Linux コンテナの基礎 / 9th CTStudy

Slide 1

Slide 1 text

Linuxίϯςφͷجૅ ୈ 9 ճ ίϯςφܕԾ૝Խͷ৘ใަ׵ձˏ෱Ԭ Ճ౻ହจ 2016-04-23 Ճ౻ହจ ୈ 9 ճ ίϯςφܕԾ૝Խͷ৘ใަ׵ձˏ෱Ԭ 2016-04-23 1 / 48

Slide 2

Slide 2 text

ࣗݾ঺հ Ճ౻ହจ http://www.ten-forward.ws/ @ten forward http://gplus.to/tenforward https://github.com/tenforward http://d.hatena.ne.jp/deﬁant/ (ٕज़ϒϩά) Ճ౻ହจ ୈ 9 ճ ίϯςφܕԾ૝Խͷ৘ใަ׵ձˏ෱Ԭ 2016-04-23 2 / 48

Slide 3

Slide 3 text

ࣗݾ঺հ ϑΝʔεταʔόɹج൫։ൃ෦ɹॴଐ Ճ౻ହจ ୈ 9 ճ ίϯςφܕԾ૝Խͷ৘ใަ׵ձˏ෱Ԭ 2016-04-23 3 / 48

Slide 4

Slide 4 text

ࣗݾ঺հ Plamo Linux ϝϯςφ LXC ͰֶͿίϯςφೖ໳ɹʔܰྔԾ૝Խ؀ڥΛ࣮ݱ͢Δٕज़ gihyo.jp Ͱ࿈ࡌ Ճ౻ହจ ୈ 9 ճ ίϯςφܕԾ૝Խͷ৘ใަ׵ձˏ෱Ԭ 2016-04-23 4 / 48

Slide 5

Slide 5 text

ࣗݾ঺հ LXC/LXD ͷ։ൃʹগ͠ࢀՃ man page ͷ೔ຊޠ༁ ެࣜϖʔδ (linuxcontainers.org) ຋༁ όάϑΟοΫεͳͲগ͚ͩ͠ίʔυʹ΋ߩݙ LXD ೔ຊޠϝοηʔδ Ճ౻ହจ ୈ 9 ճ ίϯςφܕԾ૝Խͷ৘ใަ׵ձˏ෱Ԭ 2016-04-23 5 / 48

Slide 6

Slide 6 text

ࠓ೔ͷ໨ඪ ίϯςφͷ֓ཁΛཧղ͢Δ Linux Χʔωϧ͕࣋ͭίϯςφΛߏ੒͢ΔͨΊͷओཁͳػೳ Λ֮͑Δ Ճ౻ହจ ୈ 9 ճ ίϯςφܕԾ૝Խͷ৘ใަ׵ձˏ෱Ԭ 2016-04-23 6 / 48

Slide 7

Slide 7 text

ࠓ೔ͷ಺༰ ίϯςφͷ֓ཁ Linux ʹ͓͚Δίϯςφͷ࢓૊Έ Namespace σϞ cgroup σϞ ·ͱΊ Ճ౻ହจ ୈ 9 ճ ίϯςφܕԾ૝Խͷ৘ใަ׵ձˏ෱Ԭ 2016-04-23 7 / 48

Slide 8

Slide 8 text

ίϯςφ֓ཁ Ճ౻ହจ ୈ 9 ճ ίϯςφܕԾ૝Խͷ৘ใަ׵ձˏ෱Ԭ 2016-04-23 8 / 48

Slide 9

Slide 9 text

ίϯςφͱ͸ ΧʔωϧͷػೳͰ ִ཭͞ΕۭͨؒͰϓϩηεΛ࣮ߦ͢Δ ϓϩηεʹରͯ͠Ϧιʔε੍ݶΛઃఆ͢Δ Ճ౻ହจ ୈ 9 ճ ίϯςφܕԾ૝Խͷ৘ใަ׵ձˏ෱Ԭ 2016-04-23 9 / 48

Slide 10

Slide 10 text

ίϯςφͱ͸ Χʔωϧ͔ΒݟΔͱී௨ʹϓϩηε͕ىಈ͢Δ͚ͩ ىಈ͢Δࡍʹִ཭Λࢦࣔ͢Δ ΧʔωϧͷػೳͰ (ෳ਺ͷ) ಠཱۭͨؒ͠Λ࡞Γग़͠ɼϦιʔ εΛ෼ׂɾ෼഑͢Δ ϓϩηεΛάϧʔϓԽͯ͠ଞͷάϧʔϓͱϦιʔεۭؒΛִ཭ άϧʔϓԽͨ͠ϓϩηεʹର͢ΔϦιʔε੍ݶ Ծ૝Խͱ͍͏ΑΓʮִ཭Խʯͱݴͬͨ΄͏͕Θ͔Γ΍͍͔͢΋ Ծ૝తͳίϯϐϡʔλɾγεςϜΛ࠶ݱ͢ΔԾ૝Ϛγϯʹର ͯ͠ɺԾ૝తͳ OS ؀ڥΛఏڙ͢Δ ˠ OS ϨϕϧͷԾ૝Խ Ճ౻ହจ ୈ 9 ճ ίϯςφܕԾ૝Խͷ৘ใަ׵ձˏ෱Ԭ 2016-04-23 10 / 48

Slide 11

Slide 11 text

ίϯςφͷϝϦοτ ߴີ౓Խ͕Մೳ ىಈ͍ͯ͠Δ OS (Χʔωϧ) ͸Ұͭ Φʔόʔϔου͕খ͍͞ ϋʔυ΢ΣΞͷԾ૝Խ͕ෆཁ ىಈ͕ૣ͍ Ծ૝ϚγϯͷىಈͰ͸ͳ͘ɼϗετ OS ͔ΒݟͨΒ୯ʹϓϩ ηε͕ىಈ͍ͯ͠Δ͚ͩͳͷͰɼී௨ͷϓϩάϥϜ͕ىಈ͢Δ ͷͱ΄ͱΜͲมΘΒͳ͍ ඞͣ͠΋γεςϜΛಈ͔͢ඞཁ͸ͳ͍ (ΞϓϦέʔγϣϯί ϯςφ) ྫ͑͹ίϯςφ಺Ͱ͸ httpd ͷΈ͕ಈ͍͍ͯΔ ίϯςφʹϝϞϦΛݻఆతʹׂΓ౰ͯΔඞཁ͕ͳ͍ Ճ౻ହจ ୈ 9 ճ ίϯςφܕԾ૝Խͷ৘ใަ׵ձˏ෱Ԭ 2016-04-23 11 / 48

Slide 12

Slide 12 text

ίϯςφͷσϝϦοτ ҟͳΔ OS ͷγεςϜ / ϓϩάϥϜ͸ಈ͔ͤͳ͍ ୯ʹϗετ OS ্Ͱϓϩηε͕ىಈ͢Δ͚ͩͳͷͰ౰ͨΓલ ΧʔωϧʹؔΘΔૢ࡞͸Ͱ͖ͳ͍ ىಈ͍ͯ͠ΔΧʔωϧ͸มΘΒͳ͍ͷͰ ίϯςφຖʹϩʔυ͢ΔϞδϡʔϧΛม͑ΔͳͲ Χʔωϧͷ࣮૷͸ෳࡶʹͳΔ શͯΧʔωϧͷػೳͱ࣮ͯ͠૷͞Ε͍ͯΔͷͰ Ճ౻ହจ ୈ 9 ճ ίϯςφܕԾ૝Խͷ৘ใަ׵ձˏ෱Ԭ 2016-04-23 12 / 48

Slide 13

Slide 13 text

ࠓ೔ͷ಺༰ ίϯςφͷ֓ཁ Linux ʹ͓͚Δίϯςφͷ࢓૊Έ Namespace σϞ cgroup σϞ ·ͱΊ Ճ౻ହจ ୈ 9 ճ ίϯςφܕԾ૝Խͷ৘ใަ׵ձˏ෱Ԭ 2016-04-23 13 / 48

Slide 14

Slide 14 text

Linuxʹ͓͚Δίϯςφͷ࢓ ૊Έ Ճ౻ହจ ୈ 9 ճ ίϯςφܕԾ૝Խͷ৘ใަ׵ձˏ෱Ԭ 2016-04-23 14 / 48

Slide 15

Slide 15 text

Linuxʹ͓͚Δίϯςφ͸Χʔωϧʹʰίϯ ςφʱͱ͍͏୯Ұͷػೳ͕࣮૷͞Ε࣮ͯݱ͠ ͍ͯΔΘ͚Ͱ͸͋Γ·ͤΜ Ճ౻ହจ ୈ 9 ճ ίϯςφܕԾ૝Խͷ৘ใަ׵ձˏ෱Ԭ 2016-04-23 15 / 48

Slide 16

Slide 16 text

Linux ͰίϯςφΛ࣮ݱ͢ΔͨΊͷػೳ Linux Χʔωϧʹؚ·ΕΔ৭ʑͳػೳΛ૊Έ߹Θͤͯίϯςφ؀ ڥΛ࡞੒͢ΔɻͦΕͧΕͷػೳ͸ίϯςφઐ༻ͷػೳͱ͍͏Θ͚ Ͱ͸ͳ͍ɻ ϓϩηεΛάϧʔϓԽͯ͠ଞͷάϧʔϓͱִ཭ OS Ϧιʔεͷִ཭ ˠ Namespace (໊લۭؒ) άϧʔϓԽͨ͠ϓϩηεʹର͢ΔϦιʔε੍ݶ ϗετͷ෺ཧϦιʔεʹର͢Δ੍ݶ ˠ cgroup (control group) Ճ౻ହจ ୈ 9 ճ ίϯςφܕԾ૝Խͷ৘ใަ׵ձˏ෱Ԭ 2016-04-23 16 / 48

Slide 17

Slide 17 text

LinuxͰίϯςφΛ࣮ݱ͢ΔͨΊͷػೳ ͦͷଞ ωοτϫʔΫ (veth, macvlan ͳͲ) έʔύϏϦςΟ chroot (pivot root) bind mount Checkpoint/Restore (CRIU) ͳͲͳͲ Ճ౻ହจ ୈ 9 ճ ίϯςφܕԾ૝Խͷ৘ใަ׵ձˏ෱Ԭ 2016-04-23 17 / 48

Slide 18

Slide 18 text

Linuxͷίϯςφ࣮૷ྫ Docker ΞϓϦέʔγϣϯίϯςφͷ࣮ߦʹಛԽɻίϯςφؔ࿈ͷॲཧ͸ runC ϓ ϩδΣΫτ಺ͷ libcontainer Λ࢖༻ɻ LXC/LXD Ubuntu Λத৺ʹ։ൃɻओʹγεςϜίϯςφΛ࣮ߦ͢Δ͜ͱΛલఏʹ࡞ ΒΕ͍ͯΔ͕ɺΞϓϦέʔγϣϯίϯςφͷ࣮ߦ΋Մೳɻඇಛݖίϯςφ ͕࣮ߦͰ͖Δɻ OpenVZ Linux ͷίϯςφ࣮૷ͱͯ͠͸ݹ͔͘Β͋Δ࣮૷ͷͻͱͭɻ2000 ೥͝Ζ ͔ΒɻΧʔωϧʹύονΛద༻͢ΔɻΧʔωϧʹ࣮૷͞Ε͍ͯΔίϯςφ ؔ࿈ػೳ͸ OpenVZ ༝དྷͷػೳ͕ଟ਺͋ΔɻOpenVZ Λϕʔεʹͨ͠঎ ༻൛ Virtuozzo ͕ଘࡏ͢Δɻ Ճ౻ହจ ୈ 9 ճ ίϯςφܕԾ૝Խͷ৘ใަ׵ձˏ෱Ԭ 2016-04-23 18 / 48

Slide 19

Slide 19 text

Linuxͷίϯςφ࣮૷ྫ rkt CoreOS ͕ࣾ։ൃ͢ΔΞϓϦέʔγϣϯίϯςφͷϥϯλΠϜɻ systemd ͝ଘ஌ Linux ޲͚ͷ࠷ۙओྲྀͱͳͬͨ init ࣮૷ͷͻͱͭɻίϯςφΛѻ͏ ίϚϯυ΍࢓૊Έ΋಺แ͍ͯ͠Δ MINCS γΣϧεΫϦϓτͰॻ͔Εͨίϯςφ࣮૷ runC (libcontainer) Docker ʹΑΔ Open Container Project ४ڌͷ࣮૷ Ճ౻ହจ ୈ 9 ճ ίϯςφܕԾ૝Խͷ৘ใަ׵ձˏ෱Ԭ 2016-04-23 19 / 48

Slide 20

Slide 20 text

ࠓ೔ͷ಺༰ ίϯςφͷ֓ཁ Linux ʹ͓͚Δίϯςφͷ࢓૊Έ Namespace σϞ cgroup σϞ ·ͱΊ Ճ౻ହจ ୈ 9 ճ ίϯςφܕԾ૝Խͷ৘ใަ׵ձˏ෱Ԭ 2016-04-23 20 / 48

Slide 21

Slide 21 text

Linuxʹ͓͚Δίϯςφͷ࢓૊Έ Namespace Ճ౻ହจ ୈ 9 ճ ίϯςφܕԾ૝Խͷ৘ใަ׵ձˏ෱Ԭ 2016-04-23 21 / 48

Slide 22

Slide 22 text

Namespace(໊લۭؒ) ִ཭͍ͨ͠ OS Ϧιʔε͝ͱʹ Namespace ͕४උ͞ΕΔ Ұ෦ͷ Namespace ͚ͩ࢖༻ִͯ͠཭؀ڥΛ࡞Δ͜ͱ͕Ͱ͖Δ Ճ౻ହจ ୈ 9 ճ ίϯςφܕԾ૝Խͷ৘ใަ׵ձˏ෱Ԭ 2016-04-23 22 / 48

Slide 23

Slide 23 text

Namespace ͷछྨ (1) Mount Namespace: 2.4.19 ϓϩηε͔Βݟ͍͑ͯΔϚ΢ϯτͷू߹ɼૢ࡞Λ෼཭͢Δɽ Namespace ಺ͷ mount, umount ͕ଞͷ Namespace ʹӨڹ Λ༩͑ͳ͍Α͏ʹͰ͖Δ (༩͑ΔΑ͏ʹ΋Ͱ͖Δ) ˠ private/shared/slave (ࢀߟ) Ϛ΢ϯτ໊લۭؒΛద༻͢Δ (IBM developerWorks) (ࢀߟ) Χʔωϧෟଐจॻ (Documentation/ﬁlesystems/sharedsubtree.txt) (ࢀߟ) σϑΥϧτ͸ private ͕ͩɺsystemd ͸/Λ shared ͰϚ ΢ϯτ͢Δ UTS Namespace: 2.6.19 ϗετ໊ͳͲɼuname(2) ͕ฦ͢஋ͷू߹Λ෼཭ɽ setdomainname(2), sethostname(2) Ͱ Namespace ಺ͷ஋ ͷΈมߋͰ͖Δ Ճ౻ହจ ୈ 9 ճ ίϯςφܕԾ૝Խͷ৘ใަ׵ձˏ෱Ԭ 2016-04-23 23 / 48

Slide 24

Slide 24 text

Namespace ͷछྨ (2) PID Namespace: 2.6.24 PID ۭؒͷ෼཭ɽ৽͍͠ PID Namespace Ͱ͸ PID 1 ͔Β࢝ ·Δ PID ׂ͕Γ౰ͯΒΕΔɽ਌͔Βࢠͷ PID Namespace ͸ ݟ͑Δ (਌ͷۭؒͷ PID Λ࣋ͭ) ͕ɼࢠ͔Β਌͸ݟ͑ͳ͍ IPC Namespace: 2.6.19 SysV IPC ΦϒδΣΫτɼPOSIX ϝοηʔδΩϡʔͷִ཭ User Namespace: 2.6.23 ˜ 3.8 ಠཱͨ͠ UID/GID ۭؒͱ֎෦ۭؒͷϚοϐϯά (ྫ͑͹ɼִ ཭ۭؒͰ͸ uid/gid 0/0ɼ֎෦Ͱ͸ 1000/1000 ͱ͔Մೳʹ ͳΔ) Network Namespace: 2.6.26 ωοτϫʔΫϦιʔεͷִ཭ɽωοτϫʔΫσόΠεɼΞυϨ εɼϧʔςΟϯάςʔϒϧɼιέοτɼϑΟϧλϦϯά Ճ౻ହจ ୈ 9 ճ ίϯςφܕԾ૝Խͷ৘ใަ׵ձˏ෱Ԭ 2016-04-23 24 / 48

Slide 25

Slide 25 text

Namespaceͷछྨ(3) cgroup Namespace: 4.6 cgroup ͷִ཭ /proc/$PID/cgroup ϑΝΠϧ಺ͷ cgroup ύε namespace ಺ͰϚ΢ϯτͨ͠ cgroupfs πϦʔ (͜ͷ Namespace Ͱ clone(2) ʹ༩͑Δϑϥά (32bit ੔਺) Λ࢖͍͖Γ·ͨ͠ :-) Ճ౻ହจ ୈ 9 ճ ίϯςφܕԾ૝Խͷ৘ใަ׵ձˏ෱Ԭ 2016-04-23 25 / 48

Slide 26

Slide 26 text

Namespaceৄࡉ Namespace ͷΧʔωϧ಺෦ͷ࣮૷ʹ͍ͭͯ͸ʮୈ 8 ճ ίϯςφ ܕԾ૝Խͷ৘ใަ׵ձˏ౦ژʯͰͷ Masami Ichikawa ͞Μͷ Linux Namespaces ͕ৄ͍͠Ͱ͢ (ಈը) Ճ౻ହจ ୈ 9 ճ ίϯςφܕԾ૝Խͷ৘ใަ׵ձˏ෱Ԭ 2016-04-23 26 / 48

Slide 27

Slide 27 text

ͦͷଞͷNamespace աڈʹఏҊ͞Ε͍ͯͨ΋ͷ Log Namespace Device Namespace Ճ౻ହจ ୈ 9 ճ ίϯςφܕԾ૝Խͷ৘ใަ׵ձˏ෱Ԭ 2016-04-23 27 / 48

Slide 28

Slide 28 text

Namespace ͷૢ࡞ (γεςϜίʔϧ) clone(2) Ͱ৽͍͠ϓϩηε Λੜ੒ unshare(2) Ͱ৽͍͠ϓϩηεΛੜ੒ͤͣʹ࣮ߦίϯςΩετ Λ੍ޚ͢Δ setns(2) ͰϓϩηεΛطଘ ͷ Namespace ʹؔ࿈෇͚Δ Ճ౻ହจ ୈ 9 ճ ίϯςφܕԾ૝Խͷ৘ใަ׵ձˏ෱Ԭ 2016-04-23 28 / 48

Slide 29

Slide 29 text

NamespaceσϞ(1) Mount + PID + UTS + Net Namespace Λಉ࣌ʹ࡞੒͠ ͯγΣϧΛىಈͤ͞Δ ஫໨఺ɿNamespace ಺ͱϗετ্ͰҎԼ͕ҟͳΔ͜ͱ Ϛ΢ϯτͷ৘ใ (Namespace ಺ͷϚ΢ϯτ͕ϗετ্Ͱ͸ݟ ͑ͳ͍) ϓϩηεͷ৘ใ (PID 1 ͰγΣϧ͕ىಈ͍ͯ͠Δɺϗετ্ͷ ϓϩηε͸ݟ͑ͳ͍) ωοτϫʔΫΠϯλʔϑΣʔε (ϗετͱҟͳΓϧʔϓόοΫ Ҏ֎ʹଘࡏ͠ͳ͍) ϗετ໊ (Namespace ಺Ͱมߋͯ͠΋ϗετ্ͷϗετ໊͸ มΘΒͳ͍) Ճ౻ହจ ୈ 9 ճ ίϯςφܕԾ૝Խͷ৘ใަ׵ձˏ෱Ԭ 2016-04-23 29 / 48

Slide 30

Slide 30 text

NamespaceσϞ(1) Mount + PID + UTS + Net Namespace $ sudo unshare --pid --mount --uts --net --mount-proc --fork \ > -- /bin/bash (PID, Mount Namespace Λࢦఆͯ͠ unshre ࣮ߦ) # mount --make-private / (/ Λ private ʹ) # mount -o bind /usr /mnt (bind mount Λ࣮ߦ) # ps aux (ᶃϓϩηεҰཡ) # cat /proc/1/mountinfo (ᶄ/ ͱ /mnt ͷϚ΢ϯτͷ༷ࢠΛ֬ೝ) # ip a (ᶅωοτϫʔΫΠϯλʔϑΣʔεͷ༷ࢠΛ֬ೝ) # hostname hogehoge (ϗετ໊Λมߋ) # hostname (ᶆϗετ໊ͷ֬ೝ) ผͷγΣϧͰ $ ps aux (ᶃϓϩηεҰཡ) $ cat /proc/1/mountinfo (ᶄ/ ͱ /mnt ͷϚ΢ϯτͷ༷ࢠΛ֬ೝ) $ ip a (ᶅωοτϫʔΫΠϯλʔϑΣʔεͷ༷ࢠΛ֬ೝ) $ hostname (ᶆϗετ໊ͷ֬ೝ) Ճ౻ହจ ୈ 9 ճ ίϯςφܕԾ૝Խͷ৘ใަ׵ձˏ෱Ԭ 2016-04-23 30 / 48

Slide 31

Slide 31 text

NamespaceσϞ(2) User Namespace Λ࡞੒ͯ͠γΣϧΛىಈ͢Δ ஫໨఺ɿ ҰൠϢʔβ͕ Namespace Λ࡞੒Ͱ͖Δ͜ͱ Namespace ಺ͱϗετ্ͰγΣϧͷ࣮ޮϢʔβɾάϧʔϓ͕ ҟͳΔ͜ͱ Namespace ಺Ͱ࡞੒ͨ͠ϑΝΠϧͷɺNamespace ಺Ͱݟͨ Φʔφʔͱɺϗετ্ͰݟͨΦʔφʔ͕ҟͳΔ͜ͱ Ճ౻ହจ ୈ 9 ճ ίϯςφܕԾ૝Խͷ৘ใަ׵ձˏ෱Ԭ 2016-04-23 31 / 48

Slide 32

Slide 32 text

NamespaceσϞ(2) User Namespace $ unshare -U --map-root-user -- /bin/bash (User Namespace Λ࡞੒ɻݱϢʔβΛ Namespace ಺ͷ root ʹϚοϐϯά) # echo $$ # grep ’[U|G]id’ /proc/1082/status (ᶃϓϩηεͷ࣮ޮ ID ͷ֬ೝ) # touch /tmp/testfile # ls -l /tmp/testfile (ᶄϑΝΠϧͷΦʔφʔͷ֬ೝ) ผγΣϧͰ $ grep ’[U|G]id’ /proc/1082/status (ᶃϓϩηεͷ࣮ޮ ID ͷ֬ೝ) $ ls -l /tmp/testfile (ᶄϑΝΠϧͷΦʔφʔͷ֬ೝ) Ճ౻ହจ ୈ 9 ճ ίϯςφܕԾ૝Խͷ৘ใަ׵ձˏ෱Ԭ 2016-04-23 32 / 48

Slide 33

Slide 33 text

ࠓ೔ͷ಺༰ ίϯςφͷ֓ཁ Linux ʹ͓͚Δίϯςφͷ࢓૊Έ Namespace σϞ cgroup σϞ ·ͱΊ Ճ౻ହจ ୈ 9 ճ ίϯςφܕԾ૝Խͷ৘ใަ׵ձˏ෱Ԭ 2016-04-23 33 / 48

Slide 34

Slide 34 text

Linuxʹ͓͚Δίϯςφͷ࢓૊Έ cgroup Ճ౻ହจ ୈ 9 ճ ίϯςφܕԾ૝Խͷ৘ใަ׵ձˏ෱Ԭ 2016-04-23 34 / 48

Slide 35

Slide 35 text

cgroupͱ͸ ϓϩηεΛάϧʔϓԽ͠ɺάϧʔϓʹରͯ͠Ϧιʔε੍ݶΛߦ͏ɻ ίϯςφઐ༻ͷ࢓૊ΈͰ͸ͳ͍ɻ cgroup ͷಛ௃ ػೳ͝ͱʹαϒγεςϜʹ෼͔ΕΔ cgroupfs ΛϚ΢ϯτͯ͠σΟϨΫτϦͰάϧʔϓΛද͢ ϓϩηεΛάϧʔϓ಺ͷ tasks ϑΝΠϧʹ௥Ճ͢Δͱؔ࿈͢Δ λεΫ͕εϨου୯ҐͰάϧʔϓʹ௥Ճ͞ΕΔ ෳ਺֊૚ߏ଄ɻվ଄ߏ଄͝ͱʹҟͳΔπϦʔΛ࡞੒Ͱ͖Δɻͨ ͩ͠ɺҰͭͷαϒγεςϜ͕ॴଐͰ͖ΔπϦʔ͸Ұͭ πϦʔͷͲͷϨϕϧͷάϧʔϓʹ΋λεΫ͕ॴଐͰ͖Δ Ճ౻ହจ ୈ 9 ճ ίϯςφܕԾ૝Խͷ৘ใަ׵ձˏ෱Ԭ 2016-04-23 35 / 48

Slide 36

Slide 36 text

cgroupͷ֊૚ߏ଄ Ճ౻ହจ ୈ 9 ճ ίϯςφܕԾ૝Խͷ৘ใަ׵ձˏ෱Ԭ 2016-04-23 36 / 48

Slide 37

Slide 37 text

cgroupͷαϒγεςϜ cpu: 2.6.24 CFS(Completely Fair Scheduler) bandwidth controlɽ୯Ґ ࣌ؒ಺ͷάϧʔϓ಺ͷλεΫ͕࣮ߦͰ͖Δ߹ܭ࣌ؒΛ੍ݶ͢Δ (3.2 Ͱ࣮૷) ૬ର഑෼ɽάϧʔϓؒͷ CPU ࣌ؒͷׂ౰ͷׂ߹Λࢦఆ͢Δɽ ྫ͑͹ GroupA=100,GroupB=50 ͱ͢Δͱ A:B=2:1 cpuacct: 2.6.24 άϧʔϓ಺ͷ CPU ϦιʔεͷϨϙʔτ (CPU ࣌ؒ) cpuset: 2.6.24 ׂΓ౰ͯΔ CPU, ϝϞϦϊʔυͷׂ౰ Ճ౻ହจ ୈ 9 ճ ίϯςφܕԾ૝Խͷ৘ใަ׵ձˏ෱Ԭ 2016-04-23 37 / 48

Slide 38

Slide 38 text

cgroupͷαϒγεςϜ device: 2.6.26 σόΠε΁ͷΞΫηεڐՄɼ੍ݶͷࢦఆ freezer: 2.6.28 άϧʔϓ಺ͷϓϩηεΛશͯҰ࣌ఀࢭ͢Δ memory: 2.6.29 ϝϞϦϦιʔεͷ੍ݶ (ϢʔβϝϞϦɼΧʔωϧϝϞϦ) blkio (Block IO): I/O weight controller(2.6.33 Ҏ߱) άϧʔϓͷ༏ઌ౓Λࢦఆ ͢Δ I/O throttling(2.6.37 Ҏ߱) άϧʔϓ಺ͷϓϩηεͷσόΠ εʹର͢Δૢ࡞਺ͷ߹ܭͷࢦఆ (ࢀߟ)Linux2.6.37 ͷ৽ػೳ “I/O throttling” Ճ౻ହจ ୈ 9 ճ ίϯςφܕԾ૝Խͷ৘ใަ׵ձˏ෱Ԭ 2016-04-23 38 / 48

Slide 39

Slide 39 text

cgroupͷαϒγεςϜ hugetlb: 3.6 cgroup ͔Βͷ hugetlb ͷ࢖༻ perf event: 2.6.39 άϧʔϓ୯ҐͰ perf πʔϧͰϞχλϦϯά (ύϑΥʔϚϯε ղੳ) net cls: 2.6.29 ύέοτʹࣝผࢠΛ͚ͭɼτϥϑΟοΫίϯτϩʔϧ (tc) ͱ netﬁlter(3.14 Ҏ߱) ͰίϯτϩʔϧՄೳʹ Linux 3.14 Ͱ net cls cgroup ʹ௥Ճ͞Εͨ netﬁlter ରԠ net prio: 3.3 άϧʔϓؒͰͷωοτϫʔΫͷ༏ઌ౓ΛΠϯλʔϑΣʔεຖʹ ࢦఆ͢Δ Linux 3.3 ͷ৽ػೳ Network priority cgroup Linux 3.3 ͷ৽ػೳ Network priority cgroup (2) Ճ౻ହจ ୈ 9 ճ ίϯςφܕԾ૝Խͷ৘ใަ׵ձˏ෱Ԭ 2016-04-23 39 / 48

Slide 40

Slide 40 text

cgroupͷαϒγεςϜ pids: 4.3 fork() ΍ clone() ͰىಈͰ͖Δϓϩηε਺Λ੍ݶ͢Δ LXC ͰֶͿίϯςφೖ໳ ୈ 30 ճ Linux Χʔωϧͷίϯςφ ػೳ [8] ʔ cgroup ͷ pids αϒγεςϜ Ճ౻ହจ ୈ 9 ճ ίϯςφܕԾ૝Խͷ৘ใަ׵ձˏ෱Ԭ 2016-04-23 40 / 48

Slide 41

Slide 41 text

cgroupͷ࢖͍ํ cgroup ͸ίϯςφͱؔ܎ͳ͘࢖༻Մೳ # mount -t tmpfs cgroup_root /sys/fs/cgroup # mkdir /sys/fs/cgroup/memory # mount -t cgroup -o memory cgroup /sys/fs/cgroup/memory (ϝϞϦαϒγεςϜͷ Ϛ΢ϯτ) # mkdir /sys/fs/cgroup/memory/test01 ("test01" ͱ͍͏άϧʔϓͷ࡞੒) # echo $$ > /sys/fs/cgroup/memory/test01/tasks (ϓϩηεΛάϧʔϓʹొ࿥) # cat /sys/fs/cgroup/memory/test01/tasks (άϧʔϓ಺ͷϓϩηεͷ֬ೝ) 2824 2837 # echo 30M > /sys/fs/cgroup/memory/test01/memory.limit_in_bytes (άϧʔϓʹରͯ͠ϝϞϦ্ݶ 30M ͱ͍͏੍ݶΛઃఆ) # cat /sys/fs/cgroup/memory/test01/memory.limit_in_bytes (੍ݶ஋ͷ֬ೝ) 31457280 # cat /sys/fs/cgroup/memory/test01/memory.usage_in_bytes (ݱࡏͷ࢖༻ྔͷ֬ೝ) 565248 Ճ౻ହจ ୈ 9 ճ ίϯςφܕԾ૝Խͷ৘ใަ׵ձˏ෱Ԭ 2016-04-23 41 / 48

Slide 42

Slide 42 text

cgroup v2 4.5 ΧʔωϧͰ stable ʹͳͬͨ (ͦΕ·Ͱ΋։ൃ༻Ͱ࣮૷͸͞ Ε͍ͯͨ) cgroup v1 ͸໰୊͕͋Δ ෳࡶ͗͢ ੍ݶ͕͋ΔͷͰෳࡶͳ͜ͱ͕Ͱ͖ͯ΋࣮ࡍ͸࢖͑ͳ͍ɾ࢖Θ ͳ͍ αϒγεςϜಉ࢜ͷ࿈ܞ͕औΕͳ͍ ·ͩҰ෦ͷαϒγεςϜͷΈ (memory,io,pids) Ұ෦͸ v2 Λ࢖ͬͯɺଞ͸ v1 Λ࢖͏͜ͱ΋Ͱ͖Δ Χʔωϧෟଐจॻ (Documentation/cgroup-v2.txt) Ճ౻ହจ ୈ 9 ճ ίϯςφܕԾ૝Խͷ৘ใަ׵ձˏ෱Ԭ 2016-04-23 42 / 48

Slide 43

Slide 43 text

cgroupσϞ 1 CPU ࢖༻࣌ؒͷ੍ݶ (https://asciinema.org/a/29131) ୯Ґ࣌ؒ 100000(Ж s) த 1000(Ж s) ͚ͩ࢖༻͢Δ 2 ϓϩηε਺ͷ੍ݶ (https://asciinema.org/a/29276) Ճ౻ହจ ୈ 9 ճ ίϯςφܕԾ૝Խͷ৘ใަ׵ձˏ෱Ԭ 2016-04-23 43 / 48

Slide 44

Slide 44 text

·ͱΊ Ճ౻ହจ ୈ 9 ճ ίϯςφܕԾ૝Խͷ৘ใަ׵ձˏ෱Ԭ 2016-04-23 44 / 48

Slide 45

Slide 45 text

·ͱΊ ίϯςφͷ֓ཁ Linux ʹ͓͚Δίϯςφͷ࢓૊Έ ίϯςφ͸Χʔωϧʹ࣮૷͞Ε͍ͯΔ৭ʑͳػೳͷ૊Έ߹Θͤ Ͱ࣮ݱ͞Ε͍ͯΔ Namespace OS Ϧιʔεͷִ཭ cgroup ϗετͷ෺ཧϦιʔεͷ੍ݶ ωοτϫʔΫؔ࿈ػೳ veth macvlan ίϯςφͰ࢖͑Δ໘ന͍ػೳ Ճ౻ହจ ୈ 9 ճ ίϯςφܕԾ૝Խͷ৘ใަ׵ձˏ෱Ԭ 2016-04-23 45 / 48

Slide 46

Slide 46 text

lxc-jp LXC ʹݶΒͣίϯςφͷ࿩୊Λѻ͍ͬͯ·͢ɻ https://groups.google.com/d/forum/lxc-jp Ճ౻ହจ ୈ 9 ճ ίϯςφܕԾ૝Խͷ৘ใަ׵ձˏ෱Ԭ 2016-04-23 46 / 48

Slide 47

Slide 47 text

ڠྗऀืू ҎԼͷ຋༁Λߦ͍ͬͯ·͢ɻ͕࣌ؒ͋Δͱ͖͚ͩͰ΋ྑ͍ͷ ͰϨϏϡʔɺमਖ਼ɺվྑΛͯͩ͘͠͞Δํ׻ܴ͠·͢ɻ LXC ϚχϡΞϧ (man pages) linuxcontainers.org ίϯςϯπ LXD ೔ຊޠϝοηʔδ Ճ౻ହจ ୈ 9 ճ ίϯςφܕԾ૝Խͷ৘ใަ׵ձˏ෱Ԭ 2016-04-23 47 / 48

Slide 48

Slide 48 text

͝ਗ਼ௌ͋Γ͕ͱ͏͍͟͝·ͨ͠ Ճ౻ହจ ୈ 9 ճ ίϯςφܕԾ૝Խͷ৘ใަ׵ձˏ෱Ԭ 2016-04-23 48 / 48