$30 off During Our Annual Pro Sale. View Details »

Inside Docker

Inside Docker

A small overview of virtualization technics and their schemes of work, as well as the internal structure of Docker (LXC plus AUFS)

Anton Kaliaev

January 30, 2014
Tweet

More Decks by Anton Kaliaev

Other Decks in Programming

Transcript

  1. Inside Docker

  2. OMG! Why VirtualBox is so slow?

  3. Virtualization

  4. Full Virtualization Software-based Paravirtualization

  5. Full x86 Virtualization Software-based Hardware assisted Paravirtualization

  6. Full x86 Virtualization Operating system- level Software-based Hardware assisted Paravirtualization

  7. 3 key aspects CPU virtualization Memory virtualization Device and IO

    virtualization
  8. Privilege rings for the x86 available in protected mode Ring

    0 - “Kernel” 4 rings
  9. User Apps Ring 3 Ring 2 Guest OS Ring 1

    VMM Ring 0 Hardware Binary translation Full virtualization using Binary translation
  10. User Apps Ring 3 Ring 2 Ring 1 Paravirtualized Guest

    OS Ring 0 Hardware Replacing non-virtualizable OS-instructions Paravirtualization Virtualization Layer
  11. User Apps Ring 3 Ring 2 Ring 1 Guest OS

    Ring 0 Hardware x86 VMM Root mode privilege levels Non-root mode privilege levels
  12. To summarize VBox ‣ Emulates IO/Hardware devices, BIOS ‣ Use

    binary translation ‣ Work hard in MMU (shadowing pages table, updating TLB)
  13. AUFS LXC

  14. AUFS LXC Linux Containers

  15. ‣ Kernel namespaces (ipc, uts, mount, pid, network and user)

    ‣ AppArmor and SELinux profiles ‣ Seccomp policies ‣ Chroots (using pivot_root) ‣ Kernel capabilities ‣ Control groups (cgroups)
  16. Linux namespaces user utc ipc net mnt pid Process

  17. Cgroups Resource limiting CPU Memory IO cpu.shares cpuset.cpus memory.limit_in_bytes blkio.throttle.

    {read,write}. {iops,bps}.device blkio.weight memory.stat cpuacct.stat Accounting Isolation
  18. ‣ The liblxc library ‣ Several language bindings (python3, lua

    and Go) ‣ A set of standard tools to control the containers ‣ Container templates Parts
  19. ‣ all containers uses the same kernel ‣ thus requires

    less resources ‣ and more lightweight ‣ takes seconds to start (fast) Pros ‣ not so isolated Cons
  20. AUFS LXC

  21. AUFS Layered Filesystem

  22. AUFS Branch 1 Branch 2 f1 f1 f2 f2 f3

    f3 f3 d1 f4 f5 d1 f4 d1 f5 f6 f6 f6 Copy on Write Write Read
  23. Read AUFS Branch 1 Branch 2 f6 f6 f6 Delete

    f6 Whiteout f6
  24. ‣ storage savings ‣ faster deployments ‣ better memory usage

    ‣ easier upgrades ‣ allows arbitrary changes (root filesystem is still writeable) Pros ‣ not so active development Cons
  25. Resources 1. VMware “Understanding Full Virtualization, Paravirtualization, andHardware Assist” http://www.vmware.com/files/pdf/

    VMware_paravirtualization.pdf 2. Namespaces in operation, part 1: namespaces overview https://lwn.net/ Articles/531114/ 3. PaaS Under the Hood http://blog.dotcloud.com/ 4. Lightweight Virtualization by Jérôme Petazzoni http:// www.socallinuxexpo.org/sites/default/files/presentations/Jerome- Scale11x%20LXC%20Talk.pdf 5. The File system http://www.tldp.org/LDP/tlk/fs/filesystem.html