Share
Embed
Webサーバの高集積マルチテナントアーキテクチャに関する研究
松本の研究を通じて高集積ホスティングに関する技術と最新動向を学ぶ
ペパボ研究所 主席研究員/チーフエンジニア 松本亮介
2018年3月27日 小山さんへの高集積ホスティングに関する講義
MATSUMOTO Ryosuke PRO
March 27, 2018
Transcript
136 slides
-
8FCαʔόͷجຊతͳϞσϧ 1BSFOUIUUQEQSPDFTT PXOFSSPPU $IJMEIUUQEQSPDFTT PXOFSBQBDIF $IJMEIUUQEQSPDFTT PXOFSBQBDIF $IJMEIUUQEQSPDFTT PXOFSBQBDIF $MJFOU
ϦΫΤετ Ϩεϙϯε 6/*9ܥ04ͷ߹ࣄલʹϦΫΤετΛड͚Δ ϓϩηεΛෳGPSL ͯ͠ϓʔϧ͓ͯ͘͠ ʢ͜ΕΒશͯΛؚΊͯʮ୯Ұͷαʔόϓϩηεʯͱఆٛʣ ϦΫΤετ Ϩεϙϯε ϦΫΤετ Ϩεϙϯε -
ߴूੵͷͨΊͷΞʔΩςΫνϟ IUUQE Ϣʔβ" IUUQE Ϣʔβ# IUUQE Ϣʔβ$ IUUQE Ϣʔβ" Ϣʔβ#
Ϣʔβ$ ޮྑ͘ϦιʔεΛ͑Δ ىಈʹඞཁ ͳϦιʔε ىಈʹඞཁ ͳϦιʔε ىಈʹඞཁ ͳϦιʔε ىಈʹඞཁͳϦιʔε ߴूੵ͕ཁٻ͞ΕΔ߹ͷ Ϛϧνςφϯτʢຊݚڀʣ ϚϧνςφϯτͷผΞϓϩʔν -
$(*࣮ߦํࣜ $(*QSPDFTT QIQDHJJOEFYQIQ $(*QSPDFTT GPSL UFSNJOBUFQSPDFTT FYFDWF 1BSFOUIUUQEQSPDFTT PXOFSSPPU $IJMEIUUQEQSPDFTT
PXOFSBQBDIF ϦΫΤετຖʹϓϩηεͷੜɾഁغͱ ൺֱతେ͖ͳόΠφϦʢ1)1ͩͱQIQDHJόΠφϦʣͷ FYFDWF ͕ඞཁ -
$(*QSPDFTT PXOFSVTFS $(*QSPDFTT PXOFSSPPU QIQDHJJOEFYQIQ PXOFSVTFS $(*QSPDFTT PXOFSVTFS ੩తʹઃఆ͞ΕͨVJEΛݩʹTFUVJE TFUHJE
GPSL FYFDWF TVFYFDQSPHSBN TFUVJESPPU UFSNJOBUFQSPDFTT FYFDWF 1BSFOUIUUQEQSPDFTT PXOFSSPPU $IJMEIUUQEQSPDFTT PXOFSBQBDIF ˞$(* ैདྷͷΞΫηε੍ޚख๏ ϦΫΤετຖʹ$(*༻ϓϩηεͷ ੜഁغ͕ඞཁ -
1BSFOUIUUQEQSPDFTT PXOFSSPPU $IJMEIUUQEQSPDFTT PXOFSSPPU JOEFYQIQ PXOFSVTFS TFUVJE TFUHJE QBSTF SVO
$IJMEIUUQEQSPDFTT PXOFSVTFS $IJMEIUUQEQSPDFTT PXOFSVTFS UFSNJOBUFQSPDFTT ϦΫΤετຖʹࢠIUUQEϓϩηεͷੜഁغ͕ඞཁ ˞%40 ैདྷͷΞΫηε੍ޚख๏ -
1BSFOUIUUQEQSPDFTT PXOFSSPPU $IJMEIUUQEQSPDFTT PXOFSSPPU JOEFYQIQ PXOFSVTFS TFUVJE TFUHJE QBSTF SVO
˞%40 ैདྷͷΞΫηε੍ޚख๏ $IJMEIUUQEQSPDFTT PXOFSVTFS $IJMEIUUQEQSPDFTT PXOFSVTFS UFSNJOBUFQSPDFTT ϦΫΤετຖͷࢠIUUQEϓϩηεͷੜഁغ͕ඞཁ -
$(*QSPDFTT PXOFSVTFS $(*QSPDFTT PXOFSSPPU QIQDHJJOEFYQIQ PXOFSVTFS $(*QSPDFTT PXOFSVTFS ੩తʹઃఆ͞ΕͨVJEΛݩʹTFUVJE TFUHJE
GPSL FYFDWF TVFYFDQSPHSBN TFUVJESPPU UFSNJOBUFQSPDFTT FYFDWF 1BSFOUIUUQEQSPDFTT PXOFSSPPU $IJMEIUUQEQSPDFTT PXOFSBQBDIF ϦΫΤετຖʹ$(*༻ϓϩηεͷ ੜഁغ͕ඞཁ ˞$(* ैདྷͷΞΫηε੍ޚख๏ -
$(*QSPDFTT PXOFSVTFS $(*QSPDFTT PXOFSSPPU QIQDHJJOEFYQIQ PXOFSVTFS $(*QSPDFTT PXOFSVTFS DISPPU
ϦΫΤετϑΝΠϧ͔ΒVJEऔಘޙ TFUVJE TFUHJE GPSL FYFDWF TVFYFDQSPHSBN TFUVJESPPU UFSNJOBUFQSPDFTT FYFDWF 1BSFOUIUUQEQSPDFTT PXOFSSPPU $IJMEIUUQEQSPDFTT PXOFSBQBDIF DISPPU&OWJSPONFOU ˞$(* ఏҊ͢ΔΞʔΩςΫνϟ -
ߴूੵϚϧνςφϯτͱ$(*ɾ%40ͷੑೳ wੑೳ໘ʹ͓͍ͯ$(*ຊདྷద͍ͯ͠ͳ͍ ऩ༰͕૿͑ΔͱϓϩηεͷϝϞϦ༻ྔ͕૿͑GPSL ͷޮԼ ͦͦϦΫΤετ୯ҐͰGPSL ͢ΔͷͰ͍ w%40ຊདྷGPSL Λ࣮ߦ͠ͳ͍ͨΊߴʹಈ࡞͢Δ͕
ैདྷͷ%40ͷΞΫηε੍ޚϦΫΤετຖʹGPSL Λ࣮ߦ͢Δ -
1BSFOUIUUQEQSPDFTT PXOFSSPPU $IJMEIUUQEQSPDFTT PXOFSSPPU JOEFYQIQ PXOFSVTFS TFUVJE TFUHJE QBSTF SVO
˞%40 ैདྷͷΞΫηε੍ޚख๏ $IJMEIUUQEQSPDFTT PXOFSVTFS $IJMEIUUQEQSPDFTT PXOFSVTFS UFSNJOBUFQSPDFTT ϦΫΤετຖͷࢠIUUQEϓϩηεͷੜഁغ͕ඞཁ -
1BSFOUIUUQEQSPDFTT PXOFSSPPU $IJMEIUUQEQSPDFTT PXOFSBQBDIF UISFBE PXOFSVTFS UISFBE PXOFSBQBDIF JOEFYQIQ PXOFSVTFS
TFUVJE TFUHJE ʜ VOTFUDBQT DSFBUFUISFBE TFUDBQT EFTUSPZUISFBE QBSTF SVO QSDUM TFUVJETFUHJEDBQT UISFBE PXOFSVTFS ˞%40 ఏҊ͢ΔΞΫηε੍ޚΞʔΩςΫνϟ -
1BSFOUIUUQEQSPDFTT PXOFSSPPU $IJMEIUUQEQSPDFTT PXOFSBQBDIF UISFBE PXOFSVTFS UISFBE PXOFSBQBDIF TFUVJE TFUHJE
ʜ VOTFUDBQT DSFBUFUISFBE TFUDBQT EFTUSPZUISFBE QSDUM TFUVJETFUHJEDBQT UISFBE PXOFSVTFS ˞$(* ఏҊ͢ΔΞΫηε੍ޚΞʔΩςΫνϟ $(*QSPDFTT PXOFSVTFS QIQDHJJOEFYQIQ PXOFSVTFS $(*QSPDFTT PXOFSVTFS GPSL UFSNJOBUFQSPDFTT FYFDWF -
%40࣮ߦํࣜͷΞΫηε੍ޚੑೳൺֱ w ඵؒϦΫΤετΛ૿Ճͤ͞ͳ͕Βඵ ؒϨεϙϯεΛܭଌ w ͷैདྷͷΞΫηε੍ޚ΄ͱΜͲੑ ೳ͕Ͱ͍ͯͳ͍ w ͷఏҊ͢ΔΞΫηε੍ޚΞΫηε ੍ޚແ͠ͷ߹ͱൺͯ΄ͱΜͲΦʔ
όʔϔουແ͠ ੨ɿΞΫηε੍ޚແ͠ ɿఏҊ͢ΔΞΫηε੍ޚ ɿैདྷͷΞΫηε੍ޚ -
$(*࣮ߦํࣜͷΞΫηε੍ޚੑೳൺֱ w ඵؒϦΫΤετΛ૿Ճͤ͞ͳ͕ΒඵؒϨ εϙϯεΛܭଌ w $(*ͷΞΫηε੍ޚͷ༗ແʹؔΘΒͣ$(* ͷ࣮ߦํࣜͷΦʔόʔϔου͕େ͖͍ͨΊɺ ΞΫηε੍ޚʹΑΔΦʔόʔϔουແ͍ w ষͷ$(*ͷΞΫηε੍ޚTVFYFDͱಉ
ͷੑೳͰ͋Δ͜ͱ͕ষͰ࣮ݧࡁΈ ੨ɿΞΫηε੍ޚແ͠ ɿैདྷͷΞΫηε੍ޚ ɿఏҊ͢ΔΞΫηε੍ޚ -
ࢀߟɿγεςϜίʔϧͷΛൺֱ wQIQJOGP ͷΞΫηεΛTUSBDF͔Βղੳ w$(*ʴTV&9&$ճ wNPE@QIQ NPE@QSPDFTT@TFDVSJUZճ wΦʔόʔϔουʹͳͬͯΔγεςϜίʔϧ wDMPOF PQFO DMPTF
FYFDWF ͳͲTV&9&$ؔ࿈ ˞TUSBDFDGQ1*% ˞DBUDHJMPHcHSFQWFQPMM@XBJUcHSFQWGVUFYcQFSMBOF <aEa> QSJOU@JG -
αʔόϓϩηε ࢠαʔόϓϩηε" ϦΫΤετॲཧ༻ΠϯλϓϦλ ىಈ࣌ॲཧ༻ΠϯλϓϦλ ϦΫΤετҎ֎ͷॲཧ༻ΠϯλϓϦλ εΫϦϓτ εΫϦϓτ εΫϦϓτ εΫϦϓτ εΫϦϓτ
ੑೳ͕ཁٻ͞ΕΔϑοΫ ΠϯλϓϦλΛڞ༗ ɾ ɾ ɾ -
w αʔόϓϩηεىಈ࣌ʹΠϯλϓ ϦλΛ֬อ w ϦΫΤετॲཧ࣌ʹΠϯλϓϦλ Λڞ༗ͯ͠εΫϦϓτΛίϯύΠϧ ͔ͯ͠Β࣮ߦ ߏจղੳ όΠτίʔυੜ 7.্Ͱ࣮ߦ
ϦΫΤετຖʹαʔόϓϩηε͕εΫϦϓτΛϑοΫ εΫϦϓτಡΈࠐΈ ΠϯλϓϦλͱ ϥΠϒϥϦΛڞ༗ όΠτίʔυɺάϩʔόϧมɾΫϥεɺྫ֎ϑϥάΛ։์ ഉଞॲཧ ϚϧνεϨου8FC αʔόΞʔΩςΫνϟ ʹରԠ -
ߏจղੳ όΠτίʔυੜ 7.্Ͱ࣮ߦ ϦΫΤετຖʹαʔόϓϩηε͕εΫϦϓτΛϑοΫ εΫϦϓτಡΈࠐΈ ΠϯλϓϦλͱ ϥΠϒϥϦΛڞ༗ άϩʔόϧมɾΫϥεɺྫ֎ϑϥάΛ։์ όΠτίʔυ ςʔϒϧ
w όΠτίʔυΩϟογϡʹΑͬͯαʔ όϓϩηεىಈޙʹίʔυมߋ͕ඞ ཁͳ͍߹ߴԽ w αʔόىಈ࣌ʹίϯύΠϧͯ͠όΠ τίʔυςʔϒϧʹอଘ͓͖ͯ͠ɺ ϦΫΤετ࣌ʹऔಘ࣮ͯ͠ߦ -
NPE@NSVCZઃఆྫ # Normal hook <Location /mruby-test> mrubyHandlerMiddle /path/to/test.rb </Location> #
ByteCode Caching at Start up <Location /mruby-test-cache> mrubyHandlerMiddle /path/to/test.rb cache </Location> -
NPE@NSVCZઃఆྫ # Normal hook <Location /mruby-test> mrubyHandlerMiddle /path/to/test.rb </Location> #
ByteCode Caching at Start up <Location /mruby-test-cache> mrubyHandlerMiddle /path/to/test.rb cache </Location> -
OHY@NSVCZͷΠϯϥΠϯઃఆྫ # Inline code hook location /mruby-hello { mruby_content_handler_code ‘
r = Nginx::Request.new c = Nginx::Connection.new r.content_type = “text/plain” Nginx.echo “Hello #{c.remote_ip} World” ‘; } -
NPE@NSVCZͰͷ3FWFSTF1SPYZ # mrubyTranslateNameFirst “/path/to/proxy.rb” backends = [ "http://192.168.0.101:8888/", "http://192.168.0.102:8888/", "http://192.168.0.103:8888/",
] r = Apache::Request.new backend = backends[rand(backends.length)] r.reverse_proxy backend + r.unparsed_uri -
OHY@NSVCZͰͷ3FWFSTF1SPYZ # location /proxy { # mruby_set $backend "/path/to/proxy.rb"; #
proxy_pass http://$backend; # } backends = [ "http://192.168.0.101:8888/", "http://192.168.0.102:8888/", "http://192.168.0.103:8888/", ] backends[rand(backends.length)] -
NPE@NSVCZͷ#BTJD"VUIXJUI3FEJT # <Location /basic/> # AuthType basic # AuthName "Message
for clients" # AuthBasicProvider mruby # mrubyAuthnCheckPassword /path/to/authn_basic.rb # require valid-user # </Location> anp = Apache::AuthnProvider.new redis = Redis.new "127.0.0.1”, 6379 if redis.get(anp.user) == anp.password Apache.return Apache::AuthnProvider::AUTH_GRANTED else Apache.return Apache::AuthnProvider::AUTH_DENIED end -
ҟͳΔ8FCαʔόͷ౷Ұత֦ுهड़ "QBDIF "1* 3VCZTDSJQU NPE@NSVCZ 3VCZTDSJQU ɾ ɾ ɾ ɾ
3VCZTDSJQUO /HJOY "1* OHY@NSVCZ 3VCZTDSJQU "QBDIF $PSF /HJOY $PSF 3VCZ %4- GPS8FC "QBDIF 5SB⒏D 4FSWFS "1* UT@NSVCZ "QBDIF 5SB⒏D 4FSWFS $PSF SFGIUUQTHJUIVCDPNTZVDSFBNUT@NSVCZ -
౷Ұతهड़ྫ # Output Hello World Server = get_server_calss Server.rputs "Hello
#{Server.module_name}/ #{Server.module_version} world!" # mod_mruby => "Hello mod_mruby/1.9.3 world!" # ngx_mruby => "Hello ngx_mruby/1.3.2 world!" # ts_mruby => "Hello ts_mruby/0.0.1 world!" -
ैདྷख๏ͱͷੑೳൺֱ ैདྷͷػೳ֦ ு NPE@QFSM NPE@SVCZ NPE@MVB NPE@NSVCZ NPE@NSVCZ Ωϟογϡ ݴޠ
$ 1FSM 3VCZ -VB NSVCZ NSVCZ ΠϯλϓϦλ ॳظԽॲཧ ࣄલ ࣄલ ࣄલ ϥΠϒϥϦ ಡΈࠐΈ ࣄલ ࣄલ ࣄલ ίϯύΠϧ ࣄલ ࣄલ ίʔυͷมߋ ෆՄ Մ Մ Մ ෆՄ άϩʔόϧঢ়ଶ ڞ༗ ڞ༗ ඇڞ༗ ඇڞ༗ ඇڞ༗ ੑೳ 3FTQPOTFTFD -
࣮ݱ͍ͨ͠Ϧιʔε੍ޚʢ̍ʣ 8FCαʔό 8FCαʔό Ϛϧνςφϯτํࣜͷαʔόશମͷ$16Ϧιʔε͕ṧഭͨ͠ঢ়ଶʹ͓͍ͯɺ ༻Ͱ͖Δ$16Ϧιʔεʹ੍ݶ͞ΕΔ͕ɺར༻Ͱ͖ΔΫϥΠΞϯτഒ ΞΫηεෆՄ ΞΫηεՄʂ ΞΫηεՄ $16ˋ༻͢Δ
ͭͷϓϩάϥϜΛॲཧ $16ˋ༻͢Δ ͭͷϓϩάϥϜΛॲཧ ఏҊख๏ ैདྷख๏ ΑΓཻͷ ࡉ੍͔͍ݶ -
NPE@NSVCZͱDHSPVQͷ࣮ "QBDIF1SPDFTT NPE@NSVCZ NSVCZ MJCNSVCZB NSVCZDHSPVQ MJCDHSPVQ -JOVYDHSPVQT •
֤ػೳ୯ମͰಈ࡞Մೳʢૄ݁߹ʣ • NPE@NSVCZ"QBDIFΛNSVCZͰ੍ޚ • NSVCZDHSPVQMJCDHSPVQΛNSVCZͰ੍ޚ • NSVCZ NSVCZDHSPVQ • 3VCZ$ίʔυͰϦιʔεΛ੍ޚՄೳ • ͜ͷϧʔϓ$16Ͱ • ͜ͷॻ͖ग़͠%*4,ॻࠐ.#TFDͰ -
Ϧιʔε੍ޚͷઃఆྫ r = Apache::Request.new if r.filename == “/path/to/cpu.cgi” cpu =
Cgroup::CPU.new “cpu_group” # CPU 10 cpu.cfs_quota_us = 10000 cpu.create cpu.attach end ݫີʹNTதNTͷ$16༻࣌ؒΛ RVPUBͱͯ͠εέδϡʔϧ͢Δઃఆ -
Ϧιʔε੍ޚͷઃఆྫ r = Apache::Request.new if r.hostname == “example.com” cpu =
Cgroup::CPU.new “cpu_group” # CPU 10 cpu.cfs_quota_us = 10000 cpu.create cpu.attach end -
Ϧιʔε੍ޚͷઃఆྫ r = Apache::Request.new if r.user== “matsumotory” cpu = Cgroup::CPU.new
“cpu_group” # CPU 10 cpu.cfs_quota_us = 10000 cpu.create cpu.attach end -
Ϧιʔε੍ޚͷઃఆྫ r = Apache::Request.new if r.method== “POST” cpu = Cgroup::CPU.new
“cpu_group” # CPU 10 cpu.cfs_quota_us = 10000 cpu.create cpu.attach end -
Ϧιʔε੍ޚͷઃఆྫ r = Apache::Request.new if r.finfo.user == 500 cpu =
Cgroup::CPU.new “cpu_group” # CPU 10 cpu.cfs_quota_us = 10000 cpu.create cpu.attach end -
Ϧιʔε੍ޚͷઃఆྫ r = Apache::Request.new if r.finfo.group == 300 cpu =
Cgroup::CPU.new “cpu_group” # CPU 10 cpu.cfs_quota_us = 10000 cpu.create cpu.attach end -
Ϧιʔε੍ޚͷઃఆྫ r = Apache::Request.new if r.finfo.size > 3000 cpu =
Cgroup::CPU.new “cpu_group” # CPU 10 cpu.cfs_quota_us = 10000 cpu.create cpu.attach end -
Ϧιʔε੍ޚͷઃఆྫ if resource.most_heavy_hosts.include? r.hostname # 1 100 1 c =
Cgroup::CPU.new "httpd-static-limited" c.cfs_quota_us = 100000 Apache::Resource.attach_cgroup c, "httpd-static-limited" elsif resource.heavy_hosts.include? r.hostname # CPU 25% 24 6 # httpd 100 ( ) c = Cgroup::CPU.new "httpd-limited" c.shares = 25 Apache::Resource.attach_cgroup c, "httpd-limited" else # CPU 75% 24 18 # httpd-limited 100 ( ) c = Cgroup::CPU.new "httpd" c.shares = 75 Apache::Resource.attach_cgroup c, "httpd" end -
ຊจʹؚ·ΕΔൃදจݙ തֶ࢜Ґจ 1 দຊ ྄հ, WebαʔόͷߴूੵϚϧνςφϯτΞʔΩςΫνϟʹؔ͢Δݚڀ, 2017 ژେ ֶେֶӃใֶݚڀՊ ത࢜จֶҐ৹ࠪެௌձ
20175݄ژେֶത࢜(ใֶ)ֶҐऔಘ, 2017 . -
ຊจʹؚ·ΕΔൃදจݙ จࢽจ 1 দຊ ྄հ, ܀ྛ ݈ଠ, Ԭ෦ णஉ, ϦΫΤετ୯ҐͰԾతʹϋʔυΣΞϦιʔεΛ͢
ΔWebαʔόͷϦιʔε੍ޚΞʔΩςΫνϟ, ใॲཧֶձจࢽ, Vol.59, No.3, pp.1016-1025, Mar 2018. 2 দຊ ྄հ, ܀ྛ ݈ଠ, Ԭ෦णஉ, WebαʔόͷߴूੵϚϧνςφϯτΞʔΩςΫνϟͱӡ༻ٕ ज़, ిࢠใ௨৴ֶձจࢽ, Vol.J101-B, No.1, pp.16-30, Jan 2018. -
ຊจʹؚ·ΕΔൃදจݙ จࢽจ 3 দຊ ྄հ, Ԭ෦ णஉ, mod_mruby: εΫϦϓτݴޠͰߴ͔ͭলϝϞϦʹ֦ுՄೳͳWebαʔ όͷػೳ֦ுࢧԉػߏ,
ใॲཧֶձจࢽɼVol.55, No.11, pp.2451-2460, Nov 2014. 4 দຊ ྄հ, Ԭ෦णஉ,εϨου୯ҐͰݖݶΛߦ͏WebαʔόͷΞΫηε੍ޚΞʔΩςΫ νϟ,ిࢠใ௨৴ֶձจࢽ Vol.J96-B, No.10, pp.1122-1130, Oct 2013. 5 দຊ ྄հ, ݪক࢘, দԬً, େنڞ༗ܕWebόʔνϟϧϗεςΟϯάج൫ͷηΩϡϦςΟ ͱӡ༻ٕज़ͷվળ, ใॲཧֶձจࢽ, Vol.54, No.3, pp.1077-1086, Mar 2013. -
ຊจʹؚ·ΕΔൃදจݙ ࠃࡍձٞൃදʢࠪಡ͖ʣ 1 Ryosuke Matsumoto, Yasuo Okabe, Access Control Architecture
Separating Privilege by a Thread on a Web Server, The 12th IEEE/IPSJ International Symposium on Applications and the Internet (SAINT2012), pp.178-183, July 2012.