Haconiwa の中身と設計思想 /the-haconiwa-internals

by KONDO Uchio

Slide 1

Slide 1 text

NSVCZͰ࡞Δ-JOVYίϯςφͷະདྷ )BDPOJXBͷத਎ͱઃܭࢥ૝ ۙ౻Ӊஐ࿕(.01FQBCP *OD ϗεςΟϯάٕज़ΧϯϑΝϨϯεˏେࡕ

Slide 2

Slide 2 text

ΤϯδχΞ ۙ౻Ӊஐ࿕!VE[VSB ٕज़ج൫νʔϜϓϦϯγύϧ IUUQVE[VSBIBUFOBCMPHKQ

Slide 3

Slide 3 text

!VE[VSB w෱Ԭ೥໨ࢯɻ౦ࡾՏग़਎ɺେֶˠब৬ͱ೥΄Ͳ౦ژͰա͢͝ wࣾ಺4&ˠ&$αʔϏε։ൃӡ༻ˠιʔγϟϧήʔϜˠϖύϘ wΞϓϦέʔγϣϯʢ3P3ओ৯ʣˠ%FW0QT  ˠγεςϜϓϩάϥϛϯάʁ wʰύʔϑΣΫτ3VCZPO3BJMTʱͳͲΛॻ͍ͨʢ͕ɺͦΖͦΖ

Slide 4

Slide 4 text

)BDPOJXBͱ͸

Slide 5

Slide 5 text

)BDPOJXBͱ͸ w-JOVYίϯςφΤϯδϯͷҰͭ w࠷ۙ੎͍͕͋Δʮ%PDLFSʯ΋ɺίϯςφΤϯδϯ wଞʹɺ-9$ɺSLUɺ0QFO7;ɺTZTUFNEOTQBXOɺͳͲ wૉૣ͘ɺখ͘͞ɺಠཱͨ͠ʮ04ͷΑ͏ͳʯ؀ڥΛͭ͘ΕΔ w7JSUVBM#PY,7.ͷΑ͏ͳԾ૝Խͱҧ͍ɺ$16౳ͷΤϛϡϨʔτ΍  04ΧʔωϧࣗମΛؚ·ͳ͍ʢͷͰɺҰൠʹܰྔɺߴ଎ʣ

Slide 6

Slide 6 text

ಛ௃

Slide 7

Slide 7 text

ओͳಛ௃ w-JOVYίϯςφΛߏ੒͢Δ༷ʑͳཁૉɾػೳʹ͍ͭͯɺ  ཉ͍͠΋ͷࣗ༝ʹ૊Έ߹ΘͤΔ͜ͱ͕Ͱ͖ΔίϯςφΤϯδϯ wͲΜͳ͜ͱ͕Ͱ͖Δ͔͸ޙड़ wͦͷ૊Έ߹ΘͤͷͨΊͷ಺෦%4-Λɺ3VCZ NSVCZ Ͱهड़Մೳ

Slide 8

Slide 8 text

)BDPOJXB͸NSVCZϓϩμΫτ w͓͔͛͞·Ͱ3VCZ,BJHJͰ΋͓࿩Λ͓ͯ͠Γ·͢ wIUUQSVCZLBJHJPSHQSFTFOUBUJPOTVE[VSBIUNM

Slide 9

Slide 9 text

ৄࡉ͸౦ژͷεϥΠυ΋ੋඇɻ wIUUQTTQFBLFSEFDLDPNVE[VSBIBDPOJXBPOUIFQBWFNFOU

Slide 10

Slide 10 text

؆୯ͳEFNP ൿ఻ͷखॱIUUQTHJTUHJUIVCDPNVE[VSBCFECEECDEDFCBBG

Slide 11

Slide 11 text

ࠓ೔͸ )BDPOJXBͷத਎ͷ࿩

Slide 12

Slide 12 text

)BDPOJXBΛࢧ͑Δ -JOVYίϯςφٕज़

Slide 13

Slide 13 text

ϗετ04͔Β؀ڥΛʮִ཭ʯ͢Δ wDISPPUSPPUϑΝΠϧγεςϜͷมߋ w-JOVYOBNFTQBDF04ͷ༷ʑͳϦιʔεར༻ͷʮ໊લۭؒʯΛมߋ  ϗετ໊ɺ*1$ͷϦιʔεɺϚ΢ϯτϙΠϯτɺ1*%ɺ

Slide 14

Slide 14 text

ϗετ04ͷϦιʔεར༻Λʮ੍ݶʯ͢Δ wSMJNJUΧʔωϧʹΑΔϓϩηε΁ͷ༷ʑͳϦιʔεར༻ͷ੍ݶ wDHSPVQϓϩηεάϧʔϓ୯ҐͰͷ$16ɺϝϞϦɺ*0ͳͲͷ੍ݶ wLFSOFMDBQBCJMJUZSPPUͷݖݶͷ෼ׂͱ੍ޚ

Slide 15

Slide 15 text

ಛʹηΩϡϦςΟʹؔΘΔػೳ wLFSOFMDBQBCJMJUZ wTFDDPNQγεςϜίʔϧຖͷݺͼग़͠ͷϑΟϧλϦϯά w"QQ"SNPS 4&-JOVY."$ ڧ੍ΞΫηε੍ޚ ͷಋೖ

Slide 16

Slide 16 text

-JOVYίϯςφ͸ جຊతʹɺ ͜ΕΒΛ૊Έ߹Θ͍ͤͯΔ

Slide 17

Slide 17 text

)BDPOJXB❤NSVCZ

Slide 18

Slide 18 text

ॳظͷ)BDPOJXB w$3VCZͰɺHFNͱͯ͠։ൃ͍ͯͨ͠ w$3VCZ͸ϚϧνεϨουͰىಈ͢Δͱ͍͏໰୊ wز͔ͭͷOBNFTQBDFؔ࿈ͷγεςϜίʔϧ͕௚઀ݺ΂ͳ͍ w$3VCZͷஈ֊Ͱ͸ɺͦΕΒͷॲཧΛ֎෦ίϚϯυ΍  γΣϧεΫϦϓτͰϥοϓͯ͠ରԠ͍ͯͨ͠ wϓϩηεϨΠΞ΢τ͕͔ͳΓෳࡶʹͳΔ

Slide 19

Slide 19 text

NSVCZͰॻ͖௚͢

Slide 20

Slide 20 text

ͳͥɺNSVCZ͔ͩͬͨ wΧʔωϧʹ͍ۙͱ͜ΖͷϓϩάϥϛϯάΛɺ$ݴޠͰ௚઀ࣗ෼ͷ΋ͷ  ʹͰ͖Δ wίϯςφܥϥΠϒϥϦɺγεςϜίʔϧΛ௚઀ݺͿ͜ͱ͕Մೳ w͔͠΋ɺͦΕΒίΞΛNSVCZͷ"1*Ͱϥοϓͯ͠͠·͑͹ɺ  γεςϜ΁ͷૢ࡞Λ3VCZͰॊೈʹهड़Ͱ͖Δ

Slide 21

Slide 21 text

ֶशίετ͸Ͳ͏͔ w޾͍ͱ͍͏͔ɺ೔ຊޠͰNSVCZΛ৮ͬͯΈͨͱ͍͏υΩϡϝϯτ͸  ൺֱత๛෋ʹଘࡏ͢Δ w$ͷ"1*ࣗମ΋ૉ௚Ͱɺ͍͔ͭ͘ϙΠϯτΛ֮͑Ε͹όϦόϦॻ͚Δ wNBUTVNPUPSZ͞Μͱ͍͏ਓ͕ྡͷ੮ʹଘࡏ͢Δ

Slide 22

Slide 22 text

)BDPOJXBͷ։ൃํ਑ w$ݴޠʴNSVCZͰίϯςφͷγεςϜίʔϧΛϥοϓ͢ΔNHFNΛ  ར༻͢Δ࡞ΔɻNHFNͰ͸খ͞ͳ͜ͱΛ͢Δ wGPSLFYFDXBJULJMM wNPVOUDISPPU wMJCDHSPVQ NSVCZDHSPVQ wMJCDBQ NSVCZDBQBCJMJUZ wVOTIBSFTFUOT DMPOF wͦΕΒΛɺ)BDPOJXBDPSFͰ͸3VCZͷίʔυͷΈͰ૊Έ߹ΘͤΔ

Slide 23

Slide 23 text

5JQTNSVCZ΋3VCZΒ͘͠ॻ͘ wྫ͑͹μοΫλΠϐϯάʴετϥςδύλʔϯͰઃܭΛ͖ͬ͢Γͱ͔

Slide 24

Slide 24 text

5JQTNSVCZDMJ ͷར༻ wੜ੒͞ΕͨςϯϓϨʔτʹԊ͑͹ɺ΄ͱΜͲ3VCZͷίʔυ͚ͩͰ  ϫϯόΠφϦͷπʔϧ͕࡞੒Մೳ wΦϓγϣϯύʔα͸ͳ͍ˠNSVCZBSHUBCMFΛࣗ࡞ wUPPMTIBDPOJXBIBDPOJXBDʹNBJO BSHD BSHW ͕͋Δ wτοϓϨϕϧͷ,FSOFM@@NBJO@@ΛݺͿ͚ͩɺγϯϓϧ IUUQTHJUIVCDPNIPOFNSVCZDMJ

Slide 25

Slide 25 text

)BDPOJXBͷల๬

Slide 26

Slide 26 text

ঝલ)BDPOJXBͷத਎ͷத਎ w-JOVYίϯςφΛ࡞ΔͨΊʹ͸ɺ༷ʑͳγεςϜίʔϧ͕ଘࡏ͢Δ wͦΕΒͷγεςϜίʔϧ͸ɺҰͭҰͭ͸ɺͱͯ΋খ͞ͳ࢓ࣄΛ͢Δ wͦͷখ͞ͳ࢓ࣄΛɺରԠ͢ΔNSVCZͷHFNͰҰ௨Γϥοϓ͢Δ  ͜ͱ͕׬͍ྃͯ͠Δɻ

Slide 27

Slide 27 text

͜ΕΒͷNHFNʹ͍ͭͯ wNHFNࣗମ͸ɺ୯ମͰ΋ར༻ग़དྷΔ wҰͭҰͭ͸ඇৗʹখ͞ͳ$ͷίʔυͰɺখ͞ͳ࢓ࣄΛ͍ͯ͠Δ wDG-JOVYͷίϚϯυ w͜ΕΒNHFNΛ૊Έ߹Θͤͯɺ3VCZʹΑΔ%4-Ͱϥοϓ͢Δͱɺ  )BDPOJXBͷίϯςφ࣮૷ʹͳΔ NSVCZTFDDPNQͷ୯ମར༻ʹ͍ͭͯ IUUQVE[VSBIBUFOBCMPHKQFOUSZ

Slide 28

Slide 28 text

ࢀߟ-JOVYίϚϯυγεςϜίʔϧ ίϚϯυ γεςϜίʔϧ NSVCZ chroot(1) chroot(2) Dir.chroot mount(8) mount(2) Mount.new.mount unshare(1) unshare(2) Namespace.unshare nsenter(1) setns(2) Namespace.setns capsh(1) cap_*(3) Capability.* (cgroupfs ͷૢ࡞) cgroup_*(3) Cgroup::*.new ...

Slide 29

Slide 29 text

DG4FSWFSTQFDTQFDJOGSB w4FSWFSTQFD͸ɺ34QFDϕʔεͷΠϯϑϥςετπʔϧͰ͋Δɻ wҰํͰɺʮαʔόʹର͢Δ৘ใऔಘ΍ૢ࡞ʯΛந৅Խͨ͠ϨΠϠʔͰ͋Δ TQFDJOGSB͕ଘࡏ͠ɺ4FSWFSTQFD͸ͦͷ্Ͱಈ࡞͢Δ wͭ·ΓɺʮTQFDJOGSBͱݴ͏ந৅ԽϨΠϠͷ্Ͱಈ͘Ұ࣮૷͕4FSWFSTQFDʯ Ͱ͋Δͱݴ͑Δ wଞʹ΋JUBNBF ͷΑ͏ͳ࣮૷ʢߏ੒؅ཧπʔϧʣ͕ग़ΔͳͲɺ  ΑΓ൚༻తʹ׆༻͞Ε͍ͯΔ ʮTFSWFSTQFDએݴతهड़Ͱαʔόͷঢ়ଶΛςετՄೳͳ൚༻ੑͷߴ͍ςετϑϨʔϜϫʔΫʯٶԼদຊɺ IUUQTHJUIVCDPNNJ[[ZTFSWFSTQFDUIFTJTQVMMJTTVFDPNNFOUIUUQTFSWFSTQFDPSH IUUQJUBNBFLJUDIFO

Slide 30

Slide 30 text

4FSWFSTQFDTQFDJOGSB ͷΑ͏ͳந৅ԽϨΠϠΛ )BDPOJXBʹ΋ఆٛՄೳͳ͸ͣ

Slide 31

Slide 31 text

ఆٛͰ͖Δͱ Կ͕خ͍͔͠ʁ

Slide 32

Slide 32 text

ॊೈͳίϯςφ࠶ߟ w)BDPOJXBͰ࣮ݱͰ͖Δॊೈ͞ͷྫ ɿ wϓϩάϥϜʹΑΔϦιʔεͷׂΓ౰ͯͷ੍ޚʢFHDHSPVQʣ wఀࢭϑοΫɺγάφϧड৴࣌ͷϑοΫͷఆٛ wΠϝʔδ࡞੒खॱͷNSVCZʹΑΔࣗ༝౓ͷߴ͍هड़ wෆཁͳίϯςφػೳΛແޮԽͰ͖Δ͜ͱͰͷߴूੵԽ ʮ)BDPOJXBͷ͜Ε·Ͱͱ͜Ε͔Βʯۙ౻ɺ

Slide 33

Slide 33 text

ෳࡶԽɾଟ༷Խ͢Δ ӡ༻ཁ݅Λ %4-ʹΑΔ੍ޚͰରॲ͢Δ

Slide 34

Slide 34 text

ίϯςφ͸εϨουతʹ "1*Λ௨ͯࣗ͠ࡏʹ ίϯτϩʔϧͰ͖Δ

Slide 35

Slide 35 text

'BTU$POUBJOFS%"04 w%"04 %JNFOTJPOGSFF"VUPOPNPVT0QFSBUJOH4ZTUFN   ͷఏҊ͕͋Δ wίϯςφΛҰͭͷੜଘظؒͷ۠੾ΒΕͨεϨουͱଊ͑௚͢  %"04ͷ༻ޠͰ͍͏ͱ.PSUBMͰ͋Δͱଊ͑Δ wͦͷ৔߹ɺ΋͠)BDPOJXB JOUFSOBM"1* Ͱ࣮ݱ͍ͯ͠Δ  ந৅ԽϨΠϠ͕ଘࡏ͢ΔͳΒɺ  ͦΕ͸γεςϜίʔϧʹ૬౰͢Δͱݴ͑ΔͰ͋Ζ͏ ʮ'BTU$POUBJOFSΞʔΩςΫνϟ֓࿦ʯদຊɺ

Slide 36

Slide 36 text

ίϯςφ૚ )BDPOJXB૚ ϗετ૚

Slide 37

Slide 37 text

%"04)BDPOJXBJOUFSOBM"1* Λϕʔεͱͨ͠ ৽͍͠ελοΫͷఏҊ

Slide 38

Slide 38 text

%"04ʹ͍ͭͯ͸ɺ !NBUTVNPUPSZͷൃදͰʂ

Slide 39

Slide 39 text

·ͱΊͱࠓޙ

Slide 40

Slide 40 text

)BDPOJXBͰͰ͖Δ͜ͱ w͜͜·Ͱʹݟ͖ͯͨΑ͏ͳ-JOVYͷίϯςφ࡞੒ͷͨΊͷػೳΛɺ  ॊೈʹ૊Έ߹Θͤɺಈతʹ੍ޚͰ͖ΔΑ͏ʹͳͬͨɻ wྫ͑͹ϗετͷϦιʔεΛϓϩάϥϚϒϧʹࡉ੍͔͘ޚ͢Δ wྫ͑͹Πϝʔδ΍SPPUGTͷߏ੒Λॊೈʹมߋ͢Δ wίϯςφΛߴ଎ʹىಈͨ͠Γɺಈతʹ࡟আͨ͠Γ͢Δ

Slide 41

Slide 41 text

)BDPOJX-JOVYTZTDBMMNSVCZHFN wίϯςφΤϯδϯͱͯ͠ͷ)BDPOJXB͸ɺͨ͘͞ΜͷNSVCZHFNΛ ૊Έ߹Θͤͨந৅ԽϨΠϠͷ্Ͱಈ࡞͍ͯ͠ΔͱΈͳͤΔ wͦΕͧΕͷNSVCZHFN͸ɺ-JOVYͷγεςϜίʔϧΛݺͼग़͢ wΤϯδϯͱ-JOVY,FSOFMͱͷؒͷΠϯλϑΣʔεతͳJOUFSOBM"1*Λ  ૝ఆՄೳͰɺͦΕ͸4FSWFSTQFDTQFDJOGSBͷରԠʹࣅ͍ͯΔ

Slide 42

Slide 42 text

)BDPOJXBͱ'BTU$POUBJOFS%"04 w'BTU$POUBJOFSߏ૝ʹΑΓɺ%"04ɺ.PSUBM͕ఏҊ͞Εͨ wͦΕΒͱ)BDPOJXB)BDPOJXBJOUFSOBMͷؔ܎͸ɺ  ͪΐ͏Ͳ04εϨουγεςϜίʔϧͷΑ͏ͳؔ܎ʹͳΔ w͜ΕΒٕज़ʹΑΔ৽͍͠ελοΫΛզʑ͸ఏҊ͍ͨ͠

Slide 43

Slide 43 text

ࠓޙ)BDPOJXBͰ࣮ݱ͍ͨ͜͠ͱ w'BTU$POUBJOFS ߏ૝ʹରԠ͢Δػೳͷ֦ॆ w$3*6ͱͷ࿈ܞڧԽ wϑοΫॲཧͷ֦ॆɺ%4-ͷػೳ௥Ճ wωοτϫʔΫΛ௨ͨ͠%4-ͷ࣮ߦ wΑΓଟ͘ͷίϯςφػೳ΁ͷରԠ w)BDPOJXBͷதؒ૚ʢγεςϜίʔϧ૬౰ʣͷൈ͖ग़͠ͱந৅Խ IUUQICNBUTVNPUPSKQFOUSZ IUUQTDSJVPSH.BJO@1BHF

Slide 44

Slide 44 text

͜ΕΒͷٕज़Λ༻͍ͨɺ ࠓ·Ͱʹͳ͍Α͏ͳ ϗεςΟϯάͷαʔϏεΛ ΍Γ͍ͨɻ

Slide 45

Slide 45 text

஥ؒ ืू

Slide 46

Slide 46 text

৽͍ٕ͠ज़Ͱɺ৽͍͠αʔϏεΛɻ  ϖύϘͳΒͰ͖Δ ࠷৽ͷ࠾༻৘ใΛνΣοΫˠ !QC@SFDSVJU

Slide 47

Slide 47 text

ར༻ը૾ʹ͍ͭͯ wεϥΠυͷഎܠը૾IUUQTIPXDBTFDJUZGVLVPLBMHKQ w ʮར༻্ͷ஫ҙʯʹԊͬͯར༻͍ͯ͠·͢ɻը૾ͷஶ࡞ݖ͸෱Ԭࢢʹؼଐ͠·͢ɻ