗετΛԾ૝తʹॲཧ͢Δߏ੒
    • WebαʔόͷԾ૝ϗετํࣜͱΑ͹ΕΔϚϧνςφϯτΞʔΩςΫνϟ
    58
    ߴूੵʹϗετΛऩ༰͢Δ৔߹ͷϞσϧ

    View full-size slide

  54. • Ծ૝ϗετํࣜʹΑΔϚϧνςφϯτΞʔΩςΫνϟΛ࠾༻
    • ୯ҰͷҰൠతͳWebαʔόʹ਺ສҎ্ͷϗετΛऩ༰Մೳ
    • εϖοΫͱͯ͠CPU24εϨουɺϝϞϦ32GBఔ౓ͷWebαʔόΛ૝ఆ
    59
    ߴूੵϚϧνςφϯτΞʔΩςΫνϟͷఆٛ

    View full-size slide

  55. • ΞΫηεͷ߹ͬͨϗετ໊ʹରԠͨ͠υΩϡϝϯτϧʔτΛಈతʹղੳ
    • Ծ૝ϗετ਺ʹϓϩηε਺͕ґଘ͠ͳ͍ͨΊߴूੵऩ༰࣌ʹޮ཰͕ྑ͍
    • ڞ༗ετϨʔδʹσʔλΛల։͢Ε͹Webαʔό܈ͷෛՙ෼ࢄ͕Մೳ
    • σʔλ΍ઃఆ͕Webαʔόʹݻఆ͞Εͳ͍ͨΊ
    • ಈతίϯςϯπͷ࣮ߦʹ༷ʑͳ޻෉͕ඞཁͱͳΓෳࡶͰ͋Δ
    • Ϧιʔεڝ߹໰୊΍ηΩϡϦςΟͷ୲อɺߴूੵ࣌ͷੑೳ΍ӡ༻ٕज़ͷ໰୊
    60
    Ծ૝ϗετํࣜͷϝϦοτͱσϝϦοτ

    View full-size slide

  56. • Ծ૝ϚγϯϨϕϧͷ෼཭
    • ߴूੵʹϗετΛऩ༰͢Δʹ͸ෆ޲͖ɾηΩϡϦςΟॏࢹͷ৔߹
    • ϓϩηεϨϕϧͷ෼཭
    • ϗετ਺ʹґଘͯ͠ϓϩηε਺͕૿Ճ͢ΔͨΊߴूੵʹ͸ෆ޲͖
    • ୯Ұͷαʔόϓϩηε܈Ͱෳ਺ͷϗετΛԾ૝తʹ෼཭
    • ϗετ਺ʹґଘ͠ͳ͍ͨΊߴूੵʹద͍ͯ͠Δ
    • ಛఆͷϗετͷϦιʔεઐ༗͕αʔόϓϩηεͷϦιʔεΛઐ༗͢Δ
    61
    ߴूੵऩ༰ʹ͓͚ΔWebαʔόͷϗετִ཭·ͱΊ

    View full-size slide

  57. Webαʔόʹ͓͚Δಈతίϯςϯπ

    View full-size slide

  58. • CGIʢCommon Gateway Interfaceʣ࣮ߦํࣜ
    • DSOʢDynamic Shared Objectʣ࣮ߦํࣜ
    63
    Webαʔόʹ͓͚Δಈతίϯςϯπ࣮ߦํࣜ

    View full-size slide

  59. CGI࣮ߦํࣜ
    64
    $(*QSPDFTT QIQDHJJOEFYQIQ
    $(*QSPDFTT
    GPSL

    UFSNJOBUFQSPDFTT
    FYFDWF

    1BSFOUIUUQEQSPDFTT
    PXOFSSPPU

    $IJMEIUUQEQSPDFTT
    PXOFSBQBDIF

    ϦΫΤετຖʹϓϩηεͷੜ੒ɾഁغͱൺֱతେ͖ͳ
    ΠϯλϓϦλόΠφϦʢ1)1ͩͱQIQDHJʣͷ
    FYFDWF
    ͕ඞཁ

    View full-size slide

  60. DSO࣮ߦํࣜ
    65
    1BSFOUIUUQEQSPDFTT
    PXOFSSPPU

    $IJMEIUUQEQSPDFTT
    PXOFSBQBDIF
    JOEFYQIQ
    QBSTFSVO
    αʔόϓϩηεʹΠϯλϓϦλΛϥΠϒϥϦ
    ͱͯ͠௚઀૊ΈࠐΜͰ͓͘

    View full-size slide

  61. • CGI࣮ߦํࣜ
    • ΠϯλϓϦλͷෳ਺όʔδϣϯΛ࣮ߦͰ͖Δ
    • DSO࣮ߦํࣜ
    • ੑೳ͸ߴ͍͕جຊతʹ͸୯ҰͷWebαʔόʹΠϯλϓϦλΛෳ਺όʔδϣ
    ϯ࣋ͯͳ͍
    • ࣮ߦํࣜʹΑΒͣݖݶ෼཭ػೳΛར༻͠ͳ͍৔߹͸Webαʔόϓϩηεͱಉ
    ༷ͷΦʔφͰ࣮ߦ͞ΕΔͨΊηΩϡϦςΟ্ͷ՝୊͕͋Δ
    66
    ಈతίϯςϯπͷ࣮ߦํࣜ

    View full-size slide

  62. ୅දతͳWebαʔόͷΞʔΩςΫνϟ

    View full-size slide

  63. WebαʔόͷجຊతͳϞσϧʢpreforkʣ
    1BSFOUIUUQEQSPDFTT
    PXOFSSPPU

    $IJMEIUUQEQSPDFTT
    PXOFSBQBDIF

    $IJMEIUUQEQSPDFTT
    PXOFSBQBDIF

    $IJMEIUUQEQSPDFTT
    PXOFSBQBDIF

    $MJFOU
    ϦΫΤετ
    Ϩεϙϯε
    6/*9ܥ04ͷ৔߹ࣄલʹϦΫΤετΛड͚Δ
    ϓϩηεΛෳ਺GPSL
    ͯ͠ϓʔϧ͓ͯ͘͠
    ʢ͜ΕΒશͯΛؚΊͯʮ୯Ұͷαʔόϓϩηεʯͱఆٛʣ
    68
    ϦΫΤετ
    Ϩεϙϯε
    ϦΫΤετ
    Ϩεϙϯε
    ϓϩηεϦΫΤετΛ
    ઐ༗ͯ͠ॲཧ

    View full-size slide

  64. WebαʔόͷجຊతͳϞσϧʢworkerʣ
    1BSFOUIUUQEQSPDFTT
    PXOFSSPPU

    $IJMEIUUQEUISFBE
    PXOFSBQBDIF

    $IJMEIUUQEUISFBE
    PXOFSBQBDIF

    $IJMEIUUQEUISBE
    PXOFSBQBDIF

    $MJFOU
    ϦΫΤετ
    Ϩεϙϯε
    6/*9ܥ04ͷ৔߹ࣄલʹϦΫΤετΛड͚Δ
    εϨουΛෳ਺GPSL
    ͯ͠ϓʔϧ͓ͯ͘͠
    69
    ϦΫΤετ
    Ϩεϙϯε
    ϦΫΤετ
    Ϩεϙϯε

    View full-size slide

  65. WebαʔόͷجຊతͳϞσϧʢϊϯϒϩοΩϯάʣ
    1BSFOUOHJOYQSPDFTT
    PXOFSSPPU

    $IJMEOHJOYQSPDFTT
    PXOFSOHJOY

    $IJMEOHJOYQSPDFTT
    PXOFSOHJOY

    $MJFOU
    ϦΫΤετ
    Ϩεϙϯε
    6/*9ܥ04ͷ৔߹ࣄલʹϦΫΤετΛड͚Δ
    ϓϩηεΛෳ਺GPSL
    ͯ͠ϓʔϧ͓ͯ͘͠
    ୯ҰͷϓϩηεͰෳ਺ͷϦΫΤετΛฒߦॲཧ
    70
    ϦΫΤετ
    Ϩεϙϯε
    ϦΫΤετ
    Ϩεϙϯε

    View full-size slide

  66. ߴूੵͷͨΊͷΞʔΩςΫνϟ
    IUUQE
    Ϣʔβ"
    IUUQE
    Ϣʔβ#
    IUUQE
    Ϣʔβ$
    IUUQE
    Ϣʔβ"
    Ϣʔβ#
    Ϣʔβ$
    ޮ཰ྑ͘࢒ϦιʔεΛ࢖͑Δ
    ىಈʹඞཁ
    ͳϦιʔε
    ىಈʹඞཁ
    ͳϦιʔε
    ىಈʹඞཁ
    ͳϦιʔε
    ىಈʹඞཁͳϦιʔε
    ߴूੵ͕ཁٻ͞ΕΔ৔߹ͷ
    Ϛϧνςφϯτʢ7JSUVBM)PTUʣ
    ϗετ୯ҐͰϓϩηεΛىಈ
    71

    View full-size slide

  67. • ಈతίϯςϯπͷݖݶ෼཭ͷͨΊʹsuEXECͷར༻
    • Apacheͱ͸ผͷΦʔφͰಈతίϯςϯπΛ࣮ߦ͢ΔΞΫηε੍ޚख๏
    • ϗετ୯ҐͰҰҙͷઃఆʢuidͳͲʣ͕ඞཁͱͳΓϗετ਺ʹԠͯ͡ઃఆ਺
    ΋૿େ͢Δͱ͍͏՝୊͋Γ
    • Apacheىಈ࣌ͷϝϞϦ࢖༻ྔͷ૿େʹ΋ͭͳ͕Δ
    72
    VirtualHostͷݖݶ෼཭

    View full-size slide

  68. • ApacheͷίΞػೳʹରͯ͠pluginػߏʹΑΓػೳΛ௥Ճ͢Δઃܭ
    • Ұൠతʹߴ଎ੑͱলϝϞϦΛߟྀͯ͠CݴޠͰ࣮૷͢Δ࢓༷
    73
    Apacheͷػೳ֦ுʢApacheϞδϡʔϧʣ

    View full-size slide

  69. ηΫγϣϯͷ·ͱΊ

    View full-size slide

  70. 1. Ϋϥ΢υαʔϏεͱϗεςΟϯάαʔϏε
    2. Webαʔόʹؔ͢ΔԾ૝Խٕज़ͷ෼ྨ
    3. Webαʔόʹ͓͚Δಈతίϯςϯπ
    4. ୅දతͳWebαʔόͷΞʔΩςΫνϟ
    75
    WebαʔόͱWebϗεςΟϯάγεςϜͷجૅ஌ࣝ

    View full-size slide

  71. 4.
    ηΩϡϦςΟͱϦιʔε෼཭

    View full-size slide

  72. ηΫγϣϯͷ֓ཁ

    View full-size slide

  73. 1. Ծ૝ϗετํࣜͷϦιʔεܭଌ
    2. Ծ૝ϗετํࣜͷϦιʔε෼཭
    3. ϦΫΤετ୯ҐͰͷϦιʔε෼཭ͱԾ૝Խ
    4. ͦͷଞ࠷৽ͷݚڀಈ޲
    78
    ηΩϡϦςΟͱϦιʔε෼཭

    View full-size slide

  74. Ծ૝ϗετํࣜͷϦιʔεܭଌ

    View full-size slide

  75. • ݶΒΕͨίϯϐϡʔλϦιʔεΛϗετ୯ҐͰެฏʹϦιʔε෼཭͢΂͖
    • ಛఆͷϗετ΁ͷΞΫηεʹΑΔαʔόશମͷϦιʔεઐ༗Λ๷ࢭ
    • ϋʔυ΢ΣΞίετ͚ͩͰͳ͘ӡ༻ɾ؅ཧίετΛ௿ݮ
    • JaoʹΑΔVirtualHostͰ΋ར༻͔ͷ͏ͳಉ࣌઀ଓ਺ϕʔεͰͷ੍ݶ [11]
    • ϑΝΠϧ΍ϗετ୯ҐͰͷ઀ଓ਺੍ݶ
    • ͨͬͨҰͭͷΞΫηε͕CPU΍I/OΛઐ༗͢Δ໰୊͕Ҏલͱͯ͠࢒Δ
    80
    ߴूੵϚϧνςφϯτΞʔΩςΫνϟͷϦιʔε෼཭
    <>+%BWJE NPEMJNJUJQDPOO IUUQEPNJOJBPSHEKBPMJNJUJQDPOOIUNM

    View full-size slide

  76. • ϚϧνςφϯτํࣜͷϗεςΟϯάͰ͸ଟछଟ༷ͳϓϩάϥϜ͕࣮ߦ͞ΕΔ
    • ϓϩάϥϜʹ੬ऑੑ͕ଘࡏ͢Δಈతίϯςϯπ
    • αʔόશମΛߴෛՙঢ়ଶʹ͢ΔΑ͏ͳಈతίϯςϯπ
    • αʔόͷϦιʔεΛઐ༗͔͠Ͷͳ͍ϓϩάϥϜ͸ਝ଎ʹݕ஌͢΂͖
    • ͦͷͨΊʹ΋ݪҼΛਝ଎͔ͭత֬ʹಛఆ͠ͳ͚Ε͹ͳΒͳ͍
    81
    VirtualHostํࣜʹ͓͚ΔϦιʔεফඅଌఆ

    View full-size slide

  77. • Ϧιʔεઐ༗͍ͯ͠ΔϗετΛಛఆ͠ɺαʔόϓϩηε͝ͱ੍ݶՄೳ
    • ֘౰ͷϓϩηεͷॲཧ͸ඥ෇͍ͨϗετ͚ͩͷॲཧ͕ߦΘΕΔ
    • ઐ༻ͷαʔόϓϩηεͰ͋ΔͨΊɺଞͷϓϩηεʹӨڹΛ༩͑ͳ͍
    • ྫ: ApacheͷMaxClientsͳͲ͕ϗετ୯Ґ
    • ϓϩηε܈୯ҐͰͷϦιʔε੍ݶ΍઀ଓ਺੍ݶͳͲ͕Մೳ
    • ϓϩηε΍ϛυϧ΢ΣΞશͯͷػೳ͕ར༻Մೳ
    82
    ϗετ୯ҐͰઐ༻ͷαʔόϓϩηεΛىಈ͢Δ৔߹

    View full-size slide

  78. • ୯ҰͷαʔόϓϩηεͰҟͳΔϗετͷϦΫΤετΛڞ༗͢Δ
    • ҰͭલͷϦΫΤετ͸ผͷϗετʹର͢ΔϦΫΤετͰ͋Δ৔߹΋͋Δ
    • ࣍ͷϦΫΤετʹঢ়ଶΛ࢒͢ΠϯϝϞϦΩϟογϡతͳॲཧ΋ཁ஫ҙ
    • ϓϩηε୯ҐͰ͸ͳ͘ϦΫΤετ୯ҐͰෛՙର৅Λௐࠪ͢Δඞཁ͕͋Δ
    • ಛఆͷϦΫΤετ͕ͲͷυϝΠϯͰͲͷϑΝΠϧʹΞΫηε͍ͯ͠Δ͔
    83
    VirtualHostํࣜͷϦιʔεফඅଌఆ

    View full-size slide

  79. • psίϚϯυʹΑΔϓϩηε৘ใͷऔಘ
    • ࣮ߦ͍ͯ͠ΔϓϩάϥϜ໊Ͱ͸ͳ͘αʔόϓϩηε໊httpdʹͳΔ
    • αʔόߴෛՙ࣌ʹਝ଎ʹର৅ͷϗετͱϓϩάϥϜΛಛఆ͢Δ͜ͱ͸ࠔ೉
    84
    DSO࣮ߦํࣜͷ৔߹ͷϦιʔεܭଌ

    View full-size slide

  80. • psίϚϯυʹΑΔϓϩηε৘ใऔಘ
    • CGIόΠφϦͷҾ਺ͱͯ͠ϓϩάϥϜ͕౉͞ΕΔͨΊCGIόΠφϦ໊͕දࣔ
    • DSO࣮ߦํࣜͱಉ༷ʹϓϩάϥϜϑΝΠϧΛਝ଎ʹऔಘ͢Δͷ͕ࠔ೉
    • /procҎԼ͔Βղੳ͕ඞཁͰߴෛՙ࣌ʹखؒͷ͔͔Δ࡞ۀ͕ඞཁ
    • ޙ͔ΒݪҼΛ௥ٻ͢Δ͜ͱ΋ࠔ೉
    85
    CGI࣮ߦํࣜͷ৔߹ͷϦιʔεܭଌ

    View full-size slide

  81. • ϦΫΤετΛड͚͔ͯΒϨεϙϯεΛฦ͢·ͰͷϦιʔε࢖༻ྔΛܭଌ
    • https://github.com/matsumotory/mod_resource_checker
    • getrusage()Λ࢖ͬͯϓϩηεͷϦιʔεΧ΢ϯλͷࠩ෼Λऔಘ
    • ApacheϞδϡʔϧͱ࣮ͯ͠૷
    • JSON΍ςΩετͰϩΪϯά͞ΕΔͨΊޙ͔Βͷௐࠪ΍ܭଌ΋༰қ
    86
    দຊΒͷख๏ [12]
    <>দຊ྄հɼ઒ݪক࢘ɼদԬً෉ɼlେن໛ڞ༗ܕ8FCόʔνϟϧϗεςΟϯάج൫ͷηΩϡϦςΟͱӡ
    ༻ٕज़ͷվળɼz৘ॲֶ࿦ɼWPM OP QQr .BSDI

    View full-size slide

  82. 87
    দຊΒͷख๏ͷઃఆαϯϓϧ [12]

    View full-size slide

  83. Ծ૝ϗετํࣜͷϦιʔε෼཭

    View full-size slide

  84. • HTTPϦΫΤετ୯ҐͰͷϗετ੍ޚ
    • ҰൠతͳWebαʔό࣮૷Ͱ͸Ծ૝ϗετ୯Ґͷ੍ݶख๏͸ݶఆత
    • MaxClients΍ίϯςϯπ୯Ґͷಉ࣌઀ଓ਺੍ݶ͕σϑΥϧτͰ͸Ͱ͖ͳ͍
    • Ծ૝ϗετํࣜ͸୯ҰͷαʔόϓϩηεͰେྔͷԾ૝ϗετΛॲཧ͍ͯ͠Δͨ
    ΊҰͭͷԾ૝ϗετͷϦιʔεઐ༗͕શମʹӨڹΛ༩͑ͯ΍͍͢
    • ਫ਼៛ʹ੍ޚͰ͖Δ΂͖
    90
    Ծ૝ϗετํࣜͷ੍ޚ͸ඪ४ػೳͰ͸ݶఆత

    View full-size slide

  85. • CPU΍ϝϞϦɺϓϩηε਺ͷ্ݶઃఆ
    • ϦΫΤετ͔ΒϨεϙϯε·ͰͷCPU࢖༻͕࣌ؒᮢ஋Λ௒͑ͨΒ੾அ
    • ΧʔωϧͷlimitύϥϝʔλʹΑΔ੍ݶͷͨΊϛυϧ΢ΣΞͷ࣮૷ʹؔΘΒͣ
    ڧ੍੾அ(ϓϩηε͕kill)ͰInternal Server ErrorίʔυΛΫϥΠΞϯτʹฦ
    ͢ → ࣄۀऀଆͰ੍ޚ͠ʹ͍͘
    • CGIͷΑ͏ͳࢠϓϩηε͔Βfork()ͨ͠ϓϩάϥϜʹ͔͠ద༻Ͱ͖ͳ͍
    91
    ྫ͑͹Apacheͷඪ४ͷϦιʔε੍ޚ

    View full-size slide

  86. • দຊΒͷmod_vlimit [12]
    • ೚ҙͷϗετ΍ϑΝΠϧ໊ɺઈରύεɺσΟϨΫτϦɺਖ਼نදݱʹରԠ
    • ࢠϓϩηεؒͰڞ༗ϝϞϦ্ʹΧ΢ϯλΛ഑ஔͯ͠ഉଞ੍ޚ
    • ಉҰΫϥΠΞϯτIPΞυϨε͔Βͷಉ࣌઀ଓ਺΋੍ݶՄೳ
    • ੍ݶ௒ա࣌͸Service UnavailableίʔυΛฦ͢
    • ΞΫηε਺΍ίϯςϯπͷϦιʔε࢖༻ྔʹج͍ͮͨϦιʔε੍ޚ
    92
    ϦΫΤετର৅΁ͷ࠷େಉ࣌઀ଓ਺Λ੍ݶ
    <>দຊ྄հɼ઒ݪক࢘ɼদԬً෉ɼlେن໛ڞ༗ܕ8FCόʔνϟϧϗεςΟϯάج൫ͷηΩϡϦςΟͱӡ
    ༻ٕज़ͷվળɼz৘ॲֶ࿦ɼWPM OP QQr .BSDI

    View full-size slide

  87. mod_vlimitઃఆྫ
    93

    View full-size slide

  88. • দຊΒͷmod_lalimit [13]
    • ϦΫΤετड৴࣌ʹϩʔυΞϕϨʔδͷ஋͕ߴ͚Ε͹Service Unabailable
    • ೚ҙͷϗετ΍ϑΝΠϧ໊ɺઈରύεɺσΟϨΫτϦɺਖ਼نදݱʹରԠ
    • αʔόͷશମϦιʔεΛج४ʹͨ͠Ϧιʔε੍ޚ
    94
    ϩʔυΞϕϨʔδͷ਺஋ʹج͍ͮͨϦιʔε੍ޚ
    <>দຊ྄հɼ઒ݪক࢘ɼদԬً෉ɼlେن໛ڞ༗ܕ8FCόʔνϟϧϗεςΟϯάج൫ͷηΩϡϦςΟͱӡ༻
    ٕज़ͷվળɼz৘ॲֶ࿦ɼWPM OP QQr .BSDI

    View full-size slide

  89. ϩʔυΞϕϨʔδͷ਺஋ʹج͍ͮͨϦιʔε੍ޚ
    95

    View full-size slide

  90. ϦΫΤετ୯ҐͰͷϦιʔε෼཭ͱԾ૝Խ

    View full-size slide

  91. 1. αʔόͷෛՙΛ௿ݮ͢Δ͜ͱΛॏࢹ͢Δ͋·ΓϢʔβମݧΛେ͖͘ଛͳͬͯ
    ͍Δ
    2. ࠷େಉ࣌઀ଓ਺ҎԼͰ΋ҰͭͷϦΫΤετͰେྔʹϦιʔεΛ࢖༻͢Δίϯ
    ςϯπΛߟྀͰ͖͍ͯͳ͍
    3. ੍ݶͷཻ౓͕ߥ͘ϗετؒͷϦιʔεڝ߹ʹΑΓշదʹ࢖͑ΔϢʔβͱ࢖͑
    ͳ͍Ϣʔβͷ͕ࠩେ͖͍
    97
    Ծ૝ϗετํࣜͷϦιʔε෼཭ͷ·ͱΊ

    View full-size slide

  92. ࣮ݱ͢΂͖Ϧιʔε੍ޚʢ̍ʣ
    8FCαʔό 8FCαʔό
    Ϛϧνςφϯτํࣜͷαʔόશମͷ$16Ϧιʔε͕ṧഭͨ͠ঢ়ଶʹ͓͍ͯɺ
    ࢖༻Ͱ͖Δ$16Ϧιʔε͸ʹ੍ݶ͞ΕΔ͕ɺར༻Ͱ͖ΔΫϥΠΞϯτ਺͸ഒ
    ΞΫηεෆՄ ΞΫηεՄʂ
    ΞΫηεՄ
    98
    $16ˋ࢖༻͢Δ
    ͭͷϓϩάϥϜΛॲཧ
    $16ˋ࢖༻͢Δ
    ͭͷϓϩάϥϜΛॲཧ
    ࣮ݱ͍ͨ͠ख๏
    ͜Ε·Ͱͷख๏
    ΑΓཻ౓ͷ
    ࡉ੍͔͍ݶ

    View full-size slide

  93. • ϦΫΤετʹؚ·ΕΔ༷ʑͳଐੑΛݩʹ੍ޚ͍ͨ͠
    • ߴूੵϚϧνςφϯτํࣜͰ͸ϦΫΤετͷଐੑͰϗετΛ۠ผ͠ϓϩηε
    Λڞ༗͢ΔͨΊ
    • ϦΫΤετ୯ҐͰͷϦιʔε෼཭͕ඞཁ
    • ෳࡶͳઃఆΛϓϩάϥϚϒϧʹهड़Մೳʹ͍ͨ͠
    99
    ࣮ݱ͢΂͖Ϧιʔε੍ޚʢ̎ʣ

    View full-size slide

  94. • OSͷϓϩηεϦιʔε෼཭ٕज़ΛWebαʔόͷϦΫΤετ୯ҐͰ׆༻੍͠ޚ
    • ػೳ֦ுࢧԉػߏmod_mruby [15] ΛԠ༻ʢޙड़ʣ
    • ϓϩάϥϚϒϧͰΦʔόʔϔουগͳ͍Webαʔόͷػೳ֦ுࢧԉػߏͰ
    ϦΫΤετ୯ҐʹϦιʔεΛ੍ޚՄೳ
    • RubyͰ֦ுͭͭ͠ߴ଎ʹಈ࡞Մೳ
    100
    দຊΒͷϦιʔε੍ޚΞʔΩςΫνϟ [14]
    <>দຊ྄հ ܀ྛ݈ଠ࿠ Ԭ෦णஉ ϦΫΤετ୯ҐͰԾ૝తʹϋʔυ΢ΣΞϦιʔεΛ෼཭͢Δ8FCαʔόͷϦιʔε੍ޚΞʔΩςΫνϟ
    ৘ใॲཧֶձ࿦จࢽ 7PM /P QQ .BS
    <>দຊ྄հ Ԭ෦णஉ NPE@NSVCZεΫϦϓτݴޠͰߴ଎͔ͭলϝϞϦʹ֦ுՄೳͳ8FCαʔόͷػೳ֦ுࢧԉػߏ ৘ใॲཧֶձ࿦จࢽɼ
    7PM /P QQ /PW

    View full-size slide

  95. • ϓϩηε୯ҐͰCPUɾϝϞϦɾI/O౳Λ੍ޚ
    • Linux Kernel 2.6.24Ҏ߱ͷػೳ
    • ಛఆͷϓϩηε͸1ίΞCPU30%·Ͱ͔͠࢖༻Ͱ͖ͳ͍ͳͲ
    • CPU30%ΛׂΓ౰ͯͨϦιʔεάϧʔϓΛ࡞੒
    • άϧʔϓʹࢀՃ͍ͯ͠Δෳ਺ͷϓϩηεͰϦιʔε෼഑
    • 3ͭͷϓϩηε͕CPUΛ࠷େ࢖͏৔߹͸10%ͣͭ෼഑͞ΕΔ౳
    102
    LinuxಠࣗͷϦιʔε੍ޚ cgroup

    View full-size slide

  96. 8FCαʔό
    ϓϩηε
    ΫϥΠΞϯτ
    ϦΫΤετ
    Ϩεϙϯε
    Ϩεϙϯεੜ੒ͷॲཧͷؒͷΈ
    ϓϩηεΛಛఆͷDHSPVQʹΞλον
    ʢ$16ͳͲʣ
    DHSPVQΞλον
    DHSPVQσλον
    ϦΫΤετ୯ҐͰͷϦιʔε੍ޚ
    103

    View full-size slide

  97. mod_mrubyͱcgroupͷ࣮૷
    "QBDIF1SPDFTT
    NPE@NSVCZ
    NSVCZ
    MJCNSVCZB

    NSVCZDHSPVQ
    MJCDHSPVQ
    -JOVYDHSPVQT
    •  ֤ػೳ͸୯ମͰಈ࡞Մೳʢૄ݁߹ʣ
    •  NPE@NSVCZ͸"QBDIFΛNSVCZͰ੍ޚ
    •  NSVCZDHSPVQ͸MJCDHSPVQΛNSVCZͰ੍ޚ
    •  NSVCZNSVCZDHSPVQ
    •  3VCZ΍$ίʔυ಺ͰϦιʔεΛ੍ޚՄೳ
    •  ͜ͷϧʔϓ͸$16Ͱ
    •  ͜ͷॻ͖ग़͠͸%*4,ॻࠐ.#TFDͰ
    104

    View full-size slide

  98. Apacheͱmod_mrubyʹΑΔ࣮૷֓ཁ
    105

    View full-size slide

  99. Ϧιʔε੍ޚͷઃఆྫ
    r = Apache::Request.new
    if r.filename == “/path/to/cpu.cgi”
    cpu = Cgroup::CPU.new “cpu_group”
    # CPU 10
    cpu.cfs_quota_us = 10000
    cpu.create
    cpu.attach
    end
    106
    ݫີʹ͸NTதNTͷ$16࢖༻࣌ؒΛ
    RVPUBͱͯ͠εέδϡʔϧ͢Δઃఆ

    View full-size slide

  100. Ϧιʔε੍ޚͷઃఆྫ
    r = Apache::Request.new
    if r.hostname == “example.com”
    cpu = Cgroup::CPU.new “cpu_group”
    # CPU 10
    cpu.cfs_quota_us = 10000
    cpu.create
    cpu.attach
    end
    107

    View full-size slide

  101. Ϧιʔε੍ޚͷઃఆྫ
    r = Apache::Request.new
    if r.user== “matsumotory”
    cpu = Cgroup::CPU.new “cpu_group”
    # CPU 10
    cpu.cfs_quota_us = 10000
    cpu.create
    cpu.attach
    end
    108

    View full-size slide

  102. Ϧιʔε੍ޚͷઃఆྫ
    r = Apache::Request.new
    if r.method== “POST”
    cpu = Cgroup::CPU.new “cpu_group”
    # CPU 10
    cpu.cfs_quota_us = 10000
    cpu.create
    cpu.attach
    end
    109

    View full-size slide

  103. Ϧιʔε੍ޚͷઃఆྫ
    r = Apache::Request.new
    if r.finfo.user == 500
    cpu = Cgroup::CPU.new “cpu_group”
    # CPU 10
    cpu.cfs_quota_us = 10000
    cpu.create
    cpu.attach
    end
    110

    View full-size slide

  104. Ϧιʔε੍ޚͷઃఆྫ
    r = Apache::Request.new
    if r.finfo.group == 300
    cpu = Cgroup::CPU.new “cpu_group”
    # CPU 10
    cpu.cfs_quota_us = 10000
    cpu.create
    cpu.attach
    end
    111

    View full-size slide

  105. Ϧιʔε੍ޚͷઃఆྫ
    r = Apache::Request.new
    if r.finfo.size > 3000
    cpu = Cgroup::CPU.new “cpu_group”
    # CPU 10
    cpu.cfs_quota_us = 10000
    cpu.create
    cpu.attach
    end
    112

    View full-size slide

  106. Ϧιʔε੍ޚͷઃఆྫ
    if resource.most_heavy_hosts.include? r.hostname
    # 1 100 1
    c = Cgroup::CPU.new "httpd-static-limited"
    c.cfs_quota_us = 100000
    Apache::Resource.attach_cgroup c, "httpd-static-limited"
    elsif resource.heavy_hosts.include? r.hostname
    # CPU 25% 24 6
    # httpd 100 ( )
    c = Cgroup::CPU.new "httpd-limited"
    c.shares = 25
    Apache::Resource.attach_cgroup c, "httpd-limited"
    else
    # CPU 75% 24 18
    # httpd-limited 100 ( )
    c = Cgroup::CPU.new "httpd"
    c.shares = 75
    Apache::Resource.attach_cgroup c, "httpd"
    end
    113

    View full-size slide

  107. • Ϧιʔε੍ޚಋೖʹΑΔΦʔόʔϔουධՁ
    • Ϧιʔε੍ޚͷਫ਼౓ධՁ
    114
    ਫ਼౓ͱΦʔόʔϔουͷධՁ

    View full-size slide

  108. ࣮ݧ؀ڥ
    115

    View full-size slide

  109. • Hello World͢Δ͚ͩͷHTMLϑΝΠϧ
    • Ϧιʔε੍ޚಋೖ੍͠ݶΛ͠ͳ͍৔߹ͷΦʔόʔϔου
    • ಉ࣌઀ଓ਺100ɾ૯઀ଓ਺100ສϦΫΤετ
    • ະಋೖ࣌ɿ32915.46 response/sec
    • ಋೖ࣌ɿ32322.07 response/sec
    116
    ΦʔόʔϔουͷධՁ

    View full-size slide

  110. • CPU100%࢖༻͢ΔCGI΁ϦΫΤετ
    • CPU50%ʹϦιʔε੍ޚ
    • CGIͷCPU࢖༻࣌ؒΛมߋͯ͠ਫ਼౓Λൺֱ
    • ੑೳ੍ޚ཰Λఆٛɿ
    • Ϩεϙϯε࣌ؒʢ੍ݶແ͠ʣ/ Ϩεϙϯε࣌ؒʢ੍ݶ༗Γʣ
    • ੑೳ੍ޚ཰͕50%ʹ͚ۙΕ͹ਖ਼੍͘͠ޚ͞Ε͍ͯΔ
    117
    Ϧιʔε੍ޚͷਫ਼౓ධՁ

    View full-size slide

  111. ͦͷଞ࠷৽ͷݚڀಈ޲

    View full-size slide

  112. ܦݧతʹɺαʔόͷϦιʔε࢖༻ྔͷେখΑΓ΋ɺϦιʔε࢖༻ྔͷมԽͷେখ
    ͕ߴूੵϚϧνςφϯτํࣜʹ͓͚ΔಥൃతͳߴෛՙͷݪҼͱͳΔ͜ͱ͕ଟ͍ɻ
    ·ͨɺͦͷݪҼͷߟྀ͕ௐࠪίετΛ૿େ͍ͤͯ͞Δɻ
    120
    ಥൃతͳߴෛՙͷݪҼ

    View full-size slide

  113. • Ϧιʔε஋ͷ࣌ܥྻσʔλͷมԽ఺είΞΛܭࢉ[16]
    • มԽ఺ݕग़͸false positive/negative͕ॏཁ
    • มԽ఺ݕग़ޙʹଈ੍࣌ݶ͢Δͱޡݕ஌ͷӨڹେ
    • ౷ܭ஋Λ׆͔ͤΔݕ஌࣌ͷΞΫγϣϯ͕ඞཁ
    121
    Ϧιʔε஋ͷมԽ఺ݕग़ΛԠ༻
    <>+5BLFVDIJBOE,:BNBOJTIJ l"6OJGZJOH'SBNFXPSLGPS%FUFDUJOH0VUMJFSTBOE$IBOHF1PJOUTGSPN5JNF
    4FSJFT z*&&&USBOTBDUJPOTPO,OPXMFEHFBOE%BUB&OHJOFFSJOH QQ

    View full-size slide

  114. γϛϡϨʔγϣϯσʔλͱมԽ఺είΞ
    ैདྷͷᮢ஋ॲཧͰ͸ݕ஌͕ࠔ೉͕ͩ
    มԽ఺ݕग़ʹΑͬͯݕ஌Մೳ
    ແࢹ͍ͨ͠
    122

    View full-size slide

  115. • աڈͷϦιʔε஋ͷ܏޲มԽΛΦϯϥΠϯͰஞֶ࣍श
    • มԽΛ΋ͨΒͨ͠ݪҼͷॏΈ෇͚Λஞ࣮࣍ࢪ
    • αʔόߴෛՙ࣌ʹࣗಈͰݪҼର৅ͱॏΈ෇͚͔Β੍ݶ
    • HTTPϦΫΤετܖػʹWebαʔό͕ࣗ཯తʹϦΫΤετͷಛ௃ྔΛղੳɾ
    ੍ޚͰ͖ͨΒଈ࣌ੑ΋޲্
    123
    มԽྔΛஞ࣍ղੳͯ͠ௐࠪͱରԠʹ׆༻

    View full-size slide

  116. 1. ϦΫΤετ୯ҐͷϨεϙϯελΠϜͱಉ࣌઀ଓ਺ͷ࣌ܥྻσʔλ͔Βಛ௃ྔ
    ͱͯ͠ͷมԽ఺είΞܭࢉ
    2. มԽ఺είΞͷՃࢉʹΑΔϗετ΍ϑΝΠϧʹؔ͢Δಛ௃ྔͷॏΈ෇͚Ϧε
    τͷੜ੒
    3. ߴෛՙ࣌ʹϦετͷϥϯΩϯάͷߴ͍ऩ༰ϗετ΍ϑΝΠϧ΁ͷϦΫΤετ
    ͸ಛ௃ྔʹ΋ͱ͍ͮͯCPUϦιʔεͱಉ࣌઀ଓ਺ʹΑͬͯࣗ཯੍ޚ
    124
    দຊΒͷ࠷৽ͷݚڀ [17]
    <>দຊ྄հɼాฏ߁࿕ɼࢁԼ࿨඙ɼ܀ྛ݈ଠ࿠ɼlಛ௃ྔநग़ͱมԽ఺ݕग़ʹجͮ͘8FCαʔόͷߴूੵϚϧνςφ
    ϯτํࣜʹ͓͚ΔϦιʔεͷࣗ཯੍ޚΞʔΩςΫνϟɼz৘ॲֶݚใɼWPM*05 OP QQr 'FC

    View full-size slide

  117. দຊΒͷख๏ͷࣗ཯੍ޚϑϩʔ
    8FCαʔό
    ϓϩηε
    ΫϥΠΞϯτ
    ϦΫΤετ
    Ϩεϙϯε
    ॏΈ෇͚Ϧετ
    Ϩεϙϯεੜ੒ʹ
    ফඅͨ͠Ϧιʔε஋͔
    ΒมԽ఺είΞܭࢉ
    ϗετ ͱεΫϦϓτ
    ຖͷϦ
    ιʔε࢖༻ྔͷ࣌ܥྻσʔλ
    ͔Βஞ࣍ܭࢉͨ͠౷ܭϞσϧ
    ͷ܎਺Λอଘ
    มԽ఺είΞΛॏΈ
    ෇͚ϦετʹՃࢉ
    ߴෛՙ࣌͸ॏΈ෇͚Ϧ
    ετ্Ґͷ৔߹ɺ੍ݶԼ
    ͰϨεϙϯεੜ੒
    Ϧιʔεݶఆ؀ڥ
    $16ˋ
    *014
    ϑΝΠϧ΁ͷಉ࣌઀ଓ਺
    125

    View full-size slide

  118. • Webαʔόͷػೳ֦ு mod_mruby/ngx_mruby [18]
    • มԽ఺ݕग़Τϯδϯ mruby-changefinder
    • https://github.com/matsumotory/mruby-changefinder
    • ಉ࣌઀ଓ਺੍ݶ http-access-limiter
    • https://github.com/matsumotory/http-access-limiter
    <>দຊ྄հ Ԭ෦णஉ NPE@NSVCZεΫϦϓτݴޠͰߴ଎͔ͭলϝϞϦʹ֦ுՄೳͳ8FCαʔόͷػೳ֦ுࢧԉ
    ػߏ ৘ใॲཧֶձ࿦จࢽɼ7PM /P QQ /PW
    126
    σʔλੜ੒ͱղੳख๏͸ఏҊɾ࣮૷ࡁΈ

    View full-size slide

  119. • ϨεϙϯελΠϜͷ࣌ܥྻσʔλ
    • rc_scoreͱͯ͠มԽ఺είΞΛॏΈ෇͚ʹՃࢉ
    • ಉҰϑΝΠϧ΁ͷಉ࣌઀ଓ਺ͷ࣌ܥྻσʔλ
    • st_scoreͱͯ͠มԽ఺είΞΛॏΈ෇͚ʹՃࢉ
    • score͸ϗετɾϑΝΠϧ୯ҐͰॏΈ෇͚
    127
    ղੳର৅ͷ࣌ܥྻσʔλͱॏΈ෇͚Ϧετ

    View full-size slide

  120. ॏΈ෇͚Ϧετͷσʔλߏ଄ྫ
    128
    {
    host1: {ɹɹɹɹɹɹɹɹɹɹɹɹ # ϗετ໊
    st_score: 83, # ϗετͷಉ࣌઀ଓ਺είΞ
    rc_score: 32, # ϗετͷϨεϙϯελΠϜείΞ
    files: {
    path_to_progmra1: { # ϓϩάϥϜϑΝΠϧύε
    st_score: 30, # ϑΝΠϧͷಉ࣌઀ଓ਺είΞ
    rc_score: 20, # ϑΝΠϧͷϨεϙϯελΠϜείΞ
    },
    path_to_progmra2: {
    st_score: 53,
    rc_score: 12,
    },
    },
    },
    }
    ϑΝΠϧ΁ͷϦΫΤετʹରͯ͠ܭࢉͨ͠είΞΛɺ֘౰
    ͢ΔϗετͱϑΝΠϧͷείΞʹͦΕͧΕՃࢉ͢Δ

    View full-size slide

  121. มԽ఺είΞܭࢉྫ
    129
    > cf = ChangeFinder.new 5, 0.01, 10, 0.01, 7
    => #@change_point_analyze=#,
    @smooth_term=5, @outlier_analyze=#0x7fad5c80be20>>
    > cf.learn [1,2,1,2,3,2,1,2,1]
    => [6.2017912433901, 1.3973555597559, 2.4211198000217,
    2.3979400886673, 1.7835503570548, 1.4166612339939,
    1.4837836144657, 1.2835583707215, 1.1556254255408]
    > cf.score 1
    => 1.1044914205061

    View full-size slide

  122. WebαʔόͷมԽ఺ݕग़֦ுͷઃఆྫ
    130
    # /etc/httpd/conf.d/mod_mruby.conf
    LoadModule mruby_module modules/mod_mruby.so
    # ChangeFinderͷॳظԽॲཧΛϑοΫ
    mrubyPostConfigMiddle cf_init.rb cache
    # มԽ఺είΞͷܭࢉॲཧΛϑοΫ
    mrubyLogTransactionMiddle cf_score.rb cache

    View full-size slide

  123. มԽ఺ݕग़ΤϯδϯͷॳظԽ࣮૷ྫ
    131
    # ChangeFinderΠϯελϯεੜ੒
    cf = ChangeFinder.new(5, 0.1, 10, 0.1, 3)
    # ԾֶशσʔλʹΑΔࣄલֶश
    cf.learn [1,1,1,1,1,1,1,1,1,1]
    # ֤ϑΣʔζͰσʔλΛऔΓग़ͤΔΑ͏ʹϢʔβσʔλʹอଘ
    Userdata.new.cf_list = {}
    Userdata.new.cf = cf

    View full-size slide

  124. ϗετ୯ҐͷมԽ఺είΞͷܭࢉྫ
    132
    r = Apache::Request.new
    cf = Userdata.new.cf
    cf_list = Userdata.new.cf_list

    hostname = r.hostname
    res_time = r.response_time
    # vhostͷChangeFinderΠϯελϯε͕ଘࡏ͠ͳ͚Ε͹ෳ੡
    unless cf_list.has_key?(hostname)
    usercf[hostname] = cf.clone
    end
    # ϦΫΤετλΠϜ͔ΒมԽ఺είΞΛܭࢉ͠ϩάʹग़ྗ
    Apache.log Apache::APLOG_ERR, “requesttime: #{r.response_time.to_s} score:
    #{cf_list[hostname].score(res_time)} hostname: #{hostname}”

    View full-size slide

  125. • st_scoreͷᮢ஋௒ա࣌͸ಉ࣌઀ଓ਺੍ݶ
    • rc_scoreͷᮢ஋௒ա࣌͸࠷େCPU࢖༻཰੍ݶ
    • ྆ํͷείΞ͕ߴ͍৔߹͸྆ํΛ੍ݶ
    133
    ੍ݶϧʔϧ

    View full-size slide

  126. • ϦΫΤετ୯ҐͰCPUͷ࠷େ࢖༻཰Λมߋ [19]
    • cgroup(mruby-cgroup)΍rlimit(mruby-resource)
    • ϗετ୯Ґ΍ϑΝΠϧ୯ҐͰͷಉ࣌઀ଓ਺Λมߋ
    • mod_mrubyͱhttp-access-limiter
    134
    ੍ݶख๏ͷίϯϙʔωϯτ͸࣮૷ࡁΈ
    <>দຊ྄հ ܀ྛ݈ଠ࿠ Ԭ෦णஉ ϦΫΤετ୯ҐͰԾ૝తʹϋʔυ΢ΣΞϦιʔεΛ෼཭͢Δ8FCαʔόͷϦιʔ
    ε੍ޚΞʔΩςΫνϟ ৘ใॲཧֶձ࿦จࢽ 7PM /P QQ .BS

    View full-size slide

  127. ηΫγϣϯͷ·ͱΊ

    View full-size slide

  128. 1. Ծ૝ϗετํࣜͷϦιʔεܭଌ
    2. Ծ૝ϗετํࣜͷϦιʔε෼཭
    3. ϦΫΤετ୯ҐͰͷϦιʔε෼཭ͱԾ૝Խ
    4. ͦͷଞ࠷৽ͷݚڀಈ޲
    136
    ηΩϡϦςΟͱϦιʔε෼཭

    View full-size slide

  129. 5.
    ηΩϡϦςΟͱੑೳ

    View full-size slide

  130. ηΫγϣϯͷ֓ཁ

    View full-size slide

  131. 1. γεςϜྖҬ΍ଞϗετྖҬͷ೷͖ݟ
    2. CGI࣮ߦํࣜͷηΩϡϦςΟ
    3. DSO࣮ߦํࣜͷηΩϡϦςΟ(1)~(4)
    4. ͦͷଞ࠷৽ͷݚڀಈ޲
    139
    ηΩϡϦςΟͱੑೳ

    View full-size slide

  132. γεςϜྖҬ΍ଞϗετྖҬͷ೷͖ݟ

    View full-size slide

  133. • ࣮༻໘͔Βݱ࣮తͳηΩϡϦςΟٴͼ͏࣮ӡ༻্ͷ՝୊Λ੔ཧ
    • ApacheͷVirtualHostΛ༻͍ͨߴूੵϚϧνςφϯτํࣜͷݖݶ෼཭
    • ηΩϡϦςΟͱੑೳͷཱ྆ʹ͍ͭͯ۩ମతͳΞʔΩςΫνϟͷ੔ཧ
    • OS୯Ґɺϓϩηε୯ҐɺHTTPϦΫΤετ୯Ґͷݖݶ෼཭ͳͲ༷ʑ
    • Ծ૝ϗετํࣜͷηΩϡϦςΟ͔Βϓϩηεͷݖݶ෼཭ͱੑೳΛֶͿ
    141
    Ծ૝ϗετํࣜͷݖݶ෼཭

    View full-size slide

  134. • OSͷγεςϜྖҬͰWebαʔόϓϩηεΛҰൠϢʔβͷݖݶͰىಈ
    • ҰൠϢʔβͰӾཡՄೳͳΦʔφઃఆͷϑΝΠϧ΍σΟϨΫτϦ͸ӾཡՄೳ
    • Webαʔόϓϩηε͸Ծ૝ϗετͷશͯͷίϯςϯπΛૢ࡞͢Δඞཁ͕͋Δ
    • ΞΫηε੍ޚΛ͠ͳ͍৔߹ɺશͯͷԾ૝ϗετ͕૬ޓʹίϯςϯπΛ೷͖ݟՄ
    ೳʹͳΔ
    142
    Ծ૝ϗετํࣜͷݖݶ෼཭

    View full-size slide

  135. Ծ૝ϗετؒͰͷίϯςϯπ೷͖ݟ
    143
    w JOEFYDHJ͸BQBDIFݖݶͰ࣮ߦ
    w JOEFYDHJͷதͰ֎෦ίϚϯυ࣮ߦʹ
    ΑΓIPTUͷJOEFYDHJΛSFBE͢Δͱ
    ಺༰͕ӾཡՄೳ
    w JOEFYDHJͷதʹECQBTT͕ॻ͔Εͯ
    ͍Δ͜ͱ΋͋Δ

    View full-size slide

  136. • suEXECͷΑ͏ͳΞΫηε੍ޚػߏΛར༻
    • ಈతίϯςϯπͷ࣮ߦΦʔφΛαʔόϓϩηεͷΦʔφͱม͔͑ͯΒ࣮ߦ
    • ֤ϗετ୯ҐͰ࣮ߦΦʔφΛݸผʹมߋ͢Δ͜ͱͰ೷͖ݟΛ๷͙
    144
    Ծ૝ϗετํࣜͷΞΫηε੍ޚͷجຊઓུ

    View full-size slide

  137. CGI࣮ߦํࣜͷηΩϡϦςΟ

    View full-size slide

  138. • VirtualHostʹ͓͍ͯଞϗετྖҬΛӾཡͰ͖ͳ͍ߏ੒ΛߏஙՄೳ
    • CGI࣮ߦ࣌ʹ࣮ߦΦʔφΛมߋ͢ΔΞʔΩςΫνϟ
    146
    CGI࣮ߦํࣜͱsuEXECͷجຊઓུ

    View full-size slide

  139. CGI࣮ߦํࣜ
    $(*QSPDFTT QIQDHJJOEFYQIQ
    $(*QSPDFTT
    GPSL

    UFSNJOBUFQSPDFTT
    FYFDWF

    1BSFOUIUUQEQSPDFTT
    PXOFSSPPU

    $IJMEIUUQEQSPDFTT
    PXOFSBQBDIF

    ϦΫΤετຖʹϓϩηεͷੜ੒ɾഁغͱ
    ൺֱతେ͖ͳόΠφϦʢ1)1ͩͱQIQDHJόΠφϦʣͷ
    FYFDWF
    ͕ඞཁ
    147

    View full-size slide

  140. $(*QSPDFTT
    PXOFSVTFS

    $(*QSPDFTT
    PXOFSSPPU

    QIQDHJJOEFYQIQ
    PXOFSVTFS

    $(*QSPDFTT
    PXOFSVTFS

    ੩తʹઃఆ͞ΕͨVJEΛݩʹTFUVJE
    TFUHJE

    GPSL

    FYFDWF
    TVFYFDQSPHSBN TFUVJESPPU

    UFSNJOBUFQSPDFTT
    FYFDWF

    1BSFOUIUUQEQSPDFTT
    PXOFSSPPU

    $IJMEIUUQEQSPDFTT
    PXOFSBQBDIF

    ϦΫΤετຖʹ$(*༻ϓϩηεͷ
    ੜ੒ഁغ͕ඞཁ
    ˞$(*TV&9&$
    148

    View full-size slide

  141. • DoerschΒʹΑΔख๏[19]
    • suEXEC࣌ʹ֤ϗετ؀ڥͰchroot()γεςϜίʔϧʹΑΓִ཭
    • ϗετྖҬ֎ͷϑΝΠϧΛӾཡ͢Δ͜ͱ͕Ͱ͖ͳ͍
    • ϗετ୯ҐͰݸผʹϥΠϒϥϦ΍࣮ߦ؀ڥΛ༰қ͢Δඞཁ͸͋Δ
    • ෳ਺ͷ࣮ߦ؀ڥͷݻఆతͳϥΠϒϥϦ͸ϋʔυϦϯΫͰࢀর͢Δ͜ͱʹΑ
    Γ࣮ߦ؀ڥߏங΍࢖༻༰ྔͷίετΛ࡟ݮՄೳ
    150
    suEXECͱchrootͷ૊Έ߹ΘͤʹΑΔִ཭ख๏
    <>'%PFSTDI #VH$ISPPU1BUDIGPS4V&YFD IUUQTC[BQBDIFPSHCVH[JMMBTIPXCVHDHJ JE

    View full-size slide

  142. $(*QSPDFTT
    PXOFSVTFS

    $(*QSPDFTT
    PXOFSSPPU

    QIQDHJJOEFYQIQ
    PXOFSVTFS

    $(*QSPDFTT
    PXOFSVTFS

    DISPPU
    ޙ
    TFUVJE
    TFUHJE

    GPSL

    FYFDWF
    TVFYFDQSPHSBN TFUVJESPPU

    UFSNJOBUFQSPDFTT
    FYFDWF

    1BSFOUIUUQEQSPDFTT
    PXOFSSPPU

    $IJMEIUUQEQSPDFTT
    PXOFSBQBDIF

    DISPPU&OWJSPONFOU
    ˞%PFSTDIΒͷख๏
    151

    View full-size slide

  143. • CGIϓϩάϥϜ࣮ߦ୯ҐͰϓϩηεͷੜ੒ɾഁغ͕ඞཁͱͳΓੑೳ͕௿͘ͳΔ
    • suEXECϓϩάϥϜͷexecv()΋ෳ਺ճ࣮ߦ
    • ϓϩάϥϜͷΠϯλϓϦλΛ࠷ॳ͔Βىಈ͢Δඞཁ͕͋Γىಈίετ͕ߴ͍
    • DSOͷΞΫηε੍ޚͷੑೳͱൺֱͯ͠ޙड़
    152
    CGI࣮ߦํࣜͷΞΫηε੍ޚͷ՝୊

    View full-size slide

  144. DSO࣮ߦํࣜͷηΩϡϦςΟ(1)

    View full-size slide

  145. • αʔόϓϩηεʹ૊ΈࠐΜͩΠϯλϓϦλ͕ϓϩάϥϜΛ௚઀࣮ߦ
    • ϦΫΤετ୯ҐͰϓϩηεͷੜ੒ɾഁغ͕ෆཁ
    • ΠϯλϓϦλΛ࠷ॳ͔Βϩʔυ͢Δඞཁ΋ແ͠
    • εΫϦϓτͷߦ಄ʹShebangߦͷهड़΋ඞཁແ͠
    • αʔόϓϩηεͷΦʔφͰ࣮ߦ͞ΕΔͨΊηΩϡϦςΟʹ஫ҙ͕ඞཁ
    • ΞΫηε੍ޚख๏͕͍͔ͭ͘ఏҊ͞Ε͖ͯͨ
    154
    DSO࣮ߦํࣜͷϝϦοτͱݖݶ෼཭

    View full-size slide

  146. DSO࣮ߦํࣜ
    155
    1BSFOUIUUQEQSPDFTT
    PXOFSSPPU

    $IJMEIUUQEQSPDFTT
    PXOFSBQBDIF
    JOEFYQIQ
    QBSTFSVO
    αʔόϓϩηεʹΠϯλϓϦλΛϥΠϒϥϦ
    ͱͯ͠௚઀૊ΈࠐΜͰ͓͘

    View full-size slide

  147. • DSO࣮ߦํࣜͰ͋Δmod_php͸ηʔϑϞʔυͱ͍͏ػೳ͕͋ͬͨ
    • Ծ૝ϗετํࣜͷݖݶ෼཭Λ࣮ݱ͢ΔͨΊͷࢼΈ[20]
    • PHPಛ༗ͷηΩϡϦςΟػߏͰ͋Γ൚༻ੑʹ͚ܽͨ
    • OS΍ϑΝΠϧγεςϜͷݖݶ෼཭ͷ՝୊ΛΞϓϦέʔγϣϯϨΠϠʔͰ࣮
    ݱ͢Δʹ͸ΞʔΩςΫνϟ্ݱ࣮తͰ͸Μ͔ͬͨ
    • PHP5.3.0Ͱ࢖༻͕ඇਪ঑ͱͳΓɺPHP5.4.0Ͱػೳ࡟আ
    156
    PHPͷηʔϑϞʔυ
    <>IUUQQIQOFUNBOVBMKBGFBUVSFTTBGFNPEFQIQ

    View full-size slide

  148. DSO࣮ߦํࣜͷηΩϡϦςΟ(2)

    View full-size slide

  149. • NakamitsuΒʹΑΔख๏ [21]
    • ApacheϞδϡʔϧmod_suid2ͱ࣮ͯ͠૷
    • αʔόϓϩηεΛrootݖݶͰىಈ͓͖ͯ͠ɺϦΫΤετ୯ҐͰݖݶΛมߋ
    159
    rootͷαʔόϓϩηεͰݖݶ෼཭͢Δख๏
    <>)JEFP/ NPETVJE IUUQDPEFHPPHMFDPNQNPETVJE

    View full-size slide

  150. DSO࣮ߦํࣜ
    160
    1BSFOUIUUQEQSPDFTT
    PXOFSSPPU

    $IJMEIUUQEQSPDFTT
    PXOFSBQBDIF
    JOEFYQIQ
    QBSTFSVO
    αʔόϓϩηεʹΠϯλϓϦλΛϥΠϒϥϦ
    ͱͯ͠௚઀૊ΈࠐΜͰ͓͘

    View full-size slide

  151. 1BSFOUIUUQEQSPDFTT
    PXOFSSPPU

    $IJMEIUUQEQSPDFTT
    PXOFSSPPU

    JOEFYQIQ
    PXOFSVTFS

    TFUVJE
    TFUHJE

    QBSTF SVO
    ˞NPE@TVJE
    $IJMEIUUQEQSPDFTT
    PXOFSVTFS

    $IJMEIUUQEQSPDFTT
    PXOFSVTFS

    UFSNJOBUFQSPDFTT
    ϦΫΤετຖͷࢠIUUQEϓϩηεͷੜ੒ഁغ͕ඞཁ


    View full-size slide

  152. • DSO࣮ߦํࣜͷϝϦοτͰ͋ΔύϑΥʔϚϯεͷԸܙ͕ಘΒΕͳ͍
    • ϦΫΤετ୯ҐͰࢠαʔόϓϩηεΛੜ੒ɾഁغ͢Δඞཁ͕͋Δ
    • ࢠαʔόϓϩηεͷੜ੒ɾഁغ͸CGIϓϩηεͷੜ੒ɾഁغΑΓ΋ίετߴ
    • ݁ՌతʹCGIํࣜͰϓϩάϥϜΛ࣮ߦ͢ΔΑΓ΋ੑೳ͕௿Լ
    • αʔόϓϩηεʹ೚ҙͷίϚϯυΛ࣮ߦ͢Δ੬ऑੑ͕͋Δ৔߹
    • ༰қʹrootݖݶΛ࣋ͬͨϓϩηεΛୣΘΕΔ
    162
    mod_suid2ͷ՝୊

    View full-size slide

  153. • αʔόϓϩηεΛrootͰىಈηΩϡΞOSͰrootͷಛݖΛҰ෦੍ݶ͓ͯ͘͠
    • ϦΫΤετຖʹfork()ͰϓϩηεΛੜ੒͠ɺϓϩηεͷݖݶΛมߋ͔ͯ͠Βί
    ϯςϯπΛ࣮ߦɺϓϩηεΛഁغ͢Δख๏
    • mod_suid2ΑΓ҆શͰ͋Δ͕ϦΫΤετ୯ҐͰϓϩηεͷੜ੒ɾഁغ͕ඞཁ
    • ݪཧతʹDSO࣮ߦํࣜͰ͋ͬͯ΋suEXECΛ࢖ͬͨCGIఔ౓ͷੑೳʹͳΔ
    163
    ݪΒʹΑΔख๏ [22]
    <>ݪେีɼඌ྄࡚ଠɼฌ಄࿨थɼதࢁହҰɼl)BSBDIFϑΝΠϧॴ༗ऀͷݖݶͰಈ࡞͢Δ888αʔ
    όɼz৘ॲֶ࿦ɼWPM OP QQr

    View full-size slide

  154. • CGI࣮ߦํࣜ(chroot+suEXEC)ɺCGI࣮ߦํࣜ(suEXEC)ɺDSO(mod_suid2)
    • ಉ࣌઀ଓ਺Λ1͔Β450ʹมԽͤ͞ͳ͕ΒඵؒͷϨεϙϯε਺Λܭଌ
    • PHPͰจࣈྻΛग़ྗ͢Δ͚ͩͷCGIϓϩάϥϜΛར༻
    164
    ࢀߟ: ੑೳධՁ

    View full-size slide

  155. ࣮ݧ؀ڥ
    165

    View full-size slide

  156. DSO࣮ߦํࣜͷηΩϡϦςΟ(3)

    View full-size slide

  157. • ੑೳ໘ʹ͓͍ͯCGI͸ຊདྷద͍ͯ͠ͳ͍
    • ऩ༰਺͕૿͑ΔͱϓϩηεͷϝϞϦ࢖༻ྔ͕૿͑fork()ͷޮ཰௿Լ
    • ͦ΋ͦ΋ϦΫΤετ୯ҐͰfork()͢ΔͷͰ஗͍
    • DSO͸ຊདྷfork()Λ࣮ߦ͠ͳ͍ͨΊߴ଎ʹಈ࡞͢Δ͕
    • ैདྷͷDSOͷΞΫηε੍ޚ͸ϦΫΤετຖʹfork()Λ࣮ߦ͢Δ
    168
    ߴूੵϚϧνςφϯτͱCGIɾDSOͷੑೳ

    View full-size slide

  158. • NakamitsuΒʹΑΔmod_ruid2[23]
    • rootͰαʔόϓϩηεΛىಈ͢ΔͷͰ͸ͳ͘rootͷಛݖΛࡉ෼Խ্ͨ͠ͰҰൠ
    ϢʔβʹಛݖΛҰ෦༩͑Δ → Linux Capability
    • ΦʔφΛมߋ͢ΔCAP_SETUIDͱCAP_SETGIDΛ༩͑Ε͹ྑ͍
    169
    ҰൠϢʔβͷαʔόϓϩηεͰݖݶ෼཭͢Δख๏
    <>NPE@SVJE IUUQTHJUIVCDPNNJOENPESVJE

    View full-size slide

  159. • ೚ҙΞΫηε੍ޚʢDACʣ
    • ࣗ਎͕࡞ͬͨϦιʔε΁ʹΞΫηε͸ࣗ਎͕ܾఆ
    • UNIXͷඪ४తͳϞσϧ
    • ڧ੍ΞΫηε੍ޚʢMACʣ
    • ࣗ਎͕࡞ͬͨϦιʔεʹ׬શʹΞΫηεͰ͖ΔΘ͚Ͱ͸ͳ͍
    • ؅ཧऀ͕ܾఆ → SELinuxɺTOMOYO Linux
    170
    ΞΫηε੍ޚϞσϧͷ෮श

    View full-size slide

  160. • Linux2.2Ҏ߱
    • ैདྷͷ2֊૚ͷDACݖݶϞσϧͷ֦ு
    • εϨου୯Ґʹ੍ޚՄೳͳಛݖάϧʔϓ
    • εϨου͸3छྨͷcapability setΛ࣋ͭ
    • PermittedɺEffectiveɺInheritable
    • capability setͷ૊Έ߹ΘͤʹΑͬͯcapabilityͷݖݶΛ੍ޚ
    171
    Linux Capabilities

    View full-size slide

  161. • Permitted͸ڐՄ
    • EffectiveͷηοτɾΞϯηοτ͕Մೳ
    • PermittedΛΞϯηοτ͢Δͱ໭Εͳ͍
    • Effective͸࣮ޮ
    • ࣮ࡍͷݖݶՄ൱νΣοΫ͸EffectiveΛ൑ఆ͢Δ
    • Permitted͕ڐՄ͞Ε͍ͯΕ͹Ξϯηοτޙͷ࠶ηοτ͕Մೳ
    172
    PermittedͱEffective

    View full-size slide

  162. • ໿40άϧʔϓʹ෼ׂ͞Ε͍ͯΔ
    • uidɾgidมߋͷಛݖ
    • ಛݖϙʔτʢ1024ҎԼʣͷόΠϯυಛݖ
    • chrootͷಛݖ
    • rebootͷಛݖͳͲͳͲ……..
    173
    ಛݖͷࡉ෼Խ

    View full-size slide

  163. • ಛݖΛ͍࣋ͬͯΔҰൠϢʔβͰ΋execve()࣌ʹಛݖ͕མͱ͞ΕΔ
    • ͨͩ͠ɺrootݖݶͰexecve()ͨ͠৔߹͸ಛݖΛҾ͖ܧ͛Δ
    • ϑΝΠϧࣗମʹಛݖΛઃఆͨ͠৔߹͸execve()࣌ʹಛݖΛҾ͖ܧ͙
    • ͋Β͔͡ΊϑΝΠϧʹಛݖΛઃఆ͢Δඞཁ͋Γ
    • ೚ҙͷίϚϯυΛ೚ҙͷϢʔβͰಛݖΛ༩࣮͑ͭͭߦ͢Δ৔߹͸Ͱ͖ͳ͍ʁ
    • ҰൠϢʔβͰͷexecve()͕ඞཁɺ͔ͭɺϑΝΠϧʹಛݖΛઃఆͰ͖ͳ͍
    174
    ࣮૷࣌ͷ஫ҙ఺΍੍໿ͳͲ

    View full-size slide

  164. • Linux4.3͔Β௥Ճ͞Εͨcapability
    • ࢠϓϩηεʹҾ͖ͮͭಛݖ܈
    • ҰൠϢʔβͰfile capability͕ͳͯ͘΋execve()ޙʹҾ͖ܧ͛Δ[24]
    • γϯϓϧͰ͋Δ͕࢖͍ํ࣍ୈͰ͸ඇৗʹڧྗ
    • ίϯςφ࣮૷࣌ʹAmbient capabilities͸͋͑ͯΞϯηοτ͢Δ࣮૷΋
    • exeve()ޙͷ਌͔Βͷҙਤ͠ͳ͍ಛݖͷҡ࣋ͱঢ֨Λ๷ࢭ͢ΔͨΊ
    175
    Ambient capabilities
    <>NBUTVNPUPSZ DHSPVQͱ-JOVY$BQBCJMJUZͷ׆༻ IUUQTTQFBLFSEFDLDPNNBUTVNPUP@SSDPOBOE
    DBQDPOJOUFSOBMTOVNCFSMYDKQ

    View full-size slide

  165. • mod_ruid2Λ࢖ͬͯαʔόϓϩηεΛҰൠϢʔβͰىಈͭͭ͠ɺΦʔφΛมߋ
    ͢ΔಛݖΛ༩͑ͯ΍Ε͹ɺDSO࣮ߦํࣜͰ͋ͬͯ΋ߴ଎ʹݖݶ෼཭Մೳʁ
    • ϦΫΤετ୯ҐͰΦʔφΛมߋͯ͠ϨεϙϯεΛฦͨ͠ΒΦʔφΛ໭͢
    • αʔόϓϩηεʹ೚ҙͷίϚϯυΛ࣮ߦ͢Δ੬ऑੑ͕͋ͬͯ΋ಛݖ͸࠷খݶ
    ʹݶఆͰ͖Δ
    176
    ҰൠϢʔβͷαʔόϓϩηεͰݖݶ෼཭͢Δख๏

    View full-size slide

  166. 177
    1BSFOUIUUQEQSPDFTT
    PXOFSBQBDIF

    $IJMEIUUQEQSPDFTT
    PXOFSBQBDIF

    JOEFYQIQ
    PXOFSVTFS

    TFUVJE
    TFUHJE

    QBSTF SVO
    ˞NPE@SVJE
    $IJMEIUUQEQSPDFTT
    PXOFSVTFS

    $IJMEIUUQEQSPDFTT
    PXOFSBQBDIF

    ϦΫΤετຖʹϓϩηεͷੜ੒ഁغ͕ෆཁʁʁʁ
    QSDUM
    TFUVJETFUHJEDBQT
    TFUVJE
    TFUHJE

    View full-size slide

  167. 178
    1BSFOUIUUQEQSPDFTT
    PXOFSBQBDIF

    $IJMEIUUQEQSPDFTT
    PXOFSBQBDIF

    JOEFYQIQ
    PXOFSVTFS

    TFUVJE
    TFUHJE

    QBSTF SVO
    ˞NPE@SVJE
    $IJMEIUUQEQSPDFTT
    PXOFSVTFS

    $IJMEIUUQEQSPDFTT
    PXOFSBQBDIF

    ϦΫΤετຖʹϓϩηεͷੜ੒ഁغ͕ෆཁʁʁʁ
    QSDUM
    TFUVJETFUHJEDBQT
    TFUVJE
    TFUHJE

    ίϯςϯπΛαʔϏεར༻ऀ͕࡞੒Ͱ͖Δ
    ৔߹͸੬ऑੑʹͳΔ

    View full-size slide

  168. 179
    1BSFOUIUUQEQSPDFTT
    PXOFSBQBDIF

    $IJMEIUUQEQSPDFTT
    PXOFSBQBDIF

    JOEFYQIQ
    PXOFSVTFS

    TFUVJE
    TFUHJE

    QBSTF SVO
    ˞NPE@SVJE
    $IJMEIUUQEQSPDFTT
    PXOFSVTFS

    $IJMEIUUQEQSPDFTT
    PXOFSBQBDIF

    ࣮ߦϓϩηε͕ΦʔφมߋͷಛݖΛ࣋ͬ
    ͍ͯΔͨΊɺίϯςϯπܦ༝Ͱݖݶมߋ
    ͕Մೳʂʂ
    ˣ
    QSDUM
    TFUVJETFUHJEDBQT
    TFUVJE
    TFUHJE

    ίϯςϯπ࣮ߦલʹಛݖΛམͱ͞ͳ͍ͱ͍͚
    ͳ͍ɻͭ·ΓɺϓϩηεͷΦʔφมߋޙ͸ݩ
    ͷΦʔφʹ໭Εͳ͍ͨΊϓϩηεഁغ͕ඞཁ
    VOTFUDBQT

    View full-size slide

  169. • mod_suid2ͱಉ༷ɺ݁ہͷͱ͜ΖϗεςΟϯάαʔϏεʹ͓͍ͯɺDSO࣮ߦ
    ํࣜʹ͓͍ͯηΩϡϦςΟΛ୲อ͢ΔͨΊʹ͸ϦΫΤετ୯ҐͰαʔόϓϩη
    εͷੜ੒ɾഁغ͕ඞཁ
    • ݁ՌతʹDSO࣮ߦํࣜΛ࢖͏ੑೳ্ͷϝϦοτ͕ڗडͰ͖ͳ͍
    • ͜ͷΑ͏ͳΞΫηε੍ޚख๏Λ࠾༻͢Δ৔߹͸CGIͷํ͕ϝϦοτ͕ଟ͍
    • ੑೳɾෳ਺ΠϯλϓϦλ͕ར༻ՄೳͳͲ
    180
    ҰൠϢʔβͷαʔόϓϩηεͰݖݶ෼཭͢Δख๏

    View full-size slide

  170. • Webαʔό͔ΒͷݖݶมߋΛՄٯతʹมߋՄೳʹͭͭ͠ɺ࣮ߦ͞ΕΔίϯς
    ϯπϓϩάϥϜ͔Β͸ݖݶΛมߋ͞Εͳ͍Α͏ʹ͢Δख๏
    • ϓϩάϥϜ͔Β࣮ߦ͞ΕΔγεςϜίʔϧΛ͋Β͔͡Ίચ͍ग़͠ɺίϯςϯ
    π࣮ߦ࣌ʹ֘౰ͷγεςϜίʔϧΛϑοΫͯ͠ݖݶมߋͷॲཧΛແޮԽ͢Δ
    • Linuxʹ͓͍ͯγεςϜίʔϧΛద੾ʹϑοΫ͢Δʹ͸Χʔωϧʹ௚઀มߋΛ
    Ճ͑Δඞཁ͕͋Δ
    • Χʔωϧ΍ϥΠϒϥϦΛܧଓతʹมߋ͢Δݱ৔Ͱ͸Մൖੑ͕௿͍
    181
    ݪΒͷγεςϜίʔϧΛϑοΫ͢Δख๏ [25]
    <>ݪେีɼதࢁହҰɼl)VTTBεέʔϥϒϧ͔ͭηΩϡΞͳαʔόΞʔΩςΫνϟ௿ίετͳαʔόϓϩηε
    ࣮ߦݖݶมߋػߏɼzୈճ৘ใՊֶٕज़ϑΥʔϥϜ '*5
    ߨԋ࿦จूɼ3#

    View full-size slide

  171. DSO࣮ߦํࣜͷηΩϡϦςΟ(4)

    View full-size slide

  172. • DSO൛ͷੑೳΛ׆͔͢ΞΫηε੍ޚख๏͕ແ͍
    • ࣮ߦํࣜ΍ΠϯλϓϦλ͕ಠࣗʹΞΫηε੍ޚख๏Λ࣮૷͓ͯ͠Γ൥ࡶ
    • Χʔωϧʹ൥ࡶͳ؅ཧΛٻΊΔख๏͸࣮༻্ɺՄൖੑʹ͚ܽΔ
    183
    ͜͜·Ͱͷ·ͱΊ

    View full-size slide

  173. • ੑೳ໘ʹ͓͍ͯCGI͸ຊདྷద͍ͯ͠ͳ͍
    • ऩ༰਺͕૿͑ΔͱϓϩηεͷϝϞϦ࢖༻ྔ͕૿͑fork()ͷޮ཰௿Լ
    • ͦ΋ͦ΋ϦΫΤετ୯ҐͰfork()͢ΔͷͰ஗͍
    • DSO͸ຊདྷfork()Λ࣮ߦ͠ͳ͍ͨΊߴ଎ʹಈ࡞͢Δ͕
    • ͜͜·ͰͷDSOͷΞΫηε੍ޚ͸ϦΫΤετຖʹfork()Λ࣮ߦ͢Δ
    184
    ߴूੵϚϧνςφϯτͱCGIɾDSOͷੑೳ

    View full-size slide

  174. • DSOํࣜͷੑೳΛ׆͔͢ΞΫηε੍ޚΞʔΩςΫνϟ
    • ಈతίϯςϯπ࣮ߦલʹΦʔφมߋͷಛݖͷΈΛ༩੍͑ͨޚ༻εϨουΛ࡞੒
    • ΦʔφΛมߋͨ͠εϨου্ͰίϯςϯπΛॲཧ
    • ίϯςϯπ࣮ߦޙ͸εϨουͷΈΛ࡟আ
    • ݖݶ෼཭ͷΦʔόʔϔουΛεϨουͷੜ੒ɾഁغϨϕϧʹ௿ݮ
    185
    দຊΒͷఏҊ͢ΔεϨου୯ҐͰΞΫηε੍ޚ [26]
    <>দຊ྄հ Ԭ෦णஉ εϨου୯ҐͰݖݶ෼཭Λߦ͏8FCαʔόͷΞΫηε੍ޚΞʔΩςΫνϟ ిࢠ৘ใ௨৴ֶ
    ձ࿦จࢽ7PM+# /P QQ 0DU

    View full-size slide

  175. • ݖݶ෼཭༻ͷ੍ޚ༻εϨουΛੜ੒͢ΔͨΊɺCGI΋ಉҰͷ࿮૊ΈͷதͰݖݶ
    ෼཭͕ՄೳʹͳΔ
    • Ծ૝ϗετ୯ҐͷΦʔφ৘ใ΋ϦΫΤετͷ͋ͬͨίϯςϯπ͔ΒࣗಈͰऔಘ
    ͢ΔͨΊϗετ୯Ґͷݖݶ෼཭ઃఆΛඞཁͱ͠ͳ͍
    • ߴूੵ࣌ʹϗετͷऩ༰ઃఆ਺ͷ໰୊͔Βαʔόϓϩηεͷىಈ࣌ͷϝϞϦ࢖
    ༻ྔ͕૿େ͢Δ͜ͱ͔Βɺfork()࣌ͷੑೳྼԽͷ໰୊΋͕͋ͬͨɺ౷Ұతͳઃ
    ఆͷهड़͕ՄೳͱͳΓfork()ͷੑೳ΋վળՄೳ
    186
    DSOɾCGI࣮ߦํࣜ྆ํʹରԠ

    View full-size slide

  176. 1BSFOUIUUQEQSPDFTT
    PXOFSSPPU

    $IJMEIUUQEQSPDFTT
    PXOFSBQBDIF

    UISFBE
    PXOFSVTFS

    UISFBE
    PXOFSBQBDIF

    JOEFYQIQ
    PXOFSVTFS

    TFUVJE
    TFUHJE
    ʜ VOTFUDBQT
    DSFBUFUISFBE TFUDBQT
    EFTUSPZUISFBE
    QBSTF SVO
    QSDUM
    TFUVJETFUHJEDBQT
    UISFBE
    PXOFSVTFS

    ˞%40দຊΒͷΞΫηε੍ޚΞʔΩςΫνϟ


    View full-size slide

  177. 1BSFOUIUUQEQSPDFTT
    PXOFSSPPU

    $IJMEIUUQEQSPDFTT
    PXOFSBQBDIF

    UISFBE
    PXOFSVTFS

    UISFBE
    PXOFSBQBDIF

    JOEFYQIQ
    PXOFSVTFS

    TFUVJE
    TFUHJE
    ʜ VOTFUDBQT
    DSFBUFUISFBE TFUDBQT
    EFTUSPZUISFBE
    QBSTF SVO
    QSDUM
    TFUVJETFUHJEDBQT
    UISFBE
    PXOFSVTFS

    ˞%40দຊΒͷΞΫηε੍ޚΞʔΩςΫνϟ
    DISPPU&OWJSPONFOU


    View full-size slide

  178. 1BSFOUIUUQEQSPDFTT
    PXOFSSPPU

    $IJMEIUUQEQSPDFTT
    PXOFSBQBDIF

    UISFBE
    PXOFSVTFS

    UISFBE
    PXOFSBQBDIF

    TFUVJE
    TFUHJE
    ʜ VOTFUDBQT
    DSFBUFUISFBE TFUDBQT
    EFTUSPZUISFBE
    QSDUM
    TFUVJETFUHJEDBQT
    UISFBE
    PXOFSVTFS

    ˞$(*দຊΒͷΞΫηε੍ޚΞʔΩςΫνϟ
    $(*QSPDFTT
    PXOFSVTFS

    QIQDHJJOEFYQIQ
    PXOFSVTFS

    $(*QSPDFTT
    PXOFSVTFS

    GPSL

    UFSNJOBUFQSPDFTT
    FYFDWF



    View full-size slide

  179. • 1ϦΫΤετ1ϓϩηε઎༗͢ΔαʔόϞσϧલఏ
    • DSO͸εϨουͷ༗ແʹؔΘΒͣαʔόϓϩηεʹ૊Έࠐ·ΕͨΠϯλϓϦ
    λ͕௚઀ϓϩάϥϜΛ࣮ߦ
    • εϨουΛҰ࣌తʹ࡞Δ͜ͱʹΑΔηΩϡϦςΟϨϕϧͷ௿Լ͸ੜ͡ͳ͍
    190
    WebαʔόϞσϧͱ੍ޚ༻εϨουͷߟ࡯

    View full-size slide

  180. • mod_process_securityϞδϡʔϧ
    • ઃఆ͸ҎԼͷΑ͏ʹγϯϓϧ
    191
    LinuxͰApacheϞδϡʔϧͱ࣮ͯ͠૷

    View full-size slide

  181. • Apache httpdʹରͯ͠ఏҊΞʔΩςΫνϟΛ࣮૷
    • ඵؒͷϦΫΤετ਺ΛมԽͤ͞Ϩεϙϯε਺Λܭଌ
    • phpinfo()Λग़ྗ͢Δ͚ͩͷ؆୯ͳϓϩάϥϜΛ༻ҙ
    • ֤ख๏ͷੑೳΛධՁ
    192
    ੑೳධՁ

    View full-size slide

  182. ࣮ݧ؀ڥ
    193

    View full-size slide

  183. DSO࣮ߦํࣜͷΞΫηε੍ޚੑೳൺֱ
    w ඵؒϦΫΤετ਺Λ૿Ճͤ͞ͳ͕Βඵ
    ؒϨεϙϯε਺Λܭଌ
    w ྘ͷNPE@SVJEΛར༻ͨ͠ΞΫηε੍
    ޚ͸΄ͱΜͲੑೳ͕Ͱ͍ͯͳ͍
    w ੺ͷদຊΒͷΞΫηε੍ޚ͸ΞΫηε
    ੍ޚແ͠ͷ৔߹ͱൺ΂ͯ΋΄ͱΜͲΦʔ
    όʔϔου͸ແ͠
    ੨ɿΞΫηε੍ޚແ͠
    ੺ɿদຊΒͷΞΫηε੍ޚ
    ྘ɿNPE@SVJE౳ͷΞΫηε੍ޚ
    194

    View full-size slide

  184. CGI࣮ߦํࣜͷΞΫηε੍ޚੑೳൺֱ
    w ඵؒϦΫΤετ਺Λ૿Ճͤ͞ͳ͕ΒඵؒϨ
    εϙϯε਺Λܭଌ
    w $(*ͷΞΫηε੍ޚͷ༗ແʹؔΘΒͣ$(*
    ͷ࣮ߦํࣜͷΦʔόʔϔου͕େ͖͍ͨΊɺ
    ΞΫηε੍ޚʹΑΔΦʔόʔϔου͸ແ͍
    ੨ɿΞΫηε੍ޚແ͠
    ੺ɿদຊΒͷΞΫηε੍ޚ
    ྘ɿTV&9&$
    195

    View full-size slide

  185. ࣮ߦํࣜ ΞΫηε੍ޚద༻ʹΑΔεϧʔϓοτ௿Լ཰
    $(*
    TV&9&$
    NPE@QSPDFTT@TFDVSJUZ
    %40
    NPE@SVJE౳
    NPE@QSPDFTT@TFDVSJUZ
    196

    View full-size slide

  186. • phpinfo()΁ͷΞΫηεΛstrace͔Βղੳ
    • CGI ʴ suEXEC: 3377ճ
    • mod_php + mod_process_security: 155ճ
    • ΦʔόʔϔουʹͳͬͯΔγεςϜίʔϧ
    • clone() open() close() execve() ͳͲsuEXECؔ࿈
    ˞TUSBDFDGQ1*%
    ˞DBUDHJMPHcHSFQWFQPMM@XBJUcHSFQWGVUFYcQFSMBOF
    QSJOU@JG
    197
    ࢀߟɿγεςϜίʔϧͷ਺Λൺֱ

    View full-size slide

  187. ࢀߟɿಋೖલޙͷCPU࢖༻ྔൺֱ
    Ұ೔ͷΞΫηε਺͸ͲͪΒͷαʔό΋໿ສʢαʔϏεશମͰ͸਺ेԯʣ
    $(*ʴTV&9&$ %40ʴNPE@QSPDFTT@TFDVSJUZ
    ˙TZTUFN
    ˙VTFS
    ˙JEMF
    198

    View full-size slide

  188. • ߴूੵϚϧνςφϯτํࣜʹ͓͍ͯηΩϡϦςΟͱੑೳΛཱ྆ͨ͠ख๏
    • αʔόϓϩηεͦͷ΋ͷʹ೚ҙͷίϚϯυΛ࣮ߦͰ͖Δ৔߹͸Ͳ͏ͳΔ͔
    • ϓϩηεΛڞ༗͢ΔݶΓWebαʔόͷΞʔΩςΫνϟ্ϦεΫ͕͋Δ
    • ͦͷ৔߹͸ίετͷ؍఺͔ΒVM΍ίϯςφͷִ཭Λݕ౼͢Δ
    • ίϯςφϨϕϧͷ੬ऑੑͰίϯςφͷ֎ʹग़ΒΕΔϦεΫ͸ʁ
    • Ϧιʔείετ͸ߴ͘ͳΔ͕VMϨϕϧͰͷִ཭Λݕ౼͢Δ΂͖
    199
    ·ͱΊͱϦεΫ

    View full-size slide

  189. ͦͷଞ࠷৽ͷݚڀಈ޲

    View full-size slide

  190. 201
    • Time-of-check to time-of-Use Race Condition
    • ҎԼͷॲཧΛUNIX͸ΞτϛοΫʹͰ͖ͳ͍
    • ϑΝΠϧ͕ϦϯΫ͔ɺϑΝΠϧ·ͰͷύεʹϦϯΫؚ͕·ΕΔ͔ɺͦͷݕࠪ
    ޙʹϑΝΠϧΛopen()͢ΔΑ͏ͳॲཧ
    • Webίϯςϯπ͕ࣗ༝ͳϗεςΟϯάʹ͓͍ͯ͸େ͖ͳ໰୊ͱͳΔ
    • Ϛϧνϓϩηεͷαʔόιϑτ΢ΣΞͰ͸λΠϛϯάʹΑͬͯ͸ϦϯΫͷνΣο
    ΫޙʹผϑΝΠϧʹ͢Γସ͑ΒΕΔՄೳੑ༗Γ
    ϦϯΫݕࠪͷTOCTOU໰୊

    View full-size slide

  191. 202
    • ͱ͋ΔԾ૝ϗετA͕੬ऑੑΛಥ͔ΕΔ
    • ϨʔείϯσΟγϣϯΛར༻ͯ͠ଞϗετBͷ.cgiʹରͯ͠.txtͷϦϯΫΛషΔ
    • γϯϘϦοΫϦϯΫ͸ϑΝΠϧͷଘࡏ֬ೝແ͘࡞੒͕Մೳ
    • Ծ૝ϗετํࣜ͸੩తϑΝΠϧͷ৔߹αʔόϓϩηεͷΦʔφͰread
    • ඇϦϯΫ൑ఆޙͰ͋ΔͨΊϗετBͷ.cgiʹॻ͔Εͨid/pass͕ӾཡՄೳ
    ଞϗετͷid/passΛऔಘ͞ΕΔέʔε

    View full-size slide

  192. ϑΝΠϧ͕ϦϯΫ͔ݕࠪ
    ϑΝΠϧͷύεʹϦϯΫ͕
    ؚ·ΕΔ͔ݕࠪ
    ϑΝΠϧΛPQFO
    ͯ͠
    Ϩεϙϯεੜ੒ॲཧ
    8FCαʔόϓϩηεXPSLFS"
    ϑΝΠϧΛϦϯΫʹ
    ஔ͖׵͑
    ϨʔείϯσΟγϣϯͷ
    Մೳੑ
    0,
    0,
    ϦϯΫͷνΣοΫޙʹ
    ผϗετͷϑΝΠϧ
    ʹஔ͖׵͑ΒΕͯ೷͖ݟ
    ͞ΕΔՄೳੑ͋Γ
    8FCαʔόϓϩηεXPSLFS#

    View full-size slide

  193. 204
    • ϗεςΟϯάཁ݅ʹ͓͍ͯ͸ղܾՄೳ
    • ಉҰॴ༗ऀͷϦϯΫ͸࠷ѱݕ஌Ͱ͖ͳͯ͘΋ྑ͍
    • ݕ஌͢΂͖͸ଞϗετɺͭ·Γɺଞͷॴ༗ऀͷϑΝΠϧ΁ͷϦϯΫ͔Ͳ͏͔
    • ϑΝΠϧopen()ޙʹfd͔ΒΦʔφνΣοΫ
    • ͦͷԾ૝ϗετͰઃఆ͍ͯ͠ΔΦʔφͱopen()ͨ͠ϑΝΠϧͷॴ༗ݖΛൺֱ
    mod_fileownercheck [27]
    [27] Ryosuke Matsumotoɼhttps://github.com/matsumotory/mod_fileownercheck.

    View full-size slide

  194. ϑΝΠϧΛPQFO

    GEͷPXOFSͱԾ૝ϗετͷઃ
    ఆͰڐՄ͍ͯ͠ΔPXOFSݕࠪ
    Ϩεϙϯεੜ੒ॲཧ
    ϑΝΠϧΛϦϯΫʹ
    ஔ͖׵͑
    ผϗετͷϦϯΫ
    ʹ͸ஔ͖׵͑ΒΕͳ͍
    8FCαʔόϓϩηεXPSLFS" 8FCαʔόϓϩηεXPSLFS#

    View full-size slide

  195. 206
    • ϦϯΫ࡞੒ͷϨʔείϯσΟγϣϯࣗମ͸๷͛ͳ͍
    • ϗεςΟϯάཁ݅ʹ͓͍ͯผͷॴ༗ऀϑΝΠϧ΁ͷϦϯΫ͸๷͛Δ
    • fdͷownerͱopen()ͨ͠ϑΝΠϧͷownerൺֱͰ͸μϝ
    • ύεʹϦϯΫؚ͕·ΕΔ৔߹Λݕ஌Ͱ͖ͳ͍
    • Ծ૝ϗετͷownerΛ੩తʹอ͓࣋ͯ͘͠
    • υΩϡϝϯτϧʔτͷΦʔφ΍suEXECͷઃఆ͔Βऔಘ͢ΔͳͲ޻෉͕ඞཁ
    ஫ҙ఺

    View full-size slide

  196. ηΫγϣϯͷ·ͱΊ

    View full-size slide

  197. 1. γεςϜྖҬ΍ଞϗετྖҬͷ೷͖ݟ
    2. CGI࣮ߦํࣜͷηΩϡϦςΟ
    3. DSO࣮ߦํࣜͷηΩϡϦςΟ(1)~(4)
    4. ͦͷଞ࠷৽ͷݚڀಈ޲
    208
    ηΩϡϦςΟͱੑೳ

    View full-size slide

  198. 6.
    ηΩϡϦςΟͱӡ༻ٕज़

    View full-size slide

  199. ηΫγϣϯͷ֓ཁ

    View full-size slide

  200. 1. ΞΫηε੍ޚͱ࣮ફతͳ؅ཧٕज़
    2. ΞΫηε੍ޚͱ৽نϗετ௥Ճ
    3. ߴ଎͔ͭলϝϞϦʹಈ࡞͢ΔWebαʔόͷػೳ֦ுػߏ
    4. ͦͷଞ࠷৽ͷݚڀಈ޲
    211
    ηΩϡϦςΟͱӡ༻ٕज़

    View full-size slide

  201. ࣮ફతͳΞΫηε੍ޚͱ؅ཧٕज़

    View full-size slide

  202. • ߴूੵϚϧνςφϯτΞʔΩςΫνϟͷηΩϡϦςΟͱӡ༻ٕज़
    • ηΩϡϦςΟΛ୲อ͢ΔͨΊʹӡ༻ٕज़͕ෳࡶԽ͢Δ͜ͱ͸ආ͚͍ͨ
    • ApacheͷVirtualHostํࣜ͸ऩ༰ޮ཰͕ྑ͍
    • ҰํͰɺऩ༰਺͕૿͑Δ͜ͱʹΑΓӡ༻໘ͷ՝୊͕ੜ͡Δ
    • ߴूੵϚϧνςφϯτΞʔΩςΫνϟͷηΩϡϦςΟΛલఏͱͯ͠ӡ༻ٕज़ͷ
    ࣮ફతͳख๏ͷ੔ཧͱ࠷৽ಈ޲Λ঺հ͢Δ
    213
    ߴूੵϚϧνςφϯτΞʔΩςΫνϟͷӡ༻ٕज़

    View full-size slide

  203. • suEXEC͸CGI࣮ߦํࣜͷΞΫηε੍ޚख๏
    • Shebangߦͷద੾ͳهड़
    • ྫ͑͹PHP͸جຊతʹShebangߦΛهड़ͤͣʹར༻͍ͨ͠
    • Φʔφ΍ύʔϛογϣϯ౳ͷݖݶͷઃఆ
    • ϗεςΟϯάαʔϏεར༻ऀʹద੾ʹࢦࣔ͢Δඞཁ͋Γ
    214
    suEXECʹΑΔϓϩάϥϜͱΠϯλϓϦλͷඥ͚ͮ

    View full-size slide

  204. • Pros
    • Shebangߦͷهड़΍࣮ߦݖݶͷઃఆΛলུՄೳ
    • suEXECͱಉ༷ʹCGIϓϩάϥϜΛ֤ϗετͷϢʔβݖݶͰ࣮ߦՄೳ
    • Cons
    • suEXECͱಉ༷ʹVirtualHost୯ҐͰuidɺgidͷݸผઃఆ͕ඞཁͰઃఆ਺૿Ճ
    • suEXECͱಉ༷ʹγεςϜྖҬͷ೷͖ݟ͕Մೳ
    215
    SebastianΒʹΑΔsuPHP [27]
    <>.4FCBTUJBO TV1)1)PNFQBHF IUUQXXXTVQIQPSH)PNFIUNM

    View full-size slide

  205. • suEXECͱͷซ༻͢Δ͜ͱͰݖݶ෼཭͕Մೳ
    • Pros
    • Shebangߦͷهड़΍࣮ߦݖݶͷઃఆΛলུՄೳ
    • Cons
    • ࣮ߦՄೳͳྖҬʹϥούʔϓϩάϥϜͷઃஔ͕ඞཁ
    • suEXECͱಉ༷ʹγεςϜྖҬͷ೷͖ݟ͕Մೳ
    216
    mod_actions [28]
    <>5IF"QBDIF4PGUXBSF'PVOEBUJPO "QBDIF.PEVMFNPEBDUJPOT IUUQIUUQEBQBDIFPSHEPDT
    FONPENPEBDUJPOTIUNM

    View full-size slide

  206. • suEXECϓϩάϥϜͷதͰΠϯλϓϦλͱͷඥ෇͚Λߦ͏Α͏ʹ֦ு
    • Pros
    • Shebangߦͷهड़΍࣮ߦݖݶͷઃఆΛলུՄೳ
    • ෳ਺ͷϞδϡʔϧ΍ϥούʔΛඞཁͱ͠ͳ͍
    • suEXEC࣮ߦ࣌ʹchroot͔ͯ͠Β࣮ߦ͢ΔͨΊγεςϜྖҬΛӾཡෆՄ
    • Cons: ShebangߦΛඞཁͱ͠ͳ͍ݴޠͷඥ෇͚͕ࣄલʹඞཁ
    217
    দຊΒʹΑΔsuEXECͷ֦ு [29]
    <>দຊ྄հɼ઒ݪক࢘ɼদԬً෉ɼlେن໛ڞ༗ܕ8FCόʔνϟϧϗεςΟϯάج൫ͷηΩϡϦςΟͱӡ༻
    ٕज़ͷվળɼz৘ॲֶ࿦ɼWPM OP QQr .BSDI

    View full-size slide

  207. ΞΫηε੍ޚͱ৽نϗετ௥Ճ

    View full-size slide

  208. • ୯Ұͷαʔόϓϩηε܈Ͱ਺ສͷϗετΛ؅ཧ͢ΔߴूੵϚϧνςφϯτํࣜ
    • ઃఆͷมߋ΍ϗετ৽ن௥Ճ࣌ʹ͸αʔόϓϩηεͷ࠶ಡࠐ͕ඞཁ
    • ࠶ಡࠐʹ͕͔͔࣌ؒΔͱαʔϏε඼࣭ͷ௿Լʹͭͳ͕Δ
    • ৽نϗετͷ௥Ճઃఆ΍νϡʔχϯά͸࠶ಡࠐͤͣʹߦ͍͍ͨ
    219
    Ծ૝ϗετํࣜͷઃఆಡΈࠐΈͷ՝୊

    View full-size slide

  209. • େྔͷԾ૝ϗετઃఆΛಈతʹઃఆ͢ΔϞδϡʔϧ
    • Ծ૝ϗετͷઃఆ͸ϗετ໊ΛΩʔʹಈతʹઃఆͰ͖Δ͜ͱ͕ଟ͍
    • υΩϡϝϯτϧʔτ͸%0ม਺ΛυϝΠϯʹಡΈସ͑ͯಈతʹܾఆ͢Δ
    • ಈతʹઃఆ͢Δ͜ͱʹΑΓσΟϨΫτϦߏ଄͑͞࡞͓͚ͬͯ͹ɺϦΫΤετʹ
    Ԡͯ͡ಈతʹίϯςϯπͷ୳ࡧΛߦ͏
    • ৽نԾ૝ϗετ௥ՃͷͨΊͷαʔόϓϩηεͷ࠶ಡࠐ͕ෆཁ
    220
    mod_vhost_alias [30]
    <>5IF"QBDIF4PGUXBSF'PVOEBUJPO "QBDIF.PEVMFNPEWIPTUBMJBT IUUQIUUQEBQBDIFPSHEPDT
    NPENPEWIPTUBMJBTIUNM

    View full-size slide

  210. • suEXECΛར༻͢ΔͨΊʹ͸ݸผͷઃఆ͕ඞཁͱͳΓཱ͕྆Ͱ͖ͳ͍
    • ϗετͷ਺͚ͩઃఆ਺͕૿Ճ͠αʔόϓϩηεͷϝϞϦ࢖༻ྔ૿Ճ
    221
    mod_vhost_aliasͷ՝୊

    View full-size slide

  211. • αʔόϓϩηεͷϝϞϦ࢖༻ྔʢRSSʣ͸4GBఔ౓·Ͱ૿Ճ
    • 4GBͷαʔόϓϩηε͕fork()ʹΑͬͯCGIΛ࣮ߦ͢Δͱੑೳ͕ग़ͳ͍
    • fork()ʹΑΔϖʔδςʔϒϧΤϯτϦʢPTE)ͷϙΠϯλίϐʔ͕ଟൃ
    • execv()ʹΑΔPTEͷϙΠϯλ࡟আ͕ଟൃ
    • ݁ՌతʹCGIΛ࣮ߦ͢ΔͨΊʹ1ϦΫΤετ1ඵҎ্ͷCPU࢖༻͕࣌ؒඞཁ
    • WebαʔόͰར༻͢ΔΑ͏ͳXeonͷ2.4GHzఔ౓ͷCPUੑೳΛલఏ
    222
    ྫɿ10ສϗετ෼ͷઃఆΛApacheͰಡΈࠐΉ৔߹

    View full-size slide

  212. • suEXECͷuid/gidΛdummyͰઃఆ্ͨ͠Ͱ࣮ߦ͢ΔίϯςϯπϓϩάϥϜ͔
    ΒಈతʹΦʔφ৘ใΛऔಘͰ͖ΔΑ͏ʹsuEXECΛվम
    • mod_vhost_aliasͷ؀ڥม਺ʹอଘ͞ΕΔυΩϡϝϯτϧʔτ΋ಈతʹಡΈସ
    ͑ͨਖ਼͍͠ύεʹͳΔΑ͏ʹվम
    • ૊Έ߹ΘͤΔ͜ͱʹΑΓ୯ҰͷઃఆͰ਺ສͷԾ૝ϗετઃఆΛಈతʹهड़Մೳ
    223
    দຊΒʹΑΔmod_vhost_aliasͱsuEXECͷվྑ[31]
    <>দຊ྄հɼ઒ݪক࢘ɼদԬً෉ɼlେن໛ڞ༗ܕ8FCόʔνϟϧϗεςΟϯάج൫ͷηΩϡϦςΟͱӡ༻
    ٕज़ͷվળɼz৘ॲֶ࿦ɼWPM OP QQr .BSDI

    View full-size slide

  213. • લड़ͨ͠mod_vlimit΍mod_lalimitɺmod_resource_checker͸શͯ.htaccess
    Ͱ࠶ಡࠐ͢Δ͜ͱͳ͘ઃఆΛ൓өՄೳʹ͍ͯ͠Δ
    • mod_vlimitɿ֘౰ϑΝΠϧ΍ϗετͷಉ࣌઀ଓ਺Λ੍ݶ
    • mod_lalimitɿ֘౰ϑΝΠϧ΍ϗετ΁ͷΞΫηεΛ෇ՃʹԠ੍ͯ͡ݶ
    • mod_resource_checkerɿϨεϙϯεੜ੒ʹཁ͢ΔϦιʔεྔ΍ϦΫΤετ
    ৘ใΛܭଌͯ͠ϩΪϯά
    224
    ੍ޚػೳ΋αʔόϓϩηε࠶ىಈΛෆཁʹ͓ͯ͘͠

    View full-size slide

  214. ߴ଎͔ͭলϝϞϦʹಈ࡞͢ΔWebαʔόͷ
    ػೳ֦ுػߏ

    View full-size slide

  215. • Webαʔόͷػೳ֦ுʹ͓͍ͯੑೳΛߟྀͨ͠৔߹͸CݴޠʹΑΔ࣮૷͕ఆ൪
    • ैདྷͷWebαʔόͷεΫϦϓτݴޠʹΑΔ֦ு͸ੑೳ໘ͱ҆શੑʹ՝୊
    • αʔόϓϩηε΁ͷΠϯλϓϦλ૊ΈࠐΈͷΞʔΩςΫνϟͷఏҊ͕ॏཁ
    226
    WebαʔόΛϓϩάϥϜϒϧʹ੍ޚ͢Δݚڀ

    View full-size slide

  216. • ΠϯλϓϦλڞ༗ํࣜʢmod_perlɺmod_rubyʣ
    • αʔόϓϩηεىಈ࣌ʹ୯ҰͷΠϯλϓϦλ֬อ
    • ϦΫΤετॲཧ࣌ʹෳ਺ͷεΫϦϓτͰΠϯλϓϦλڞ༗
    • άϩʔόϧͷঢ়ଶ΋ڞ༗
    • ߴػೳ͔ͭن໛ͷେ͖͍ΠϯλϓϦλʹ࠷ద
    227
    ҰൠతͳεΫϦϓτʹΑΔػೳ֦ுํࣜʢ̍ʣ

    View full-size slide

  217. • ෳ਺ΠϯλϓϦλํࣜʢmod_luaʣ
    • εΫϦϓτ࣮ߦʢϦΫΤετॲཧʣ୯ҐͰΠϯλϓϦλ֬อ
    • άϩʔόϧͳঢ়ଶ͸ಠཱͰ҆શ
    • ΠϯλϓϦλ͕֬อ͢Δঢ়ଶ΋౎౓։์ͯ͠লϝϞϦ
    • ௿ػೳͰߴ଎ɾলϝϞϦͳ૊ΈࠐΈεΫϦϓτݴޠͳͲʹ࠷ద
    228
    ҰൠతͳεΫϦϓτʹΑΔػೳ֦ுํࣜʢ̎ʣ

    View full-size slide

  218. ػೳ֦ு NPE@QFSM NPE@SVCZ NPE@MVB
    ݴޠ $ 1FSM 3VCZ -VB
    ΠϯλϓϦλॳظԽ
    ॲཧ
    ࣄલ ౎౓
    ϥΠϒϥϦಡΈࠐΈ ࣄલ ౎౓
    ίϯύΠϧ ࣄલ ౎౓ ౎౓
    ίʔυͷมߋ ෆՄ Մ Մ
    άϩʔόϧঢ়ଶ ڞ༗ ڞ༗ ඇڞ༗
    229

    View full-size slide

  219. • ΠϯλϓϦλڞ༗ํࣜͷ՝୊
    • άϩʔόϧঢ়ଶ͕ෳ਺εΫϦϓτͰׯব
    • ࣮ߦ࣌ͷόΠτίʔυ૿ՃʹΑΔϝϞϦͷ૿Ճ
    • ෳ਺ΠϯλϓϦλํࣜͷ՝୊
    • ϦΫΤετຖͷΠϯλϓϦλ֬อɾ։์ͷίετ͕ߴ͍
    230
    εΫϦϓτݴޠʹΑΔϛυϧ΢ΣΞ֦ுͷ՝୊

    View full-size slide

  220. VM
    • 
    • 
    • 
    231

    View full-size slide

  221. • ੑೳ͕ཁٻ͞ΕΔՕॴ͸ΠϯλϓϦλڞ༗
    • ੑೳ͕ཁٻ͞Εͳ͍Օॴ͸ݸผʹΠϯλϓϦλ֬อ
    • ϝϞϦ૿ՃͷݪҼͰ͋ΔόΠτίʔυͷΈΛ։์
    • ҆શੑͷ໘Ͱάϩʔόϧͷঢ়ଶͷΈΛ։์Մೳ
    • όΠτίʔυΩϟογϡʹΑΔߴ଎Խ΋Մೳ
    232
    দຊΒͷΞʔΩςΫνϟ [32]
    <>দຊ྄հ Ԭ෦णஉ NPE@NSVCZεΫϦϓτݴޠͰߴ଎͔ͭলϝϞϦʹ֦ுՄೳͳ8FCαʔόͷػೳ֦ுࢧ
    ԉػߏ ৘ใॲཧֶձ࿦จࢽɼ7PM /P QQ /PW

    View full-size slide

  222. ਌αʔόϓϩηε
    ࢠαʔόϓϩηε" ϦΫΤετॲཧ༻ΠϯλϓϦλ
    ىಈ࣌ॲཧ༻ΠϯλϓϦλ
    ϦΫΤετҎ֎ͷॲཧ༻ΠϯλϓϦλ
    εΫϦϓτ
    εΫϦϓτ
    εΫϦϓτ
    εΫϦϓτ
    εΫϦϓτ
    ੑೳ͕ཁٻ͞ΕΔϑοΫ
    ͸ΠϯλϓϦλΛڞ༗
    ɾ
    ɾ
    ɾ

    233

    View full-size slide

  223. w αʔόϓϩηεىಈ࣌ʹΠϯλϓ
    ϦλΛ֬อ
    w ϦΫΤετॲཧ࣌ʹΠϯλϓϦλ
    Λڞ༗ͯ͠εΫϦϓτΛίϯύΠϧ
    ͔ͯ͠Β࣮ߦ
    ߏจ໦ղੳ
    όΠτίʔυੜ੒
    7.্Ͱ࣮ߦ
    ϦΫΤετຖʹαʔόϓϩηε͕εΫϦϓτΛϑοΫ
    εΫϦϓτಡΈࠐΈ
    ΠϯλϓϦλͱ
    ϥΠϒϥϦΛڞ༗
    όΠτίʔυɺάϩʔόϧม਺ɾΫϥεɺྫ֎ϑϥάΛ։์
    ഉଞॲཧ
    ϚϧνεϨου8FC
    αʔόΞʔΩςΫνϟ
    ʹରԠ
    234

    View full-size slide

  224. ߏจ໦ղੳ
    όΠτίʔυੜ੒
    7.্Ͱ࣮ߦ
    ϦΫΤετຖʹαʔόϓϩηε͕εΫϦϓτΛϑοΫ
    εΫϦϓτಡΈࠐΈ
    ΠϯλϓϦλͱ
    ϥΠϒϥϦΛڞ༗
    άϩʔόϧม਺ɾΫϥεɺྫ֎ϑϥάΛ։์
    όΠτίʔυ
    ςʔϒϧ
    w όΠτίʔυΩϟογϡʹΑͬͯαʔ
    όϓϩηεىಈޙʹίʔυมߋ͕ඞ
    ཁͳ͍৔߹͸ߴ଎Խ
    w αʔόىಈ࣌ʹίϯύΠϧͯ͠όΠ
    τίʔυςʔϒϧʹอଘ͓͖ͯ͠ɺ
    ϦΫΤετ࣌ʹऔಘ࣮ͯ͠ߦ
    235

    View full-size slide

  225. • ApacheϞδϡʔϧͷmod_mrubyͱ࣮ͯ͠૷
    • nginxϞδϡʔϧͷngx_mrubyͱͯ͠΋࣮૷
    • mrubyͱ͍͏ܰྔRubyΠϯλϓϦλΛར༻
    • RubyͰWebαʔόͷৼΔ෣͍Λ֦ுՄೳ
    • దࡐదॴͱͯ͠ैདྷͷCݴޠͷ࣮૷ͱڞଘՄೳ
    236
    ΞʔΩςΫνϟͷ࣮૷

    View full-size slide

  226. mod_mrubyͷػೳ֦ுͷ֓ཁਤ
    237

    View full-size slide

  227. mod_mrubyઃఆྫ
    # Normal hook

    mrubyHandlerMiddle /path/to/test.rb

    # ByteCode Caching at Start up

    mrubyHandlerMiddle /path/to/test.rb cache

    238

    View full-size slide

  228. mod_mrubyઃఆྫ
    # Normal hook

    mrubyHandlerMiddle /path/to/test.rb

    # ByteCode Caching at Start up

    mrubyHandlerMiddle /path/to/test.rb cache

    239

    View full-size slide

  229. ngx_mrubyͷΠϯϥΠϯઃఆྫ
    # Inline code hook
    location /mruby-hello {
    mruby_content_handler_code ‘
    r = Nginx::Request.new
    c = Nginx::Connection.new
    r.content_type = “text/plain”
    Nginx.echo “Hello #{c.remote_ip} World”
    ‘;
    }
    240

    View full-size slide

  230. mod_mrubyͰͷReverse Proxy
    # mrubyTranslateNameFirst “/path/to/proxy.rb”
    backends = [
    "http://192.168.0.101:8888/",
    "http://192.168.0.102:8888/",
    "http://192.168.0.103:8888/",
    ]
    r = Apache::Request.new
    backend = backends[rand(backends.length)]
    r.reverse_proxy backend + r.unparsed_uri
    241

    View full-size slide

  231. ngx_mrubyͰͷReverse Proxy
    # location /proxy {
    # mruby_set $backend "/path/to/proxy.rb";
    # proxy_pass http://$backend;
    # }
    backends = [
    "http://192.168.0.101:8888/",
    "http://192.168.0.102:8888/",
    "http://192.168.0.103:8888/",
    ]
    backends[rand(backends.length)]
    242

    View full-size slide

  232. mod_mrubyͷBasicAuth with Redis
    #
    # AuthType basic
    # AuthName "Message for clients"
    # AuthBasicProvider mruby
    # mrubyAuthnCheckPassword /path/to/authn_basic.rb
    # require valid-user
    #
    anp = Apache::AuthnProvider.new
    redis = Redis.new "127.0.0.1”, 6379
    if redis.get(anp.user) == anp.password
    Apache.return Apache::AuthnProvider::AUTH_GRANTED
    else
    Apache.return Apache::AuthnProvider::AUTH_DENIED
    end
    243

    View full-size slide

  233. ҟͳΔWebαʔόͷ౷Ұత֦ுهड़
    "QBDIF
    "1*
    3VCZTDSJQU
    NPE@NSVCZ
    3VCZTDSJQU
    ɾ
    ɾ
    ɾ
    ɾ

    3VCZTDSJQUO
    /HJOY
    "1*
    OHY@NSVCZ
    3VCZTDSJQU
    "QBDIF
    $PSF
    /HJOY
    $PSF
    3VCZ
    %4-
    GPS8FC
    "QBDIF
    5SB⒏D
    4FSWFS
    "1*
    UT@NSVCZ
    "QBDIF
    5SB⒏D
    4FSWFS
    $PSF
    SFGIUUQTHJUIVCDPNTZVDSFBNUT@NSVCZ
    244

    View full-size slide

  234. ౷Ұతهड़ྫ
    # Output Hello World
    Server = get_server_calss
    Server.rputs "Hello #{Server.module_name}/
    #{Server.module_version} world!"
    # mod_mruby => "Hello mod_mruby/1.9.3 world!"
    # ngx_mruby => "Hello ngx_mruby/1.3.2 world!"
    # ts_mruby => "Hello ts_mruby/0.0.1 world!"
    245

    View full-size slide

  235. • ੑೳධՁ
    • Hello Worldग़ྗͷ୯७ͳϓϩάϥϜʢΠϯλϓϦλͷੑೳͰ͸ͳ͘૊Έࠐ
    ΈΞʔΩςΫνϟͷੑೳΛ࠷େԽ͢ΔͨΊʣ
    • দຊΒͷख๏ͱؔ࿈ݚڀͰ࣮ߦ͠ඵؒͷϨεϙϯε਺Λܭଌ
    • ಉ࣌઀ଓ਺100ɾ૯઀ଓ਺10ສ
    246
    ࣮ݧ

    View full-size slide

  236. ࣮ݧ؀ڥ
    247

    View full-size slide

  237. ؔ࿈ݚڀͱͷੑೳൺֱ
    ػೳ֦ு NPE@QFSM NPE@SVCZ NPE@MVB NPE@NSVCZ
    NPE@NSVCZ
    Ωϟογϡ
    ݴޠ $ 1FSM 3VCZ -VB NSVCZ NSVCZ
    ΠϯλϓϦλ
    ॳظԽॲཧ
    ࣄલ ౎౓ ࣄલ ࣄલ
    ϥΠϒϥϦ
    ಡΈࠐΈ
    ࣄલ ౎౓ ࣄલ ࣄલ
    ίϯύΠϧ ࣄલ ౎౓ ౎౓ ౎౓ ࣄલ
    ίʔυͷมߋ ෆՄ Մ Մ Մ ෆՄ
    άϩʔόϧঢ়ଶ ڞ༗ ڞ༗ ඇڞ༗ ඇڞ༗ ඇڞ༗
    ੑೳ
    3FTQPOTFTFD

    248

    View full-size slide

  238. ೥ͷੈքதͷ8FCϑϨʔϜϫʔΫͷ଎౓Λڝ͏ίϯςετ
    $ɺ$ɺ+BWBɺ(P౳ͷத3VCZͰؤு͍ͬͯΔҐ
    SFGIUUQTXXXUFDIFNQPXFSDPNCFODINBSLT


    View full-size slide

  239. ݴޠΛ3VCZʹݶఆͨ݁͠Ռ
    Ґ
    SFGIUUQTXXXUFDIFNQPXFSDPNCFODINBSLT


    View full-size slide

  240. • εΫϦϓτݴޠͰߴ଎͔ͭ҆શʹಈ࡞͢ΔWebαʔόػೳ֦ுࢧԉΞʔΩς
    Ϋνϟʹؔ͢ΔݚڀΛ঺հ
    • ैདྷݚڀΑΓ΋ߴ଎ͰWebαʔό׆༻έʔεͰ͸CݴޠͰͷ࣮૷ʹḮ৭ͳ͍
    ΞʔΩςΫνϟΛ࣮ݱ
    • ޿͘࢖ΘΕ͍ͯΔWebαʔόιϑτ΢ΣΞͷϞδϡʔϧͱ࣮ͯ͠૷͠Φʔϓϯ
    ιʔειϑτ΢ΣΞͱͯ͠ެ։ → mod_mruby, ngx_mruby
    251
    ·ͱΊ

    View full-size slide

  241. ͦͷଞ࠷৽ͷݚڀಈ޲

    View full-size slide

  242. • C10k໰୊ͳͲ͔Βಉ࣌઀ଓ਺Λେ෯ʹվળ͍ͨ͠
    • CPUͷίΞΛे෼ʹ࢖͍੾Γ͍ͨɾ઀ଓ਺Λϓϩηε਺ʹґଘͤ͞ͳ͍
    • ϓϩηεͷI/OΛϊϯϒϩοΫɾඇಉظʹॲཧ͢Δ͜ͱͰղܾ
    • File I/O, Network I/O, sleep…
    • ࣮૷ྫͱͯ͠͸epoll()ͰfdͷεςʔλεΛ؂ࢹͯ͠ΠϕϯτΛൃՐ
    • I/OͷଟॏԽͱ΋ݴ͏͕͜ͷ࢓૊ΈΛΠϕϯτϧʔϓͱ࣮ͯ͠૷
    253
    ϛυϧ΢ΣΞͷϊϯϒϩοΩϯάI/O

    View full-size slide

  243. • mruby͸جຊతʹॲཧΛmrubyͰϒϩοΫͯ͠͠·͏
    • ಉ࣌઀ଓ਺͕૿Ճͨ࣌͠ʹmrubyͷॲཧ͕ϘτϧωοΫʹͳΔ
    • mrubyͷॲཧ͕௕͍ͱޙଓͷϦΫΤετॲཧʹ஗Ԇ͕ੜ͡Δ
    254
    mrubyΛ૊ΈࠐΜͩϛυϧ΢ΣΞͷϊϯϒϩοΫ

    View full-size slide

  244. 255
    mruby͕֤ϦΫΤετΛϒϩοΫ͢Δྫ
    SFRVFTUQSPDFTTJOH NSVCZ
    NSVCZ
    SFRVFTUQSPDFTTJOH
    SFRVFTUQSPDFTTJOH NSVCZ DSFBUFSFTQPOTF
    DSFBUFSFTQPOTF
    DSFBUFSFTQPOTF
    TFOESFTQPOTF
    OPOCMPDLJOHNJEEMFXBSFMJLFOHJOYJOTJOHMFQSPDFTT
    SFDWSFRVFTU
    BUUIFTBNFUJNF

    View full-size slide

  245. 256
    mruby͕֤ϦΫΤετΛϒϩοΫ͢Δྫ
    SFRVFTU NSVCZ
    NSVCZ
    SFTQPOTF
    SFRVFTU
    SFRVFTU SFTQPOTF
    SFTQPOTF
    NSVCZ
    TFOESFTQPOTF
    SFDWSFRVFTU
    BUUIFTBNFUJNF
    Other responses are delayed in proportion to the time of processing of mruby blocking
    OPOCMPDLJOHNJEEMFXBSFMJLFOHJOYJOTJOHMFQSPDFTT

    View full-size slide

  246. 257
    mruby͕֤ϦΫΤετΛϒϩοΫ͢Δྫ

    View full-size slide

  247. 258
    mruby͕֤ϦΫΤετΛϊϯϒϩοΩϯάʹॲཧ͢Δ
    SFRVFTU SFTQPOTF
    SFRVFTU
    SFRVFTU SFTQPOTF
    SFTQPOTF
    TFOESFTQPOTF
    SFDWSFRVFTU
    BUUIFTBNFUJNF
    CMPDLJOH
    PQFSBJUPO
    NSVCZ
    CMPDLJOH
    PQFSBJUPO
    NSVCZ
    NSVCZ
    CMPDLJOH
    PQFSBJUPO
    OPOCMPDLJOHNJEEMFXBSFMJLFOHJOYJOTJOHMFQSPDFTT

    View full-size slide

  248. 259
    mruby͕֤ϦΫΤετΛϊϯϒϩοΩϯάʹॲཧ͢Δ

    View full-size slide

  249. • mrubyͷϒϩοΩϯά͢ΔϝιουΛϊϯϒϩοΩϯάϞʔυͰ࣮૷
    • ϝιουͷॲཧ͕׬ྃ͢Δ·ͰmrubyͷॲཧΛҰ࣌ఀࢭ
    • mruby͔Βϛυϧ΢ΣΞͷΠϕϯτϧʔϓ΁ॲཧΛ໭͢
    • ϝιουͷॲཧ͕׬ྃͨ͠ΒΠϕϯτϧʔϓ͔Β௨஌Λड͚mrubyͷॲཧΛ
    ࠶։
    260
    ͲͷΑ͏ʹϊϯϒϩοΩϯάΛ࣮ݱ͢Δ͔ʁ

    View full-size slide

  250. 3VCZ4DSJQUʢ3VCZXPSMEʣ
    1SPD
    'JCFSSFTVNF
    mruby૊ΈࠐΈͷϛυϧ΢ΣΞͷϊϯϒϩοΩϯά
    261
    NJEEMFXBSF $XPSME

    NSC@TUBUF
    'JCFS
    3VCZCZUFDPEFJODMVEFE
    CMPDLJOHNFUIPE
    DGVODPGCMPDLJOHNFUIPE
    SVOCMPDLJOHPQFSBUJPOXJUIOPOCMPDLJOHNPEF
    TFUDBMMCBDLDGVODUPFWFOUMPPQPGNJEEMFXBSF
    DGVODPGNJEEMFXBSFPOFWFOUMPPQ
    QSPDFTTPUIFSSFRVFTUPOFWFOUMPPQ
    DBMMCBDLDGVOD
    SVOSFTVNFCZSVOOJOHQSPDPCKFDUGSPN$
    DGVODPGNJEEMFXBSFXJUINSC@TUBUF
    SVOQSPDPCKFDUGSPN$










    $VSSFOUNSVCZOPOCMPDLJOHNPEFM
    3FRVFTU
    'JCFSZJFME


    View full-size slide

  251. non-blocking sleep sample script
    262

    View full-size slide

  252. async sleepͷαϯϓϧ
    263

    View full-size slide

  253. RubyεΫϦϓτΛFiberͰแΉ
    264

    View full-size slide

  254. RubyεΫϦϓτΛFiberͰแΜͰlambdaΛฦ͢
    265

    View full-size slide

  255. Cଆ͔ΒRubyͰ࡞ͬͨFiberΦϒδΣΫτΛ࣮ߦ
    266
    SFUVSOUPFWFOUMPPQXIFOpCFSJTBMJWJOH

    View full-size slide

  256. CଆͷNginx::Async.sleep
    267
    QSPDDFTTPUIFSSFRVFTUT
    VOUJMDBMMCBDLGVODUJPO

    View full-size slide

  257. RubyଆͷAsync.sleepͷ࣮૷
    268

    View full-size slide

  258. ϛυϧ΢ΣΞͷΠϕϯτϧʔϓ͔Βcallback
    269

    View full-size slide

  259. ϒϩοΩϯάͱϊϯϒϩοΩϯάϞʔυͷੑೳධՁ
    270
    ϕϯνϚʔΫ
    ΫϥΠΞϯτ
    ϓϩΩγαʔό "1*αʔό
    ϨεϙϯελΠϜΛ
    ৭ʑมԽͤ͞Δ
    NSVCZΛհͯ͠"1*αʔό
    ͔ΒҰ෦৘ใΛऔಘͦ͠ΕΛ
    ݩʹϨεϙϯεΛฦ͢
    ಉ࣌઀ଓ਺ΛมԽͤ͞ͳ͕Β
    ϕϯνϚʔΫΛ͔͚Δ
    1.apiଆͷϨεϙϯελΠϜΛ1msec͔Β50msec·ͰมԽͤ͞ͳ͕Βɺಉ࣌઀ଓ਺100Ͱϕϯ
    νϚʔΫΛ͔͚ͯRequest/secΛܭଌ͢Δ
    2.apiଆͷϨεϙϯελΠϜΛ10msecʹݻఆ͠ɺಉ࣌઀ଓ਺Λ1͔Β100ʹมԽͤͯ͞
    Request/secΛܭଌ͢Δ

    View full-size slide

  260. ੑೳද࣮ݧͷngx_mrubyͷઃఆʢൈਮʣ
    271
    "1*αʔόଆͷઃఆ
    QSPYZαʔόଆͷઃఆ

    View full-size slide

  261. APIαʔόͷϨεϙϯεΛมԽͤͨ࣌͞ͷੑೳධՁ
    272

    View full-size slide

  262. ಉ࣌઀ଓ਺Λมߋͤͨ࣌͞ͷੑೳධՁ
    273

    View full-size slide

  263. • WebαʔόΛϓϩάϥϚϒϧʹ֦ுɾ੍ޚͰ͖ΔΑ͏ʹͳͬͨ
    • WebαʔόͷΑ͏ͳϛυϧ΢ΣΞʹϓϩάϥϛϯάݴޠΛ૊ΈࠐΈ
    • ૊ΈࠐΜͩݴޠͷॲཧࣗମ͕ϛυϧ΢ΣΞΛϒϩοΫ͢Δ͜ͱʹͳΔ
    • C10k໰୊ͷΑ͏ͳϊϯϒϩοΩϯάϛυϧ΢ΣΞͷରԠͱڝ߹͢Δ
    • ϛυϧ΢ΣΞͱ૊ΈࠐΈݴޠͦΕͧΕͰͷϊϯϒϩοΩϯάରԠ͕ඞཁ
    274
    ӡ༻ٕज़ʹؔ͢Δ࠷৽ͷݚڀಈ޲

    View full-size slide

  264. ηΫγϣϯͷ·ͱΊ

    View full-size slide

  265. 1. ΞΫηε੍ޚͱ࣮ફతͳ؅ཧٕज़
    2. ΞΫηε੍ޚͱ৽نϗετ௥Ճ
    3. ߴ଎͔ͭলϝϞϦʹಈ࡞͢ΔWebαʔόͷػೳ֦ுػߏ
    4. ͦͷଞ࠷৽ͷݚڀಈ޲
    276
    ηΩϡϦςΟͱӡ༻ٕज़

    View full-size slide

  266. 7.
    େن໛WebαʔόͷTLSূ໌ॻ؅ཧ

    View full-size slide

  267. ηΫγϣϯͷ֓ཁ

    View full-size slide

  268. 1.ৗ࣌HTTPSԽͷഎܠͱຊݚڀͷ໨త
    2.੩తʹূ໌ॻΛಡΈࠐΉํࣜ
    3.ಈతʹূ໌ॻΛಡΈࠐΉํࣜ
    4.੩తಡΈࠐΈͱಈతಡΈࠐΈͷൺֱ
    279
    େن໛WebαʔόͷTLSূ໌ॻ؅ཧ

    View full-size slide

  269. ৗ࣌HTTPSԽͷഎܠͱূ໌ॻ؅ཧͷ֓ཁ

    View full-size slide

  270. • HTTP/2ͷRFC࠾୒ͱ࣮༻ԽͷऔΓ૊Έ
    • GoogleʹΑΔৗ࣌HTTPSԽͷਪਐ
    • Let’s EncryptʹΑΔແྉͷDVূ໌ॻͷఏڙ
    • اۀ͚ͩͰͳ͘ݸਓͷWebαΠτͷHTTPSԽ΋ඞਢ
    281
    ݚڀͷഎܠ

    View full-size slide

  271. • ݸਓ޲͚ͷ௿Ձ֨ϗεςΟϯάͰ࠾༻͞ΕΔ͜ͱͷଟ͍ํࣜ [36]
    • ୯ҰͷWebαʔόʹߴूੵ(਺ສυϝΠϯ)ʹϗετΛऩ༰
    • Ծ૝ϗετํࣜʹΑΓେྔͷϗετΛಉҰϓϩηεͰॲཧ
    • ϦόʔεϓϩΩγͷ৔߹͸ߋʹߴूੵ(਺ेɺ਺ඦສυϝΠϯ)
    • ߴूੵϚϧνςφϯτํࣜͷHTTPSରԠ΋ٸ຿
    282
    ߴूੵϚϧνςφϯτํࣜͷWebαʔό
    <>দຊ྄հ തֶ࢜Ґ࿦จ8FCαʔόͷߴूੵϚϧνςφϯτΞʔΩςΫνϟʹؔ͢Δݚڀ
    IUUQTSFQPTJUPSZLVMJCLZPUPVBDKQETQBDFIBOEMF ژ౎େֶ ೥݄

    View full-size slide

  272. • Webαʔόϓϩηεىಈ࣌ʹશͯͷূ໌ॻΛಡΈࠐΉํࣜ
    • ߴूੵϚϧνςφϯτํࣜͰ͸ূ໌ॻ਺͕๲େ
    • ϝϞϦ࢖༻ྔ͕ূ໌ॻ਺ʹґଘͯ͠ϋʔυ΢ΣΞίετ૿Ճ
    • ϓϩηεىಈʹ௕͕͔͔࣌ؒΓઃఆมߋ࣌ͷӡ༻໘ʹ՝୊
    • ࠓޙΛݟਾ͑ͯݚڀऀͱͯ͠ૣΊʹखΛ͏ͭඞཁ͕͋Δ
    283
    ߴूੵϚϧνςφϯτํࣜͷূ໌ॻઃఆͷ՝୊

    View full-size slide

  273. 2015೥Լظ͔ΒऔΓ૊Έ։࢝ޙ2016೥1݄ϦϦʔε
    284
    SFGIUUQICNBUTVNPUPSKQFOUSZ

    View full-size slide

  274. • ߴूੵϚϧνςφϯτWebαʔόͷେن໛ূ໌ॻ؅ཧ
    • ূ໌ॻ਺ͷ૿Ճʹ൐͏Ϧιʔε࢖༻ྔͷ૿ՃΛ௿ݮ
    • αʔϏεఀࢭ͢Δ͜ͱͳ͘৽نઃఆΛ൓өՄೳ
    • ϗεςΟϯάαʔϏεͷϓϩμΫγϣϯ؀ڥʹಋೖͯ͠ධՁ
    • େྔͷূ໌ॻΛ؅ཧ͢Δϋʔυ΢ΣΞ΍؅ཧίετΛ௿ݮͤ͞Δ
    285
    େن໛ূ໌ॻ؅ཧͷඞཁੑͱධՁ

    View full-size slide

  275. ੩తʹূ໌ॻΛಡΈࠐΉํࣜͷ՝୊

    View full-size slide

  276. 1. HTTPSԽʹ൐͏ϋʔυ΢ΣΞίετͷ૿Ճ
    2. ূ໌ॻ௥Ճ౳ͷઃఆมߋద༻࣌ؒͷ૿Ճ
    287
    ߴूੵϚϧνςφϯτํࣜͷऩ༰཰ͱӡ༻໘ͷ՝୊

    View full-size slide

  277. • ϗετͷ਺ʹൺྫͯ͠ϗετઃఆɾূ໌ॻ΍ൿີ伴ͷσʔλɾHTTP/HTTPSॲ
    ཧʹඞཁͳϝϞϦ࢖༻ྔ͕૿େ
    • ΄ͱΜͲΞΫηεͷແ͍ϗετʹରͯ͠΋ઃఆ৘ใΛอ࣋
    • Մ༻ੑͱอकੑΛߴΊΔͨΊʹHTTPS༻ͷϓϩΩγΛલஈʹஔ͍ͨ৔߹͸
    όοΫΤϯυͷυϝΠϯΛશͯू໿͢Δඞཁ͋Γ
    • ฐࣾϗεςΟϯάαʔϏεͰ͸200ສυϝΠϯҎ্
    288
    1. HTTPSԽʹ൐͏ϋʔυ΢ΣΞίετͷ૿Ճ

    View full-size slide

  278. • αʔόϓϩηεىಈ࣌ʹશͯͷূ໌ॻ΍ઃఆΛಡΈࠐແඞཁ͕͋Δ
    • ϗετ୯ҐͰରԠ͢Δূ໌ॻͷϑΝΠϧ΍ઃఆΛهड़
    • ߴूੵԽʹ൐͍ઃఆߦ਺ͷ૿େ΍؅ཧίετͷ૿େ͕՝୊
    • ઃఆ਺૿Ճʹ൐͍αʔόϓϩηεͷ࠶ىಈ͕࣌ؒ૿Ճ
    • ઃఆͷ࠶ಡΈࠐΈॲཧ͢ΒαʔϏεఀࢭʹܨ͕ΔڪΕ༗Γ
    289
    2. ূ໌ॻ௥Ճ౳ͷઃఆมߋద༻࣌ؒͷ૿Ճ

    View full-size slide

  279. ಈతʹূ໌ॻΛಡΈࠐΉํࣜ

    View full-size slide

  280. • αʔόϓϩηεىಈ࣌ʹূ໌ॻ͸Ұ੾ಡΈࠐ·ͳ͍
    • αʔόϓϩηεͷ࠶ىಈ/࠶ಡΈࠐΈ࣌ؒͷ௿଎ԽΛճආ
    • TLSϋϯυγΣΠΫ࣌ʹඞཁͳূ໌ॻͱઃఆΛಈతʹಡΈࠐΈ
    • ߴ଎ͳϓϩηε࠶ಡΈࠐΈʹΑΔϝϞϦղ์΋Մೳ
    • ূ໌ॻ΍ϗετͷ৽ن௥Ճઃఆʹϓϩηε࠶ىಈ͕ෆཁ
    291
    দຊΒͷূ໌ॻͷಈతಡΈࠐΈख๏ [37]
    <>3ZPTVLF.BUTVNPUP ,FOKJ3JLJUBLF ,FOUBSP,VSJCBZBTIJ -BSHFTDBMF$FSUJpDBUF.BOBHFNFOUPO
    .VMUJUFOBOU8FC4FSWFST 5IFUI*&&&*OUFSOBUJPOBM$0.14"$8PSLTIPQPO"SDIJUFDUVSF %FTJHO
    %FQMPZNFOUBOE.BOBHFNFOUPG/FUXPSLTBOE"QQMJDBUJPOT "%./&5
    +VM

    View full-size slide

  281. ΞʔΩςΫνϟʢํࣜʣͷఏҊ
    292
    'JMF,74
    IUUQE

    QSPDFTT
    $MJFOU
    4/*ʹΑͬͯTFSWFSOBNF͕FYBNQMFKQͷ
    υϝΠϯʹର͢Δ5-4ϋϯυγΣΠΫ͕։࢝
    5-4ϋϯυγΣΠΫ࣌ʹυϝΠϯFYBNQMFKQʹඥͮ͘ূ
    ໌ॻͱൿີ伴ΛϑΝΠϧ΍,FZ7BMVF4UPSF ,74
    ͳͲ
    ͔ΒಈతʹಡΈࠐΈ͍ͨ

    View full-size slide

  282. ΞʔΩςΫνϟʢํࣜʣͷఏҊ
    293
    'JMF,74
    IUUQE

    QSPDFTT
    $MJFOU
    5-4ϋϯυγΣΠΫ࣌ʹ೚ҙͷؔ਺Λ࣮ߦͰ͖Ε͹ྑ͍
    ؔ਺ͷதͰυϝΠϯͱඥͮ͘αʔόূ໌ॻͱൿີ伴Λ
    ಡΈࠐΉؔ਺Λ࣮ߦͰ͖Ε͹ྑ͍

    View full-size slide

  283. • 3೥ͿΓͷϝδϟʔϦϦʔε
    • https://www.openssl.org/news/openssl-1.0.2-notes.html
    • OpenSSLͷίʔυΛٱʑʹோΊ͍ͯͨ
    • TLSϋϯυγΣΠΫ࣌ʹؔ਺ΛίʔϧόοΫ͢Δؔ਺͕௥Ճ
    • SSL_CTX_set_client_cert_cb() ͳͲ
    294
    OpenSSL 1.0.2͕2015೥1݄22೔ʹϦϦʔε

    View full-size slide

  284. • RubyͰΠϯϑϥઃܭʹԠͨ͡ಈతઃఆΛՄೳʹ͢ΔͨΊ
    • όοΫΤϯυͷܾఆ΋RubyͰॻ͍ͯnginxͷઃఆΛ؆ૉԽ
    • ূ໌ॻσʔλͷऔΓग़͠Λࣗ༝ʹબ୒Ͱ͖ΔΑ͏ʹ͢ΔͨΊ
    • RedisɺMySQLɺlocalmemcacheɺAPIͳͲmrbgemͷ׆༻
    • ੑೳʹ໰୊͕ແ͚Ε͹RubyͰॻ͖͍ͨ
    295
    ͞Βʹngx_mruby΋׆༻͍ͨ͠

    View full-size slide

  285. • ngx_mruby[38]ʹTLSϋϯυγΣΠΫͷRubyϑοΫઃఆΛ࣮૷
    • TLSϋϯυγΣΠΫ࣌ʹϑοΫ͞ΕͨRubyͷίʔυΛ࣮ߦ
    • RubyϝιουͰOpenSSLͱσʔλͷड͚౉͠Λ࣮ߦ
    • KVS/File͔Βূ໌ॻ΍ൿີ伴ΛRubyܦ༝ͰಡΈࠐΈՄ
    296
    ngx_mruby v1.16.0ʢ2016೥2݄ʣͰ௥Ճ࣮૷
    <>দຊ྄հ Ԭ෦णஉ NPE@NSVCZεΫϦϓτݴޠͰߴ଎͔ͭলϝϞϦʹ֦ுՄೳͳ8FCαʔόͷػ
    ೳ֦ுࢧԉػߏ ৘ใॲཧֶձ࿦จࢽɼ7PM /P QQ /PW

    View full-size slide

  286. ngx_mrubyͷূ໌ॻಈతಡΈࠐΈ࣮૷ϑϩʔ
    297
    44-@$59@TFU@DFSU@DC
    ʹ3VCZͷόΠ
    τίʔυΛ࣮ߦ͢ΔIBOEMFSͷؔ਺ϙΠϯ
    λͱίϯςΩετߏ଄ମϙΠϯλΛηοτ
    OHJOYDPOGͷઃఆ͔ΒಡΈࠐΜͩ3VCZε
    ΫϦϓτΛόΠτίʔυԽͯ͠
    ίϯςΩετߏ଄ମʹอଘ
    5-4ϋϯυγΣΠΫ࣌ʹIBOEMFS͕ίʔϧ
    όοΫ͞ΕόΠτίʔυΛ࣮ߦ
    όΠτίʔυͰ࣮ߦ͞ΕΔ3VCZͷϝιο
    υܦ༝Ͱূ໌ॻ΍ൿີ伴σʔλ͕
    ίϯςΩετߏ଄ମʹηοτ͢Δ
    ূ໌ॻͱൿີ伴σʔλʹج͍ͯ#*0ܦ༝Ͱ
    σʔλΛಡΈࠐΜͰϋϯυγΣΠΫΛଓߦ
    OHJOYىಈ࣌ͷॲཧ OHJOY͕ϦΫΤετड৴ͨ࣌͠ͷॲཧ
    NSVCZͷ5-4ϋϯυγΣΠΫϑοΫσΟ
    ϨΫςΟϒ͕ଘࡏͨ͠Β
    44-@$59@TFU@DFSU@DC
    Λݺͼग़͢

    View full-size slide

  287. lua-nginx-module΋΄΅ಉ࣌ظʹ։ൃ
    298
    ೥݄ʹͲͪΒ΋Ϛʔδ
    ࣗ෼͕ཉ͍͠ͱࢥͬͨ࣌ʹͳ͔ͬͨ͜ͱͱ3VCZͰॻ͖͔ͨͬͨͷͰOHY@NSVCZʹ࣮૷

    View full-size slide

  288. • ϦΫΤετͷ͋ͬͨOpenSSLͷservernameͰ൑ఆ
    • ඥͮ͘ূ໌ॻͱϓϩΩγઌΛRubyͷίʔυͰܾఆ
    • RubyͰಈతʹઃఆ(mruby_set $hostͱproxy_pass $host)
    • ୯ҰͷઃఆͰສͷΦʔμʔͷυϝΠϯΛಈతʹॲཧ
    • ઃఆͱূ໌ॻʹؔ͢ΔϝϞϦ࢖༻ྔΛઅ໿
    299
    ngx_mrubyͷಈతͳઃఆͱূ໌ॻಡΈࠐΈ

    View full-size slide

  289. 300
    ϦΫΤετ͞ΕͨυϝΠϯ͔Βಈతʹূ໌ॻΛಡΈସ͑Δ͜ͱʹΑ
    ΓόοΫΤϯυ΁ͷϓϩΩγઃఆ΋ؚΊ୯Ұͷઃఆʹू໿Մೳ
    ϑΝΠϧϕʔεͷಈతূ໌ॻಡΈࠐΈྫ
    3VCZͰϓϩάϥϚϒϧʹهड़Մೳ

    View full-size slide

  290. 301
    ϦΫΤετ͞ΕͨυϝΠϯ͔Βಈతʹূ໌ॻΛ
    ಡΈସ͑Δ͜ͱʹΑΓ୯Ұͷઃఆʹू໿Մೳ
    ,74ϕʔεͷಈతূ໌ॻಡΈࠐΈྫ

    View full-size slide

  291. 1. αʔόϓϩηεىಈ࣌ʹ͸ূ໌ॻ͸ಡΈࠐ·ͳ͍
    2. υϝΠϯͱূ໌ॻɺϓϩΩγͷઃఆ͸୯Ұͷઃఆʹѹॖ
    3. ΞΫηεͷ͋ͬͨυϝΠϯͷΈͷূ໌ॻΛಡΈࠐΉͨΊΤί
    • 200ສυϝΠϯͰΞΫηεͷແ͍υϝΠϯ͸ଟ਺ଘࡏ
    4. ఆظతͳϓϩηεϦϩʔυʹΑΓূ໌ॻσʔλΛղ์
    302
    HTTPSԽʹؔ͢ΔϝϞϦ࢖༻ྔޮ཰Խ·ͱΊ

    View full-size slide

  292. ੩తಡΈࠐΈͱಈతಡΈࠐΈͷൺֱ࣮ݧ

    View full-size slide

  293. 1. ࣮ݧ؀ڥͰ੩తಡΈࠐΈख๏ͱಈతಡΈࠐΈख๏ͷىಈ࣌ؒͷ࣮ݧ
    2. ࣮ݧ؀ڥͰ੩తಡΈࠐΈख๏ͱಈతಡΈࠐΈख๏ͷੑೳൺֱ࣮ݧ
    ɾಈతূ໌ॻಡΈࠐΈͷΦʔόʔϔου͸Ͳͷఔ౓͔ʁ
    3. ಈతಡΈࠐΈख๏ͷຊ൪؀ڥͰ࣮ӡ༻্ͷධՁ
    ɾແྉHTTPSΦϓγϣϯαʔϏεͷ։࢝ͱͦͷޙ
    304
    ࣮ݧͱ࣮ӡ༻্ͷධՁ

    View full-size slide

  294. 1. ੩తಡΈࠐΈख๏ͱಈతಡΈࠐΈख๏ͷ
    ىಈ࣌ؒͷ࣮ݧ

    View full-size slide

  295. ࣮ݧ؀ڥ
    306
    ࢓༷
    $16 *OUFM9FPO&W()[DPSF
    .FNPSZ (CZUFT
    4FSWFS /&$&YQSFTT3G&
    04 $FOU04-JOVY,FSOFM

    View full-size slide

  296. • 10ສϗετ෼ͷ4096bitsͷ伴௕ͷൿີ伴ͱαʔόূ໌ॻΛnginxόʔδϣϯ
    1.11.13ͰಡΈࠐΈ
    • ੩తಡΈࠐΈ͸࠶ಡΈࠐΈॲཧͰ΋αʔϏεఀࢭʹܨ͕Δ
    307
    ੩తಡΈࠐΈͱಈతಡΈࠐΈͷىಈ࣌ؒͷ࣮ݧ
    ߲໨ ੩తಡΈࠐΈ ಈతಡΈࠐΈ
    ϓϩηεىಈͷ࣮࣌ؒ ඵ
    ϓϩηεىಈͷϢʔβ$16࢖༻࣌ؒ ඵ
    ϓϩηεىಈͷγεςϜ$16࢖༻࣌ؒ ඵ

    View full-size slide

  297. 2. ੩తಡΈࠐΈͱಈతಡΈࠐΈͷ
    ੑೳൺֱ࣮ݧ

    View full-size slide

  298. • ੩తಡΈࠐΈख๏ͱಈతಡΈࠐΈख๏(KVSϕʔε)ͱൺֱ
    • ಉ࣌઀ଓ਺ΛมԽͤ͞ͳ͕ΒੑೳΛධՁ
    • nginxʹॳظಉ෧͞Ε͍ͯΔ612Bytesͷindex.html
    • cipher suites͸ECDHE-RSA-AES128-GCM-SHA256
    309
    ಈతಡΈࠐΈͷੑೳධՁ

    View full-size slide

  299. ੩తಡΈࠐΈͱಈతಡΈࠐΈͷੑೳൺֱ
    310
    ಉ࣌઀ଓ਺
    ੩తಡΈࠐΈख๏
    SFRTFD

    ಈతಡΈࠐΈख๏
    SFRTFD





    $(*ͷΑ͏ͳϓϩηεෳ੡͕ੜ͡ͳ͍ܰྔͳ੩తϑΝΠϧ΁ͷϦΫΤετͰ΋ɺ
    ূ໌ॻͷಈతಡΈࠐΈ͸ैདྷख๏ͷ੩తಡΈࠐΈͱൺֱͯ͠΋΄΅͕ࠩͳ͍

    View full-size slide

  300. • TLS΍Ϩεϙϯεੜ੒ॲཧͱൺֱͯ͠ಈతূ໌ॻಡΈࠐΈॲཧ͸࣮༻্໰୊ʹ
    ͳΒͳ͍ఔ౓ͷॲཧίετ
    • TLSϋϯυγΣΠΫ࣌ͷ҉߸ɾ෮߸ॲཧͷίετ͕େ͖͍
    311
    ߟ࡯

    View full-size slide

  301. 3. ຊ൪؀ڥͰ࣮ӡ༻্ͷධՁ

    View full-size slide

  302. • ੩తಡΈࠐΈͱಈతಡΈࠐΈख๏ͷ1ϲ݄ؒͷϦιʔε࢖༻ྔΛൺֱ
    • ੩తಡΈࠐΈख๏͸2017೥3݄͔Β4݄ɺಈతಡΈࠐΈख๏͸7݄͔Β8݄
    • ෳ਺୆ͷಉҰϋʔυ΢ΣΞ্ʹ4݄຤ΛػʹϦϓϨʔε
    • ੩తಡΈࠐΈख๏͸Apache2.4ɺಈతಡΈࠐΈख๏͸nginx1.11Ͱ࣮૷
    • ূ໌ॻ਺ͷ૿Ճ΍ϦΫΤετॲཧ਺ͷมԽͱൺֱ͠ͳ͕Βߟ࡯
    313
    ແྉূ໌ॻαʔϏεΛػʹ࣮ӡ༻্ͷධՁ

    View full-size slide

  303. ຊ൪؀ڥͷಈతಡΈࠐΈख๏ʹΑΔγεςϜߏ੒֓ཁ
    314
    ಈతಡΈࠐΈख๏ͷద༻Օॴ

    View full-size slide

  304. ຊ൪؀ڥͷϦόʔεϓϩΩγαʔόͷ࢓༷
    315
    ࢓༷
    $16 *OUFM9FPO&W()[UISFBE
    .FNPSZ (CZUFT
    4FSWFS /&$&YQSFTT&F.
    04 $FOU04

    View full-size slide

  305. 0
    5000
    10000
    15000
    20000
    25000
    1 6 11 16 21 26 31
    The number of cer-ficates
    day
    The number of cer-ficate in a month
    dynamic load preload
    1ϲ݄ؒͷূ໌ॻ਺ͷભҠ
    316
    Θ͔Γʹ͍͕͘Ұϲ݄Ͱ͔Β΁ͱ
    ূ໌ॻఔ౓૿͍͑ͯΔ
    ূ໌ॻ਺͸ϦϓϨʔεલͷഒ͔Βഒ

    View full-size slide

  306. 1ϲ݄ؒͷ1αʔό΁ͷඵؒHTTPSϦΫΤετ਺
    317
    ϓϩμΫγϣϯ্Ͱ͸QSFMPBEJOHͰ͸SFMPBE͕සൃ͢ΔͨΊ
    ݁Ռͱͯ͠ฏۉతʹϨεϙϯε͕஗͘ͳΔ

    View full-size slide

  307. 1ϲ݄ؒͷCPU࢖༻཰ͷભҠ
    318
    ূ໌ॻ਺͕͔Βഒʹ΋ؔΘΒͣ$16࢖༻཰͸ඍ͕ࠩͩ௿ݮ܏޲
    ສূ໌ॻ૿ՃͰ$16͸ఔ౓ඍ૿

    View full-size slide

  308. 1ϲ݄ؒͷϝϞϦ࢖༻཰ͷભҠ
    319
    ূ໌ॻ਺͸͔Βഒʹ΋ؔΘΒͣϝϞϦ࢖༻཰͸௿ݮ
    ఏҊख๏͸ສҎ্૿Ճ͍ͯ͠Δূ໌ॻ਺ʹ΋΄΅ґଘ͍ͯ͠ͳ͍
    ূ໌ॻ਺૿Ճʹ൐͍ϝϞϦ࢖༻ྔ͸αʔόશମͰ(#ZUFTఔ౓૿Ճ

    View full-size slide

  309. • ੩తಡΈࠐΈ͸1ϗετ௥Ճ͋ͨΓϝϞϦ2.5MBytes૿Ճ
    • 2ສূ໌ॻͷ৔߹͸50GBytesҎ্ͷϝϞϦ͕ඞཁ
    • ϝϞϦ32GbytesͷαʔόͳͷͰ੩తಡΈࠐΈख๏Ͱ͸طʹ௒ա
    • ಈతಡΈࠐΈख๏͸2ສূ໌ॻΛ௒͑ͯ΋໿3GbytesͰ΄΅Ұఆ
    • ຖ೔ͷreload͕ՄೳʹͳΓͦͷ૊Έ߹ΘͤʹΑ࣮ͬͯݱ
    320
    1ϲ݄ͷ࣮ӡ༻্ͷධՁ͔ΒϝϞϦͷ࢖༻ྔΛߟ࡯

    View full-size slide

  310. • ੩తಡΈࠐΈख๏͸20ສূ໌ॻΛॲཧ͢Δͷʹ500Gbytesඞཁ
    • 32GBytesͷαʔό͕15୆Ҏ্ඞཁ
    • ಈతಡΈࠐΈख๏͸20ສূ໌ॻͰ΋1୆ͰॲཧՄೳͷݟࠐΈ
    • 1ɺ2ສূ໌ॻ૿Ճͯ͠΋ϝϞϦ࢖༻ྔ͸3GBytesͰ΄΅ҰఆɺCPU࢖༻཰͸
    0.2ʙ0.5%૿Ճఔ౓
    321
    ϝϞϦ࢖༻ྔ͔Βඞཁͳϋʔυ΢ΣΞΛݟੵ΋Γ

    View full-size slide

  311. • ϝϞϦ࢖༻ྔΛ͞Βʹ௿ݮͤ͞ΔઓུΛͱΔ
    • reloadͷ૊Έ߹ΘͤͰ΋૿ՃྔΛߋʹݮΒͤͨΒޮ཰ԽՄೳ
    • reloadΛ΍Ίͯ·ͣ͸૿ՃྔΛ֬ೝ
    • ͔ͦ͜Βո͍͠ίʔυͱઃఆΛϦϑΝΫλϦϯά͍ͯ͘͠
    • 4ϲ݄ؒͷϝϞϦભҠΛάϥϑԽ…..༧૝֎ʹϦʔΫ͍ͯͨ͠
    322
    ϝϞϦό΢ϯυͷ՝୊Λߋʹվળ͍ͨ͠

    View full-size slide

  312. 323
    0
    5000
    10000
    15000
    20000
    25000
    30000
    2017/07/02-09:00
    2017/07/04-09:00
    2017/07/06-09:00
    2017/07/08-09:00
    2017/07/10-09:00
    2017/07/12-09:00
    2017/07/14-09:00
    2017/07/16-09:00
    2017/07/18-09:00
    2017/07/20-09:00
    2017/07/22-09:00
    2017/07/24-09:00
    2017/07/26-09:00
    2017/07/28-09:00
    2017/07/30-09:00
    2017/08/01-09:00
    2017/08/03-09:00
    2017/08/05-09:00
    2017/08/07-09:00
    2017/08/09-09:00
    2017/08/11-09:00
    2017/08/13-09:00
    2017/08/15-09:00
    2017/08/17-09:00
    2017/08/19-09:00
    2017/08/21-09:00
    2017/08/23-09:00
    2017/08/25-09:00
    2017/08/27-09:00
    2017/08/29-09:00
    2017/08/31-09:00
    2017/09/02-09:00
    2017/09/04-09:00
    2017/09/06-09:00
    2017/09/08-09:00
    2017/09/10-09:00
    2017/09/12-09:00
    2017/09/14-09:00
    2017/09/16-09:00
    2017/09/18-09:00
    2017/09/20-09:00
    2017/09/22-09:00
    2017/09/24-09:00
    2017/09/26-09:00
    2017/09/28-09:00
    2017/09/30-09:00
    2017/10/02-09:00
    2017/10/04-09:00
    2017/10/06-09:00
    2017/10/08-09:00
    2017/10/10-09:00
    2017/10/12-09:00
    2017/10/14-09:00
    2017/10/16-09:00
    2017/10/18-09:00
    2017/10/20-09:00
    2017/10/22-09:00
    2017/10/24-09:00
    2017/10/26-09:00
    2017/10/28-09:00
    2017/10/30-09:00
    2017/11/01-09:00
    Memory Usage [MBytes]
    Day
    Memory Usage for Four Months
    Memory Usage
    ಈతॲཧຖ೔SFMPBE SFMPBEఀࢭத SFMPBEఀࢭத
    ϦϑΝΫλϦϯά
    ສυϝΠϯ)5514Խ
    ສυϝΠϯ)5514Խ
    SFMPBEఀࢭ

    View full-size slide

  313. • ngx_mrubyͷcacheΦϓγϣϯͰϦʔΫ͢Δύλʔϯ͋Δʁ
    • ݱࡏௐࠪதʢҟৗॲཧ࣌ʹϦʔΫ͍ͯ͠Δ͔΋ʣ
    • mruby_setͰ͸ͳ͘mruby_set_codeͳͲʹॻ͖׵͑
    • Ϋϥε΍ϞδϡʔϧΛmrbgemԽͯ͠Ϗϧυ࣌ʹ૊ΈࠐΈ
    • ྫ֎ॲཧ΍ҟৗͳΞΫηε΁ͷΤϥʔॲཧͷݟ௚͠
    324
    ϦϑΝΫλϦϯάͰ΍ͬͨ͜ͱ

    View full-size slide

  314. 325
    0
    5000
    10000
    15000
    20000
    25000
    30000
    2017/07/02-09:00
    2017/07/04-09:00
    2017/07/06-09:00
    2017/07/08-09:00
    2017/07/10-09:00
    2017/07/12-09:00
    2017/07/14-09:00
    2017/07/16-09:00
    2017/07/18-09:00
    2017/07/20-09:00
    2017/07/22-09:00
    2017/07/24-09:00
    2017/07/26-09:00
    2017/07/28-09:00
    2017/07/30-09:00
    2017/08/01-09:00
    2017/08/03-09:00
    2017/08/05-09:00
    2017/08/07-09:00
    2017/08/09-09:00
    2017/08/11-09:00
    2017/08/13-09:00
    2017/08/15-09:00
    2017/08/17-09:00
    2017/08/19-09:00
    2017/08/21-09:00
    2017/08/23-09:00
    2017/08/25-09:00
    2017/08/27-09:00
    2017/08/29-09:00
    2017/08/31-09:00
    2017/09/02-09:00
    2017/09/04-09:00
    2017/09/06-09:00
    2017/09/08-09:00
    2017/09/10-09:00
    2017/09/12-09:00
    2017/09/14-09:00
    2017/09/16-09:00
    2017/09/18-09:00
    2017/09/20-09:00
    2017/09/22-09:00
    2017/09/24-09:00
    2017/09/26-09:00
    2017/09/28-09:00
    2017/09/30-09:00
    2017/10/02-09:00
    2017/10/04-09:00
    2017/10/06-09:00
    2017/10/08-09:00
    2017/10/10-09:00
    2017/10/12-09:00
    2017/10/14-09:00
    2017/10/16-09:00
    2017/10/18-09:00
    2017/10/20-09:00
    2017/10/22-09:00
    2017/10/24-09:00
    2017/10/26-09:00
    2017/10/28-09:00
    2017/10/30-09:00
    2017/11/01-09:00
    Memory Usage [MBytes]
    Day
    Memory Usage for Four Months
    Memory Usage
    ಈతॲཧຖ೔SFMPBE SFMPBEఀࢭத SFMPBEఀࢭத
    ϦϑΝΫλϦϯά
    ສυϝΠϯ)5514Խ
    ສυϝΠϯ)5514Խ
    SFMPBEఀࢭ

    View full-size slide

  315. • ϦϑΝΫλϦϯάલ͸5೔Ͱ10GBఔ౓ϦʔΫ(1೔2GB)
    • ىಈ࣌͸αʔόશମͰϝϞϦ2GB઎༗͠1೔Ͱ2GBϦʔΫ͢Δঢ়گΛຖ೔
    reloadͯ͠ฏۉ3GBͰ҆ఆ͍ͤͯͨ͞
    • ϦʔΫରԠޙ͸5೔Ͱ250MBఔ౓ͷϦʔΫ(1೔50MB)
    • reloadͱ૊Έ߹ΘͤΔͱฏۉ2GBͰ҆ఆͰ͖ΔՄೳੑ͋Γ
    326
    ϦʔΫ໰୊ͷߟ࡯

    View full-size slide

  316. • ੩తಡΈࠐΈख๏͸200ສυϝΠϯͰ32GBytesαʔό͕150୆ඞཁ
    • ಈతಡΈࠐΈख๏͸ϝϞϦό΢ϯυͷ؍఺Ͱ1୆ʹऩ·ΔՄೳੑ͋Γ
    • 6ສυϝΠϯ૿ՃͰ1೔50MBͷϝϞϦ૿Ճʹऩ·Δܭࢉ
    • 200ສυϝΠϯͰ1೔2GBͷϝϞϦ૿Ճʹऩ·ΔՄೳੑ͋Γ
    • ϝϞϦҎ֎ͷΦʔόʔϔου͕Ͳ͜ʹग़ͯ͘Δ͔Λਵ࣌ධՁ
    327
    ཧ࿦తʹ΋αʔό୆਺ͷ100෼ͷ1͕ࢹ໺ʹ

    View full-size slide

  317. 7݄͔Β8݄ͷ2ϲ݄ؒͷτϥϑΟοΫมԽ
    328
    ূ໌ॻ਺͸ສ૿Ճ͕ͨ͠ɺ΋ͱ΋ͱ)551ͱ)5514྆ํॲཧ͍ͯ͠ΔͨΊ
    )551ͷυϝΠϯ͕)5514Խ͞Εͯ΋ͦΕ΄Ͳۃ୺ͳӨڹ͸ແ͍ɻ

    View full-size slide

  318. • ߴूੵϚϧνςφϯτํࣜͷେྔূ໌ॻ؅ཧͷख๏ͷ঺հ
    • Ϋϥ΢υ΍ϗεςΟϯάαʔϏεʹ͓͚ΔಈతಡΈࠐΈͷϝϦοτΛఆྔධՁ
    • ඞཁͳυϝΠϯͷΈͷಈతূ໌ॻಡΈࠐΈͱαʔόϓϩηε࠶ಡΈࠐΈͷ௿଎
    Խ๷ࢭʹΑΔϝϞϦղ์ͷ૊Έ߹ΘͤͰ࣮ݱ
    • ϋʔυ΢ΣΞίετΛ࡟ݮՄೳ(কདྷతʹ͸200ສυϝΠϯ)
    • ॲཧੑೳʹ΋࣮༻্໰୊ͳ͘ઃఆ൓ө΋ਝ଎ʹՄೳ
    329
    ·ͱΊ

    View full-size slide

  319. ηΫγϣϯͷ·ͱΊ

    View full-size slide

  320. 1.ৗ࣌HTTPSԽͷഎܠͱຊݚڀͷ໨త
    2.੩తʹূ໌ॻΛಡΈࠐΉํࣜ
    3.ಈతʹূ໌ॻΛಡΈࠐΉํࣜ
    4.੩తಡΈࠐΈͱಈతಡΈࠐΈͷൺֱ
    331
    େن໛WebαʔόͷTLSূ໌ॻ؅ཧ

    View full-size slide

  321. ຊߨ࠲ͷ·ͱΊ

    View full-size slide

  322. • େن໛ϗεςΟϯάαʔϏεͷ಺෦ΞʔΩςΫνϟ͔Β࣮ફతͳηΩϡϦςΟ
    ΍Ϧιʔε؅ཧɺੑೳ΍ӡ༻ٕज़ʹֶ͍ͭͯΜͩ
    • ηΩϡϦςΟͱੑೳʹؔ࿈ͯ͠ϓϩηεϞσϧ΍ΞΫηε੍ޚΛ੔ཧ
    • ཧղʹඞཁͳOSͷηΩϡϦςΟػߏʹ͍ͭͯ΋ֶΜͩ
    • Ϧιʔε؅ཧ΍ӡ༻ٕज़͔ΒOSͷجૅٕज़Λ͍͔ʹ׆༻͢Δ͔
    • ར༻ऀͱࣄۀऀ໨ઢ͔ΒշదͳαʔϏεͷߏஙํ਑ʹֶ͍ͭͯΜͩ
    • ࠷৽ͷݚڀಈ޲΋঺հͨ͠
    334
    େن໛ϗεςΟϯάαʔϏε͔Β஌ΔηΩϡϦςΟ

    View full-size slide

  323. 1. ͸͡Ίʹ
    2. WebαʔόͷηΩϡϦςΟͱӡ༻ٕज़ͷഎܠ
    3. WebαʔόͱWebϗεςΟϯάγεςϜͷجૅ஌ࣝ
    4. ηΩϡϦςΟͱϦιʔε෼཭
    5. ηΩϡϦςΟͱੑೳ
    335
    ໨࣍ͷৼΓฦΓ

    View full-size slide

  324. 6. ηΩϡϦςΟͱӡ༻ٕज़
    7. େن໛WebαʔόͷTLSূ໌ॻ؅ཧ
    8. ͓ΘΓʹ
    ext. FastContainerʹؔ͢Δݚڀಈ޲
    336
    ໨࣍

    View full-size slide

  325. • Ϋϥ΢υαʔϏε͔Βϋʔυ΢ΣΞ
    ΍ωοτϫʔΫͷఆ൪ߏ੒Λ஌Δ
    • Ϋϥ΢υج൫ιϑτ΢ΣΞ͔ΒVM
    ΍ίϯςφͷΦʔέετϨʔγϣϯ
    ͔ΒϨΠϠʔΞʔΩςΫνϟ΍ͦͷ
    ࣮૷ʹ͍ͭͯཧղ͢Δ
    • OpenStackɺKubernetesͳͲ
    337
    ࠓճ͸औΓ্͛·ͤΜͰ͕ͨ͠

    View full-size slide

  326. ext.
    ߃ৗੜΛ࣋ͭγεςϜΞʔΩςΫνϟʹ
    ؔ͢Δݚڀ

    View full-size slide

  327. FastContainer: ࣮ߦ؀ڥͷมԽʹ
    ૉૣ͘దԠͰ͖Δ߃ৗੑΛ࣋ͭ
    γεςϜΞʔΩςΫνϟʹؔ͢Δݚڀಈ޲

    View full-size slide

  328. ηΫγϣϯͷ֓ཁ

    View full-size slide

  329. 1.FastContainer: ࣮ߦ؀ڥͷมԽʹૉૣ͘దԠͰ͖Δ߃ৗ
    ੑΛ࣋ͭγεςϜɾΞʔΩςΫνϟʹؔ͢Δݚڀಈ޲
    2.HTTPϦΫΤετ୯ҐͰΠϯελϯεͷ࠶഑ஔ͕Մೳͳ௿
    ίετͰߴ଎ͳεέδϡʔϦϯάख๏
    341
    ߃ৗੑΛ࣋ͭγεςϜΞʔΩςΫνϟͷݚڀಈ޲

    View full-size slide

  330. FastContainer
    ࣮ߦ؀ڥͷมԽʹૉૣ͘దԠͰ͖Δ߃ৗ
    ੑΛ࣋ͭγεςϜΞʔΩςΫνϟ

    View full-size slide

  331. 1. എܠͱ໨త
    2. Ծ૝Խج൫ͷεέʔϦϯάͱӡ༻ٕज़ͷ՝୊
    3. FastContainerΞʔΩςΫνϟ
    4. ࣮ݧͱߟ࡯
    5. ·ͱΊ
    343
    ໨࣍

    View full-size slide

  332. 1.
    എܠͱ໨త

    View full-size slide

  333. • ݸਓ͕౰ͨΓલʹଟछଟ༷ͳWebαΠτΛ࣋ͭ࣌୅
    • VPSͷΑ͏ͳࣗ༝౓ͱִ཭؀ڥ΋ٻΊΒΕ͖͍ͯͯΔ
    • SNSΛհͯ͠ݸਓͷίϯςϯπΛ֦ࢄ͠΍͍࣌͢୅
    • ݸਓͷWebαΠτ΁ͷΞΫηεूத͢Δػձͷ૿େ
    • ݸਓαΠτͰ΋ਝ଎ʹΦʔτεέʔϧͰ͖Δج൫͕ඞཁ
    345
    ݸਓͷWebαΠτ΁ͷΞΫηεूத΁ͷରԠ

    View full-size slide

  334. 1. Πϯελϯε௥Ճॲཧ͕௿଎Ͱ͋Δ͜ͱ
    2. ϋʔυ΢ΣΞϦιʔεͷར༻ޮ཰ͷ௿͞
    3. εέʔϦϯά͢΂͖ঢ়گݕ஌ͷϦΞϧλΠϜੑͷ௿͞
    4. ۭ͖Ϧιʔε֬ೝͷͨΊͷεέδϡʔϦϯάॲཧͷ஗Ԇ
    346
    ҰൠతͳԾ૝Խج൫ͷΦʔτεέʔϧͷ՝୊
    ͦ΋ͦ΋ΦʔτεέʔϧΛݸਓͷαΠτʹద༻͢Δͷ΋೉͍͠…

    View full-size slide

  335. 1. Πϯελϯε௥Ճॲཧ͕௿଎Ͱ͋Δ͜ͱ
    2. ϋʔυ΢ΣΞϦιʔεͷར༻ޮ཰ͷ௿͞
    3. εέʔϦϯά͢΂͖ঢ়گݕ஌ͷϦΞϧλΠϜੑͷ௿͞
    4. ۭ͖Ϧιʔε֬ೝͷͨΊͷεέδϡʔϦϯάॲཧͷ஗Ԇ
    347
    ҰൠతͳԾ૝Խج൫ͷΦʔτεέʔϧͷ՝୊
    ຊൃදͰ͸1.ͱ2.ͷ՝୊ΛղܾͰ͖ΔΞʔΩςΫνϟͷఏҊ
    → ݸਓ͕ҙࣝͤͣͱ΋࢖͑ΔαʔϏε΁ͷ࣮૷Λ໨ࢦ͢

    View full-size slide

  336. 1. Πϯελϯε௥Ճॲཧ͕௿଎Ͱ͋Δ͜ͱΛղܾ
    1.Πϯελϯεͷঢ়ଶͷఀࢭɾىಈɾมߋɾෳ੡ɾ࠶഑ஔΛߴ଎ʹ॥؀
    2.ϦΫΤετ୯ҐͰঢ়ଶΛܾఆ
    2. ϋʔυ΢ΣΞϦιʔεͷར༻ޮ཰ͷ௿͞Λղܾ
    1.ϦΫΤετ͕ແ͍Πϯελϯε͸Ұఆظؒىಈޙʹఀࢭ
    ϦΫΤετ୯ҐͰΠϯελϯεͷঢ়ଶΛܾఆ͢Δख๏ͷఏҊ
    348
    Πϯελϯε͕॥؀͢ΔมԽʹڧ͍ج൫ͷఏҊ

    View full-size slide

  337. • ϗετ͕॥؀͢ΔͷͰϥΠϒϥϦ͕ࣗવʹߋ৽͞Ε͍ͯ͘
    • ऩ༰ઌ৘ใΛม͑Δ͚ͩͰࣗવʹऩ༰αʔόؒΛҠಈՄೳ
    • WordPress౳ͷҰൠతͳCMSΛ഑ஔɾΦʔτεέʔϧՄೳ
    • Ϋϥ΢υϓϩόΠμࢦఆͷίʔσΟϯάͷඞཁ΋ͳ͍
    • ྫɿAWS lambdaʹྨ͢ΔServerless Architecture౳
    349
    ηΩϡϦςΟ΍ӡ༻ٕज़ͷ՝୊΋ಉ࣌ʹղܾ

    View full-size slide

  338. 2.
    Ծ૝Խج൫ͷεέʔϦϯάͱ
    ӡ༻ٕज़ͷ՝୊

    View full-size slide

  339. 1. Πϯελϯε௥Ճॲཧ͕௿଎Ͱ͋Δ͜ͱ
    2. ϋʔυ΢ΣΞϦιʔεͷར༻ޮ཰ͷ௿͞
    3. εέʔϦϯά͢΂͖ঢ়گݕ஌ͷϦΞϧλΠϜੑͷ௿͞
    4. ۭ͖Ϧιʔε֬ೝͷͨΊͷεέδϡʔϦϯάॲཧͷ஗Ԇ
    351
    ҰൠతͳԾ૝Խج൫ͷΦʔτεέʔϧͷ՝୊
    ຊൃදͰ͸1.ͱ2.ͷ՝୊Λείʔϓͱ͢Δ

    View full-size slide

  340. • VMͷ৔߹ɺݕ஌͔ΒͷΠϯελϯεىಈʹ͕͔͔࣌ؒΔ
    • ಥൃతͳΞΫηε࣌ʹεέʔϧॲཧ͕ؒʹ߹Θͳ͍
    • εέʔϧΞοϓʢׂΓ౰ͯϦιʔε૿ڧʣ΋؆୯ʹͰ͖ͳ͍
    352
    1. Πϯελϯεͷ௥Ճॲཧ͕௿଎Ͱ͋Δ͜ͱ

    View full-size slide

  341. • Πϯελϯε͕جຊతʹىಈ͠ϦιʔεΛ઎༗͠ଓ͚Δ
    • Πϯελϯε͕VMͷ৔߹ʹ࢖༻͢ΔϦιʔεྔ΋ଟ͍
    • Ұൠతʹ͸ৗ࣌Πϯελϯε͕ىಈ͠ଓ͚Δํࣜ
    • ىಈΠϯελϯεͷ਺͚ͩৗ࣌ϦιʔεΛ઎༗͢Δ
    • ϝϞϦϦʔΫ͢ΔϓϩηεͷӨڹ΋ड͚΍͍͢
    353
    2. ϋʔυ΢ΣΞϦιʔεͷར༻ޮ཰ͷ௿͞

    View full-size slide

  342. • ੬ऑੑରԠ΍όʔδϣϯΞοϓͷίετ͕ߴ͍
    • αʔϏεͷఀࢭˠόʔδϣϯΞοϓˠىಈͳͲ
    • ϝϯςφϯε࣌ͷௐ੔ͷίετ͕ߴ͍
    • ऩ༰αʔόͷҠಈͷίετ
    • αʔϏεఀࢭ࣌ؒͷௐ੔ͳͲߴ͍ස౓Ͱͷ࣮ࢪ͕ࠔ೉
    354
    ͦͷଞͷӡ༻ٕज़΍ηΩϡϦςΟͷ՝୊

    View full-size slide

  343. 3.
    FastContainerΞʔΩςΫνϟ

    View full-size slide

  344. • ঢ়ଶͷมԽΛߴ଎ʹߦ͑ͯ൓Ԡతʹಈ࡞Ͱ͖Δ͜ͱΛॏࢹ
    • γεςϜͷཁૉͷఀࢭ͔Βىಈॲཧͷޮ཰Խʹண໨
    • γεςϜͷཁૉͷఀࢭঢ়ଶΛڐ༰͢ΔγεςϜ
    • ৗʹఀࢭͱىಈ͕॥؀Մೳͳ߃ৗੑΛ࣋ͭγεςϜΛ໨ࢦ͢
    • ॥؀Մೳ = Մ༻ੑ͕ߴ͘ৗʹมԽՄೳͳج൫͕࣮ݱͰ͖Δ
    356
    Մ༻ੑߴ͘มԽʹڧ͍ج൫Λઃܭ͢Δʹ͸ʁ

    View full-size slide

  345. มԽ͠ଓ͚Δ͜ͱ͔ΒಘΒΕΔ҆ఆੑ
    357
    ϗετ"
    ϗετ"
    ϗετ"
    ϗετ" ϗετ"
    Πϯλʔωοτ
    ϗετ"
    ϗετ"
    ϗετ"
    ΍͕ͯఀࢭ
    ൓Ԡతʹىಈ
    ൓Ԡతʹ
    εέʔϧΞοϓ
    ऩ༰αʔόA
    ऩ༰αʔόB
    HTTPϦΫΤετ
    ൓Ԡతʹ
    εέʔϧΞ΢τ
    • ϗετͷىಈͱఀࢭΛ॥؀
    • ৗʹ॥؀͠ଓ͚ΔΞʔΩςΫνϟ
    • มԽ͠ଓ͚Δ͜ͱʹΑΔ҆ఆੑ
    • ॥؀ͷ଎౓վળΛ௥ٻ
    ৗʹมԽՄೳͰ͋ΔͨΊಥൃతͳΞ
    ΫηεूதͷΑ͏ͳมԽʹ΋଱ੑͷ
    ͋ΔΞʔΩςΫνϟΛ࣮ݱՄೳ

    View full-size slide

  346. • ϗετͷىಈɾෳ੡ɾఀࢭɾ૿ڧॲཧͷޮ཰ԽΛॏࢹ
    • ֤छॲཧΛHTTPϦΫΤετ࣌ʹϦΞΫςΟϒʹ࣮ࢪ
    • ϗετʹ͸ίϯςφܕԾ૝ԽΛ࠾༻ͯ͠ىಈΛߴ଎ʹ࣮ݱ
    • ϦΫΤετʹج͍ͯϦΞΫςΟϒʹίϯςφͷঢ়ଶΛܾఆ
    • ैདྷͷϓϩΞΫςΟϒɾ༧ଌతͳεέʔϦϯά͔Β൓Ԡతͳํࣜ΁
    • ΞΫηε܏޲ͱϦιʔεׂΓ౰͕ͯݶΓͳ͘ҰகͰ͖ΔΑ͏ʹ͢Δ
    • ༧ଌͰ͖ͳ͍ΞΫηε΍ಥൃతͳมԽʹదԠతͳΓιʔεׂΓ౰͕ͯՄೳ
    358
    FastContainerΞʔΩςΫνϟͱ໋໊

    View full-size slide

  347. ίϯςφ࣌୅ͷWebαʔϏεج൫Ϟσϧ
    359
    ຊΞʔΩςΫνϟͷείʔϓ
    FastContainer͸ཧ૝తʹ͸
    ΦʔέετϨʔγϣϯ૚ҎԼͷ
    πʔϧ܈Ͱ࣮૷ՄೳͰ͋Δ
    0SDIFTUSBUJPO-BZFS
    (,& &$4 .BSBUIPO ,VCFSOFUFT %PDLFS4XBSN
    4USBUFHZ-BZFS
    3BODIFS 'BTU$POUBJOFS
    4FSWJDF-BZFS
    8FC"QQMJDBUJPOPS4FSWJDFPO$POUBJOFST
    *OGSBTUSVDUVSF-BZFS
    ($1 "[VSF "84 0QFO4UBDL .FTPT #BSF.FUBM -JOVY,JU
    $POUBJOFS3VOUJNF-BZFS
    %PDLFS .PCZ DPOUBJOFSE -9$ SLU )BDPOJXB ,BUB$POUBJOFST
    $POUBJOFS3VOUJNF*OUFSGBDF $3*

    View full-size slide

  348. HTTP FastContainerͷϑϩʔ
    360
    8FC1SPYZ
    ʢOHY@NSVCZ

    $.%#
    ʴ
    "1*
    -PDBM8FC1SPYZ
    OHY@NSVCZ

    $MJFOU ίϯςφ
    ίϯςφ
    ίϯςφ
    w )551ϦΫΤετͷ)PTUOBNF
    ΛΩʔʹɺ$.%# ߏ੒؅ཧ%#

    ͔Βίϯςφͷ৘ใΛऔಘ
    )551 4

    ϦΫΤετ
    w ίϯςφͷ*1ͱϙʔτʹج͍
    ͯίϯςφʹϓϩΩγ
    w ίϯςφ͕-JTUFO͍ͯ͠ͳ͍
    ৔߹͸$.%#͔Βίϯςφ
    ৘ใΛಘͯىಈ
    $POUBJOFS&OHJOF
    IBDPOJXB

    View full-size slide

  349. ΦʔτεέʔϦϯάݕ஌ͷΞʔΩςΫνϟ
    361

    View full-size slide

  350. • ϦΫΤετ୯ҐͰߴ଎ʹεέʔϧΞοϓɾεέʔϧΞ΢τՄೳ
    • ίϯςφʹ߃ৗੑΛ࣋ͨͤΔ͜ͱͰϦιʔεͷޮ཰Խ
    • ίϯςφΛ࢖͍ࣺͯՄೳʹ → immutability
    • Ұఆ࣌ؒىಈ͢Δ͜ͱͰ౎౓ىಈΑΓߴ଎Խ → mortality
    • ߟ͑ํʹΑͬͯ͸ϝϞϦϦʔΫ͢Διϑτ΢ΣΞΛ΋ڐ༰
    362
    FastContainerΞʔΩςΫνϟͷ·ͱΊ

    View full-size slide

  351. • ίϯςφ͕॥؀͢ΔͷͰϥΠϒϥϦ͕ࣗવʹߋ৽͞Ε͍ͯ͘
    • ར༻ऀʹͱͬͯ͸ηΩϡϦςΟ޲্
    • ఏڙଆʹͱͬͯ͸੬ऑੑରԠ΍όʔδϣϯΞοϓͷޮ཰Խ
    • CMDBͷऩ༰ઌ৘ใΛม͑Δ͚ͩͰࣗવʹऩ༰αʔόΛҠಈ
    • ϝϯςφϯε΍ো֐ରԠ࣌ͷແఀࢭରԠ͕༰қʹͳΔ
    363
    FastContainerΞʔΩςΫνϟͷ·ͱΊ

    View full-size slide

  352. 4.
    ࣮ݧͱߟ࡯

    View full-size slide

  353. FastContainerΞʔΩςΫνϟͷ࣮૷
    365
    CMDBʹߏ੒΍ίϯςφͷঢ়
    ଶ͕શͯอଘ͞Ε͍ͯΔɻ
    UserProxyͱCompute͕Ϧ
    ΫΤετʹج͍ͯCoreAPIܦ
    ༝ͰCMDB͔Βঢ়ଶΛऔಘɾ
    มߋ͠ߏ੒ΛมԽͤ͞Δɻ
    Compute͸ෳ਺୆Ͱ
    DataPoolΛNFSͰڞ༗͠ɺ
    ίϯςφΛHTTPϦΫΤετ
    ͔ΒϦΞΫςΟϒʹىಈ͢Δɻ

    View full-size slide

  354. ࣮ݧ؀ڥ ߲໨ ࢓༷
    $PNQVUF
    $16
    .FNPSZ
    /*$
    04
    *OUFM9FPO&()[DPSF
    (CZUF
    (CQT
    6CVOUV,FSOFM
    6TFS1SPYZ
    $16
    .FNPSZ
    /*$
    04
    *OUFM9FPO&()[DPSF
    (CZUF
    (CQT
    6CVOUV,FSOFM
    $PSF"1*
    $16
    .FNPSZ
    /*$
    04
    *OUFM9FPO&()[DPSF
    (CZUF
    (CQT
    6CVOUV,FSOFM
    $.%#
    $16
    .FNPSZ
    /*$
    04
    *OUFM9FPO&()[DPSF
    (CZUF
    (CQT
    6CVOUV,FSOFM
    %BUB1PPM
    $16
    .FNPSZ
    /*$
    04
    *OUFM9FPO&()[DPSF
    (CZUF
    (CQT
    6CVOUV,FSOFM
    OpenStackͰߏங͞ΕͨԾ૝ج൫্
    Ͱ֤ίϯϙʔωϯτΛVM্Ͱ࣮૷
    ͠ɺ࣮ݧΛ࣮ࢪɻ
    ίϯςφ͸phpinfo()͕ಈ࡞͢Δ
    mod_phpΛ૊ΈࠐΜͩApache࣮ߦ
    ؀ڥɻઃఆ͸σϑΥϧτɻCPU1ίΞ
    ͷ30%ɺϝϞϦ512MBΛׂΓ౰ͯɻ
    εέʔϧΞ΢τͱεέʔϧΞοϓͷਝ
    ଎ੑΛධՁ͢ΔͨΊʹɺ10ສϦΫΤ
    ετͷ5ສϦΫΤετ͔Βεέʔϧॲ
    ཧΛߦ͍ɺॲཧ͕٧·Δ͜ͱͳ͘ෛՙ
    ෼ࢄग़དྷ͍ͯΔ͔Λ֬ೝɻ

    View full-size slide

  355. 367
    335ඵ࣌఺ͰεέʔϧΞ΢τΛ࣮ࢪ͠ɺ
    340ඵ࣌఺Ͱෛՙ෼ࢄ͕։࢝͞Ε͍ͯΔɻ
    5ສϦΫΤετҎ߱͸2ίϯ
    ςφʹεέʔϧΞ΢τ͞Εͨ
    ͨΊɺϨεϙϯελΠϜ͕൒
    ෼ҎԼͱͳͬͯ࢒Γͷ5ສϦ
    ΫΤετ୹࣌ؒͰॲཧ͍ͯ͠
    Δ͜ͱ͕෼͔Δɻ

    View full-size slide

  356. 368
    301ඵ࣌఺ͰCPU2ഒͷεέʔϧΞο
    ϓΛ࣮ࢪ͠ɺ302ඵ͔ΒϨεϙϯε
    λΠϜ͕ঃʑʹૣ͘ͳΓ304ඵͰ൒
    ෼ͷϨεϙϯελΠϜʹͳ͍ͬͯΔɻ
    5ສϦΫΤετҎ߱͸CPU͕
    ݩͷ2ഒʹڧԽ͞ΕͨͨΊɺ
    ϨεϙϯελΠϜ͕໿൒෼ͱ
    ͳͬͯ࢒Γͷ5ສϦΫΤετ
    ୹࣌ؒͰॲཧ͍ͯ͠Δ͜ͱ͕
    ෼͔Δɻ

    View full-size slide

  357. Ruby on Railsͷىಈ࣌ؒʢCRIUʣ
    369
    3VCZɼ3BJMTɼ1VNB
    3VCZPO3BJMTͷσϑΥϧταΠτ

    View full-size slide

  358. • ΦʔτεέʔϧͷॲཧίετͱϦιʔεޮ཰Խͷ՝୊ʹண໨
    • ෆมੑΛ൐͏ج൫ͷηΩϡϦςΟͱӡ༻ٕज़ͷ՝୊ʹண໨
    • Πϯελϯε͕॥؀͠มԽʹڧ͍Ծ૝Խج൫ٕज़ͷఏҊ
    • ϩϦϙοϓʂϚωʔδυΫϥ΢υͱͯ͠αʔϏε΋ϦϦʔε
    • ຊΞʔΩςΫνϟͱࣗ࡞ίϯςφΤϯδϯΛ࣮૷࣮ͯ͠ݱ
    371
    ·ͱΊ

    View full-size slide

  359. • αʔϏεͱ࣮ͯ͠૷࣮͠ӡ༻্ͷޮՌΛଌఆத
    • ॳճىಈ࣌ؒͱىಈܧଓ࣌ؒͱΞΫηε਺ͷؔ܎Λߟ࡯
    • ϢʔβମݧΛଛͳΘͳ͍ىಈܧଓ࣌ؒͷదԠతܾఆ͕Մೳ͔
    • CRIUʹΑΓίϯςφ಺ͷΞϓϦΛΠϝʔδԽͯ͠ߴ଎ىಈ
    • ߃ৗੑʹΑΔϦιʔεޮ཰ԽΛ۝भେֶͱڞಉͰ࣮ূ࣮ݧத
    372
    ࠓޙͷ՝୊

    View full-size slide

  360. 1. Πϯελϯε௥Ճॲཧ͕௿଎Ͱ͋Δ͜ͱ
    2. ϋʔυ΢ΣΞϦιʔεͷར༻ޮ཰ͷ௿͞
    3. εέʔϦϯά͢΂͖ঢ়گݕ஌ͷϦΞϧλΠϜੑͷ௿͞
    4. ۭ͖Ϧιʔε֬ೝͷͨΊͷεέδϡʔϦϯάॲཧͷ஗Ԇ
    373
    ҰൠతͳԾ૝Խج൫ͷΦʔτεέʔϧͷ՝୊
    ਐḿ

    View full-size slide

  361. • σʔλऩूࣗମ͸਺ेඵ୯Ґ
    • εέʔϦϯάͷτϦΨʔݕ஌͸࠷େ3෼ඞཁ
    • ޡݕ஌ΛݮΒ͠ͳ͕Βૉૣ͘εέʔϦϯάΛݕ஌Ͱ͖Δ͔
    • εέʔϧΞ΢τɾΠϯ͕ແବʹසൃ͠ͳ͍Α͏ͳϧʔϧઃܭ
    • ΦϯϥΠϯʹదͨ͠มԽ఺ݕग़ͷΑ͏ͳ౷ܭతख๏ʹ΋ؼண
    374
    εέʔϦϯά͢΂͖ঢ়گͷݕ஌ʹؔ͢Δ՝୊

    View full-size slide

  362. FastContainer
    CRIUΛར༻ͨ͠HTTPϦΫΤετ୯ҐͰίϯςφΛ
    ࠶഑ஔͰ͖Δ௿ίετͰߴ଎ͳεέδϡʔϦϯάख๏

    View full-size slide

  363. 1. എܠͱ໨త
    2. ؔ࿈ݚڀͷ՝୊
    3. ఏҊख๏
    4. ࣮ݧͱߟ࡯
    5. ·ͱΊ
    376
    ໨࣍

    View full-size slide

  364. 1.
    എܠͱ໨త

    View full-size slide

  365. • ݸਓ͕౰ͨΓલʹଟछଟ༷ͳWebαΠτΛ࣋ͭ࣌୅
    • Ϋϥ΢υɾVPSͷΑ͏ͳࣗ༝౓ͱִ཭؀ڥʢΠϯελϯεʣʹର͢Δཁٻ
    • SNSΛհͯ͠ݸਓͷίϯςϯπΛ֦ࢄ͠΍͍࣌͢୅
    • ݸਓͷWebαΠτ΁ͷΞΫηεूத͢Δػձͷ૿େ
    • ݸਓαΠτͰ΋ΞΫηεूத΍ো֐ͱ͍ͬͨมԽʹڧ͍ج൫͕ඞཁ
    378
    ݸਓͷWebαΠτ΁ͷΞΫηεूத΍৴པੑ

    View full-size slide

  366. 1. Πϯελϯε௥Ճॲཧ͕௿଎Ͱ͋Δ͜ͱΛղܾ
    • Πϯελϯε(ίϯςφ)ͷঢ়ଶͷఀࢭɾىಈɾεέʔϦϯάΛߴ଎ʹ॥؀
    • ϦΫΤετ୯ҐͰঢ়ଶΛܾఆ → มԽʹڧ͍ج൫΁
    2. ϋʔυ΢ΣΞϦιʔεͷར༻ޮ཰ͷ௿͞Λղܾ
    • ϦΫΤετ͕ແ͍Πϯελϯε͸Ұఆظؒىಈޙʹఀࢭ
    • CPU48ίΞ256GBϝϞϦఔ౓ͷαʔόʹ਺ສ͔Βे਺ສϗετΛ૝ఆ
    ΠϯελϯεΛߴूੵʹऩ༰ՄೳͰมԽʹڧ͍Ծ૝Խج൫FastContainer
    379
    Πϯελϯε͕॥؀͢ΔมԽʹڧ͍ج൫ͷఏҊ※1
    ˞দຊ྄հ ۙ౻Ӊஐ࿕ ࡾ୐༔հ ྗ෢݈࣍ ܀ྛ݈ଠ࿠ 'BTU$POUBJOFS࣮ߦ؀ڥͷมԽʹૉૣ͘దԠͰ͖Δ߃ৗੑΛ࣋ͭγεςϜΞʔΩςΫνϟ
    Πϯλʔωοτͱӡ༻ٕज़γϯϙδ΢Ϝ࿦จूɼɼʢʣ /PW

    View full-size slide

  367. • Մ༻ੑ୲อͷͨΊʹෳ਺ΠϯελϯεՔಇͤ͞Δ͜ͱʹΑΔίετͷ૿େ
    • ෳ਺ͷऩ༰αʔόʹΠϯελϯεΛͦΕͧΕՔಇͤ͞Δ͜ͱͰՄ༻ੑΛ୲อ
    • ߴूੵʹΠϯελϯεऩ༰͢Δ؍఺͔ΒͰ͖Δ͚ͩϦιʔεΛઅ໿͍ͨ͠
    • ར༻ऀ໨ઢͰ΋Մ༻ੑΛ୲อͭͭ͠අ༻Λ࡟ݮ͍ͨ͠
    • ґવͱͯ͠ɺHTTPͷϨεϙϯελΠϜͷ؍఺͔ΒɺFastContainerͷHTTPϦ
    ΫΤετܖػͰঢ়ଶΛมߋ͢Δ࣌ؒͷ୹ॖ΋՝୊
    380
    FastContainer͓Αͼؔ࿈ݚڀͷՄ༻ੑͷ՝୊

    View full-size slide

  368. 1. Πϯελϯε্ͰWordPressͷΑ͏ͳҰൠతͳWebΞϓϦ͕ಈ࡞Մೳ
    2. ୯ҰΠϯελϯεͰ΋ऩ༰αʔόো֐࣌ʹ͸ผαʔό΁ࣗಈతʹ࠶഑ஔՄೳ
    3. Πϯελϯεͷ࠶഑ஔͷ࣮ߦ࣌Ͱ͋ͬͯ΋਺ඵͷ஗ԆͰHTTPλΠϜΞ΢τ͢
    Δ͜ͱͳ͘ΦϯϥΠϯͰϨεϙϯεΛૹ৴Մೳ
    ΠϯελϯεΛߴ଎ʹ࠶഑ஔՄೳʹ͢Δ͜ͱͰूੵ཰Λ޲্ͤ͞
    ௿ίετͳج൫Λ࣮ݱ͢ΔεέδϡʔϦϯάख๏ͷఏҊ
    381
    ݚڀͷ໨త: ϦΫΤετ୯Ґ ͰͷΠϯελϯε࠶഑ஔ

    View full-size slide

  369. 2.
    ؔ࿈ݚڀͷ՝୊

    View full-size slide

  370. • FastContainer ※1͸HTTPϦΫΤετʹԠͯ͡൓Ԡత͔ͭߴ଎ʹΠϯελϯε
    ͷঢ়ଶʢىಈɺఀࢭɺҠಈɺෳ੡ɺϦιʔε૿ݮ౳ʣΛܾఆ
    • ΞΫηε਺ʹԠͨ͡ϦΞΫςΟϒͳεέʔϦϯάॲཧ͕Մೳ
    • Ϋϥ΢υαʔϏεج൫͸༧ΊΠϯελϯεΛىಈͤͯ͞ϦΫΤετΛॲཧ
    • ΞΫηεूத࣌͸༧ଌత͔ͭϓϩΞΫςΟϒͳεέʔϦϯάॲཧ͕ඞཁ
    383
    FastContainerͱΫϥ΢υαʔϏεج൫ͷಛ௃
    ˞দຊ྄հ ۙ౻Ӊஐ࿕ ࡾ୐༔հ ྗ෢݈࣍ ܀ྛ݈ଠ࿠ 'BTU$POUBJOFS࣮ߦ؀ڥͷมԽʹૉૣ͘దԠͰ͖
    Δ߃ৗੑΛ࣋ͭγεςϜΞʔΩςΫνϟ Πϯλʔωοτͱӡ༻ٕज़γϯϙδ΢Ϝ࿦จूɼɼ
    ʢʣ ೥݄

    View full-size slide

  371. 1. WordPressͷΑ͏ͳҰൠతͳWebΞϓϦέʔγϣϯΛར༻Մೳ
    2. Πϯελϯεͷऩ༰αʔόͷো֐࣌ʹHTTPλΠϜΞ΢τ͕ੜ͡ͳ͍ϨϕϧͰ
    αʔϏεΛܧଓͰ͖Δఔ౓ͷՄ༻ੑΛ૝ఆ
    ௿Ձ֨WebϗεςΟϯάج൫ɺΫϥ΢υج൫ɺFastContainerج൫Ͱ੔ཧ
    384
    ຊݚڀʹ͓͚ΔԾ૝Խج൫ͱՄ༻ੑͷલఏ

    View full-size slide

  372. • ҰൠతͳWebΞϓϦέʔγϣϯ͕ར༻Մೳ
    • ௿Ձ֨Λ࣮ݱ͢ΔͨΊߴूੵʹϗετΛऩ༰ՄೳͳԾ૝ϗετํ͕ࣜҰൠత
    • ྫɿ୯ҰͷApacheͰ਺ສυϝΠϯͷԾ૝ϗετΛॲཧ
    • ਺ສυϝΠϯΛॲཧ͢ΔApacheΛෳ਺αʔόʹෳ਺഑ஔͯ͠Մ༻ੑΛ୲อ※1
    • ෳ਺Webαʔόϓϩηεͷىಈ͕લఏͱͳΓϦιʔε઎༗ͷίετ͕૿େ
    385
    ௿Ձ֨WebϗεςΟϯάج൫ͷՄ༻ੑ
    ˞দຊ྄հ ઒ݪক࢘ দԬً෉ େن໛ڞ༗ܕ8FCόʔνϟϧϗεςΟϯάج൫ͷηΩϡϦςΟͱӡ༻ٕज़ͷ
    վળ ৘ใॲཧֶձ࿦จࢽ 7PM /P QQ .BS

    View full-size slide

  373. • ༷ʑͳWebΞϓϦέʔγϣϯʢϗεςΟϯάΑΓࣗ༝౓͕ߴ͍ʣ͕ར༻Մೳ
    • IaaS΍PaaSΛར༻ͨ͠Πϯελϯε୯ҐͰͷߏங͓ΑͼՄ༻ੑ୲อ͕Ұൠత
    • ຊݚڀͷՄ༻ੑ͕લఏͷ৔߹ɺෳ਺ऩ༰αʔόʹͦΕͧΕΠϯελϯεΛϗο
    τελϯόΠํࣜʢىಈࡁΈͷ଴ػΠϯελϯεʣͰ଴ػ͢Δ͜ͱͰ࣮ݱ
    • ऩ༰αʔόఀࢭ࣌ʹ΋ଈ࣌αʔϏεΛܧଓ͢ΔͨΊ
    • ෳ਺Πϯελϯεͷىಈ͕લఏͱͳΓϦιʔε઎༗ͷίετ͕૿େ
    386
    FastContainer΍Ϋϥ΢υج൫ͷՄ༻ੑ

    View full-size slide

  374. 387
    $MJFOU
    4FSWFS
    "QBDIF
    ʢWIPTU܈ʣ
    4UPSBHF
    $MJFOU
    4FSWFS
    JOTUBODF"
    JOTUBODF#
    JOTUBODF$
    4FSWFS
    JOTUBODF"
    4UPSBHF
    4FSWFS
    "QBDIF
    ʢWIPTU܈ʣ
    ௿Ձ֨8FCϗεςΟϯάج൫ͷՄ༻ੑ 'BTU$POUBJOFS΍Ϋϥ΢υج൫ͷՄ༻ੑ
    )551ϦΫΤετ )551ϦΫΤετ

    View full-size slide

  375. 388
    $MJFOU
    4FSWFS
    "QBDIF
    ʢWIPTU܈ʣ
    4UPSBHF
    $MJFOU
    4FSWFS
    JOTUBODF"
    JOTUBODF#
    JOTUBODF$
    4FSWFS
    JOTUBODF"
    4UPSBHF
    4FSWFS
    "QBDIF
    ʢWIPTU܈ʣ
    ௿Ձ֨8FCϗεςΟϯάج൫ͷՄ༻ੑ 'BTU$POUBJOFS΍Ϋϥ΢υج൫ͷՄ༻ੑ
    )551ϦΫΤετ
    )551ϦΫΤετ


    View full-size slide

  376. 3.
    ఏҊख๏

    View full-size slide

  377. 1. Πϯελϯε্ͰWordPressͷΑ͏ͳҰൠతͳWebΞϓϦ͕ಈ࡞Մೳ
    2. ୯ҰΠϯελϯεͰ΋ऩ༰αʔόো֐࣌ʹ͸ผαʔό΁ࣗಈతʹ࠶഑ஔՄೳ
    3. Πϯελϯεͷ࠶഑ஔͷ࣮ߦ࣌Ͱ͋ͬͯ΋਺ඵͷ஗ԆͰHTTPλΠϜΞ΢τ͢
    Δ͜ͱͳ͘ΦϯϥΠϯͰϨεϙϯεΛૹ৴Մೳ
    390
    ఏҊख๏: ϦΫΤετ୯Ґ ͰͷΠϯελϯε࠶഑ஔ

    View full-size slide

  378. 391
    4UPSBHF
    $MJFOU
    4FSWFS
    JOTUBODF"
    JOTUBODF#
    JOTUBODF$
    4FSWFS
    JOTUBODF"
    'BTU$POUBJOFS΍Ϋϥ΢υج൫ͷՄ༻ੑ
    4UPSBHF
    $MJFOU
    4FSWFS
    JOTUBODF"
    JOTUBODF#
    JOTUBODF$
    4FSWFS
    ఏҊख๏ʴ'BTU$POUBJOFSͷՄ༻ੑ
    ఏҊख๏
    )551ϦΫΤετ )551ϦΫΤετ

    View full-size slide

  379. 392
    4UPSBHF
    $MJFOU
    4FSWFS
    JOTUBODF"
    JOTUBODF#
    JOTUBODF$
    4FSWFS
    JOTUBODF"
    'BTU$POUBJOFS΍Ϋϥ΢υج൫ͷՄ༻ੑ
    4UPSBHF
    $MJFOU
    4FSWFS
    JOTUBODF"
    JOTUBODF#
    JOTUBODF$
    4FSWFS
    ఏҊख๏ʴ'BTU$POUBJOFSͷՄ༻ੑ
    ఏҊख๏
    )551ϦΫΤετ )551ϦΫΤετ
    JOTUBODF"
    ✗൓Ԡతʹ
    ࠶഑ஔ

    View full-size slide

  380. HTTP FastContainerͷجຊϑϩʔ
    393
    8FC1SPYZ
    ʢOHY@NSVCZ

    $.%#
    ʴ
    "1*
    8FC%JTQBUDIFS
    OHY@NSVCZ

    $MJFOU ίϯςφ
    ίϯςφ
    ίϯςφ
    w )551ϦΫΤετͷ)PTUOBNF
    ΛΩʔʹɺ$.%# ߏ੒؅ཧ%#

    ͔Βίϯςφͷ৘ใΛऔಘ
    )551 4

    ϦΫΤετ
    w ίϯςφͷ*1ͱϙʔτʹج͍
    ͯίϯςφʹϓϩΩγ
    w ίϯςφ͕-JTUFO͍ͯ͠ͳ͍
    ৔߹͸$.%#͔Βίϯςφ
    ৘ใΛಘͯىಈ
    $POUBJOFS&OHJOF
    IBDPOJXB

    ऩ༰ϗετ"

    View full-size slide

  381. 1. Proxy͔Βऩ༰αʔόʹICMP/TCPͰ࠷௿ݶͷύέοτͰԠ౴଎౓Λଌఆ
    2. Ԡ౴଎౓͕ᮢ஋Λ௒͍͑ͯͨΒผͷऩ༰αʔό΁࠶഑ஔ
    3. ίϯςφىಈ࣌͸ɺىಈ׬ྃ௚લͷঢ়ଶͷϓϩηεΠϝʔδ͔Β෮ݩ
    → ඇৗʹγϯϓϧͳํࣜͰߴ଎ͳ࠶഑ஔΛ࣮ݱՄೳ
    → ୯ҰͷίϯςφͰ࣮༻తͳՄ༻ੑΛ୲อՄೳʢϦιʔείετͷ࡟ݮʣ
    394
    ߴ଎ͳऩ༰ϗετͷࢮ׆؂ࢹͱ࠶഑ஔ

    View full-size slide

  382. )PTU04
    8FC1SPYZ
    $.%#"1*
    $POUBJOFS
    %JTQBUDIFS
    $POUBJOFS
    )PTU04
    $POUBJOFS
    %JTQBUDIFS
    $POUBJOFS
    $MJFOU
    )551
    *$.1
    )551
    )551
    )551
    *$.1PS5$1

    View full-size slide

  383. )PTU04
    8FC1SPYZ
    $.%#"1*
    $POUBJOFS
    %JTQBUDIFS
    $POUBJOFS
    )PTU04
    $POUBJOFS
    %JTQBUDIFS
    $POUBJOFS
    $MJFOU
    )551 *$.1PS5$1
    *$.1PS5$1
    )551
    )551
    )551

    ࠷ॳͷ࠶഑ஔ࣌͸ίϯςφͷىಈ͕ඞཁͰ͋Δ͕ɺ
    ىಈޙ͸Ұఆظؒىಈ͠ଓ͚Δɻ

    View full-size slide

  384. • ICMP/TCPͰᮢ஋νΣοΫ͕Ұ࣌తʹޡݕ஌ͯ͠΋Өڹ͕গͳ͍
    • TCPͷ৔߹͸ࣗ࡞TCPελοΫͰԟ෮3ύέοτͰνΣοΫ[38]
    • FastContainerͳͷͰޡݕ஌ͷ࠶഑ஔ͕ੜͯ͡΋αʔϏε͕ܧଓ͞ΕΔ
    • ޡݕ஌Ͱଞαʔόʹىಈͯ͠͠·ͬͯ΋Ұఆ࣌ؒىಈͨ͠Βఀࢭ͢Δ
    • ݩαʔόʹ࠶഑ஔ͞ΕͯCMDB্͸ݩαʔόͷΈʹϦΫΤετ͕ྲྀΕΔ
    • Ԡ౴࣌ؒͷᮢ஋΍λΠϜΞ΢τΛΪϦΪϦ·ͰνϡʔχϯάՄೳ
    397
    ఏҊख๏ͷϙΠϯτʢICMP/TCP؂ࢹʣ
    <>NBUTVNPUPSZ NSVCZGBTUSFNPUFDIFDL IUUQTHJUIVCDPNNBUTVNPUPSZNSVCZGBTUSFNPUFDIFDL

    View full-size slide

  385. • ίϯςφ಺ͷWebαʔόϓϩηεΛىಈ׬ྃ௚લͰΠϝʔδԽ(Checkpoint)
    • ఆظతʹඇಉظͰϓϩηεͷىಈ׬ྃ௚લΠϝʔδΛ࡞੒͓ͯ͘͠
    • ϦΫΤετड৴࣌ʹΠϝʔδΛϓϩηεʹ෮ݩ(Restore)
    • αʔόϓϩηεͷॳظԽॲཧΛεΩοϓ
    • ىಈʹ࣌ؒͷ͔͔ΔΞϓϦέʔγϣϯαʔό౳ʹ༗ར
    • Ruby on RailsɼDjangoͳͲ
    398
    ఏҊख๏ͷϙΠϯτʢCheckpoint/Restoreʣ

    View full-size slide

  386. • αʔόϓϩηεͷىಈ௚ޙΛίϯςφϥϯλΠϜͰϑοΫͯ͠Checkpoint
    • ࢀߟ: seccompͰγεςϜίʔϧΛ؂ࢹ͠ptraceͰҰ࣌ఀࢭ͔ͯ͠ΒCRIUͰ
    CheckpointʹΑΔΠϝʔδԽͱ͍͏ํ๏΋͋Δ
    • CRIUͷதͰseccompΛ࢖͓ͬͯΓύον͕ඞཁͰ൚༻ੑʹ͔͚Δ
    • ϦΫΤετΛड͚ͯίϯςφΛىಈ͢Δ࣌͸Πϝʔδ͔ΒRestoreͯ͠ىಈ
    399
    Checkpoint/RestoreʹΑΔFastContainerͷىಈ

    View full-size slide

  387. αʔόϓϩηεͷCheckpoint/Restoreͷ࣮૷
    400
    SFGl04ϨΠϠͰ8FCαʔό͕ىಈ࣌ʹ࣮ߦ͢ΔγεςϜίʔϧΛ؂ࢹ͠ىಈ׬ྃ௚લͷϓϩηεΛΠϝʔδԽ͢ΔlIUUQ
    ICNBUTVNPUPSKQFOUSZ

    View full-size slide

  388. 4.
    ࣮ݧͱߟ࡯

    View full-size slide

  389. FastContainerͷγεςϜߏ੒
    402

    View full-size slide

  390. • ༧උ࣮ݧ: CRIUͱCheckpoint/Restore͢ΔϓϩηεͷϝϞϦαΠζͱͷؔ܎
    • ༧උ࣮ݧ: CRIUͱCheckpoint/Restore͢Δϓϩηε਺ͱͷؔ܎
    • ୅දతͳΞϓϦέʔγϣϯΛ࢖ͬͨίϯςφ࠶഑ஔ࣌ͷϨεϙϯελΠϜ
    • Apache 2.4.18ɼPHP 7.3.0ɼWordpress 5.0.3ʢσϑΥϧτϖʔδʣ
    • Python 3.7.1ɼDjango 2.1.4ɼgunicorn 19.9.0※1
    • Ruby 2.5.1ɼRails 5.2.1ɼPuma 3.12.0※2
    404
    ࣮ݧ಺༰
    ˞IUUQTNDMPMJQPQ[FOEFTLDPNIDKBBSUJDMFT
    ˞IUUQTHJUIVCDPNFWFSZMFBGFMUSBJOJO
    ݱ࣮తͳن໛ʢݸਓάϧʔϓ಺Ͱͷར༻ͷΞϓϦέʔγϣϯఔ౓ʣͰ%#Λར༻ͨ͠΋ͷΛ࠾

    View full-size slide

  391. • ComputeͰWebαʔόͷCheckpoint/Restoreͷ଎౓Λܭଌ
    • mruby-simplehttpserver※1ͰWebαʔόΛىಈͤ͞setsockopt()Λ؂ࢹ
    • setsockopt()࣮ߦલʹCheckpoint
    • setsockopt()࣮ߦલʹϝϞϦΛ֬อͯ͠ɺϝϞϦαΠζʹԠͯ͡
    Checkpoint/Restoreͷ଎౓ͷมԽΛܭଌ
    405
    ༧උ࣮ݧɿϓϩηεͷΠϝʔδԽͷ࣮ݧ
    ˞NBUTVNPUPSZNSVCZTJNQMFIUUQTFSWFS IUUQTHJUIVCDPNNBUTVNPUPSZNSVCZTJNQMFIUUQTFSWFS

    View full-size slide

  392. αʔόϓϩηεͷΠϝʔδԽ(Checkpoint/Restore)
    406
    $IFDLQPJOU3FTUPSF1SPDFTTJOH5JNFEVFUP.FNPSZ6TBHF
    1SPDFTTJOHUJNF











    .FNPSZVTBHFQFSQSPDFTT<.#>

    $IFDLQPJOU 3FTUPSF

    View full-size slide

  393. • ComputeͰApache httpdͷϓϩηε਺ΛมԽ
    • HTTPϦΫΤετΛܖػʹApache httpdΛىಈͤͯ͞ϨεϙϯεΛฦ͢
    • ਺ेόΠτͷ੩తͳindex.htmlʹର͢ΔϦΫΤετ
    • CRIUΛ࢖͏৔߹
    • CRIUΛ࢖Θͳ͍৔߹
    407
    ༧උ࣮ݧɿϓϩηε਺ͱCRIUͷؔ܎

    View full-size slide

  394. Apacheͷworker਺ͱCRIUͷؔ܎
    408
    )PUTUBSU͸શͯͷ8PSLFSϓϩηε
    ͷىಈ׬ྃΛ଴ͨͣʹɼͭͰ΋
    XPSLFSϓϩηε͕ىಈ͢Ε͹Ϩεϙ
    ϯεΛฦ͢͜ͱ͕Ͱ͖ΔͨΊҰఆɽ
    $3*6͔Βͷىಈ͸8PSLFSϓϩηε
    ΛશͯΠϝʔδ͔͢ΔͨΊɼશ͕ͯ
    3FTUPSF͞Ε͔ͯΒϨεϙϯεΛฦ͢
    ͨΊ୯ௐ૿Ճɽ

    View full-size slide

  395. • Apache 2.4.18ɼPHP 7.3.0ɼWordpress 5.0.3
    • ϓϩηε਺͸3ɼ୯ҰͷϓϩηεͷϝϞϦαΠζ(RSS)͸35MBytes
    • Python 3.7.1ɼDjango 2.1.4ɼgunicorn 19.9.0 ※1
    • ϓϩηε਺2ɼεϨου਺2ɼ୯ҰͷϓϩηεͷRSS͸33MBytes
    • Ruby 2.5.1ɼRails 5.2.1ɼPuma 3.12.0 ※2
    • ϓϩηε਺2ɼεϨου਺14ɼ୯ҰͷϓϩηεͷRSS͸89MBytes
    • gemΛࣄલίϯύΠϧ͓ͯ͘͠bootsnapͱ΋ൺֱ
    409
    ίϯςφ࠶഑ஔ࣌ͷϨεϙϯελΠϜ

    View full-size slide

  396. WordPress on Apache httpd
    410
    BCίϚϯυͰಉ࣌઀ଓ਺ͷϕϯνϚʔΫΛ͔͚ͳ͕Β
    ऩ༰ϗετΛJQBUBCMFTͰԾ૝తʹμ΢ϯͤͯ͞ɼผͷऩ༰αʔόʹ࠶഑ஔΛڧ੍తʹൃੜͤͨ͞

    View full-size slide

  397. Django
    411
    IUUQTNDMPMJQPQ[FOEFTLDPNIDKBBSUJDMFT
    ݱ࣮తͳن໛ʢݸਓάϧʔϓ಺Ͱͷར༻ͷΞϓϦέʔγϣϯఔ౓ʣͰ%#Λར༻ͨ͠΋ͷΛ࠾༻

    View full-size slide

  398. Ruby on Rails
    412
    IUUQTHJUIVCDPNFWFSZMFBGFMUSBJOJO
    ݱ࣮తͳن໛ʢݸਓάϧʔϓ಺Ͱͷར༻ͷΞϓϦέʔγϣϯఔ౓ʣͰ%#Λར༻ͨ͠΋ͷΛ࠾༻

    View full-size slide

  399. • ୯ҰΠϯελϯεͰՄ༻ੑΛ୲อ͢Δߴ଎ͳεέδϡʔϦϯάख๏ΛఏҊ
    • ෳ਺ΠϯελϯεΛඞཁͱ͠ͳ͍ͨΊϦιʔείετ͕௿͍
    • ࣮ݧ͔Βݱ࣌఺Ͱ΋࣮༻ՄೳͳϨϕϧͷ࠶഑ஔͷੑೳ͕ಘΒΕͨ
    • ϓϩμΫγϣϯ؀ڥͰԠ༻
    • ϗετো֐࣌Ͱ͋ͬͯ΋Ϣʔβ͕ؾ͔ͮͳ͍ϨϕϧͰͷՄ༻ੑ
    • ΦʔτεέʔϦϯά࣌ʹ΋γʔϜϨεʹίϯςφΛ૿΍ͯ͠ෛՙରࡦՄೳʹ
    • ΞΫηε܏޲ͱϦιʔεׂΓ౰͕ͯਖ਼֬ʹ௥ਵՄೳʹ
    • εέʔϦϯά΍ϋʔυ΢ΣΞϓʔϧͷϦιʔεׂΓ౰ͯ΋࠷దԽ
    414
    ·ͱΊ

    View full-size slide