ロリポップ！マネージドクラウドを支えるコンテナ技術 / lolipop-mc-containers

by KONDO Uchio

Slide 1

Slide 1 text

ۙ౻͏͓ͪ(.01FQBCP *OD 1)1ΧϯϑΝϨϯε෱Ԭ ϩϦϙοϓʂ ϚωʔδυΫϥ΢υΛࢧ͑Δ ίϯςφٕज़ͷશͯ

Slide 2

Slide 2 text

γχΞɾϓϦϯγύϧ ۙ౻͏͓ͪ!VE[VSB (.0ϖύϘɹٕज़෦ɹٕज़ج൫νʔϜ IUUQTCMPHVE[VSBKQ

Slide 3

Slide 3 text

'VLVPLBSC ! ԙϖύες (.0ϖύϘ෱Ԭࢧࣾ'

Slide 4

Slide 4 text

No content

Slide 5

Slide 5 text

Slide 6

Slide 6 text

No content

Slide 7

Slide 7 text

IUUQTNDMPMJQPQKQ

Slide 8

Slide 8 text

Λ❗ Λ❗

Slide 9

Slide 9 text

8PSE1SFTTͳΒҰॠʂ 1)1؀ڥ΋͙͢ʹʂ 44)΋Ͱ͖Δʂ ಠࣗυϝΠϯ΋γϡοͱʂ ແྉͰ5-4ରԠ΋ʂ

Slide 10

Slide 10 text

No content

Slide 11

Slide 11 text

ίϯςφ

Slide 12

Slide 12 text

Linux containers, in short, contain applications in a way that keep them isolated from the host system that they run on. IUUQTPQFOTPVSDFDPNSFTPVSDFTXIBUBSFMJOVYDPOUBJOFST

Slide 13

Slide 13 text

ίϯςφΛ࢖͏ཧ༝ Ͱ

Slide 14

Slide 14 text

։ൃऀ༷ʹ ΞϓϦέʔγϣϯʹ ूத͍͖͍ͯͨͩͨ͠

Slide 15

Slide 15 text

αʔόͰۤ࿑ͨ͘͠ͳ͍ʂ wϛυϧ΢ΣΞͳͲΛࣗ෼ͰೖΕΔͷ͸᠘΋ଟͯ͘େม wಥવෛՙ͕ߴ·ͬͨΒͲ͏͠Α͏ʁ w৭ʑͳ੬ऑੑ͕ग़͖ͯͯΔ͚ͲɺͲ͏ରॲ͢Ε͹͍͍ͷʁ

Slide 16

Slide 16 text

ίϯςφͷಛ௃ wίϯςφ͸ϙʔλϒϧ wˠඞཁͳ΋ͷʮશ෦ೖΓʯͷ؀ڥΛ͝ఏڙʂ wίϯςφ͸ىಈɾఀࢭ͕ߴ଎ wˠඞཁʹԠͯ͡ͷىಈʢΦʔτεέʔϧʣ΋଎͍ʂ wˠෆཁͳ৔߹͸ͪΌΜͱఀࢭͯ͠ɺඅ༻͕͔͔Γ͗͢ͳ͍Α͏ʹ wˠίϯςφͷΞοϓάϨʔυɾೖΕସ͑࠶ىಈ΋ૉૣ͘ʂ

Slide 17

Slide 17 text

ίϯςφӡ༻͸ ϖύϘʹ͓೚ͤʂ

Slide 18

Slide 18 text

ίϯςφͷಛ௃ ͷ

Slide 19

Slide 19 text

օ༷ʹͱͬͯίϯςφͱ͸

Slide 20

Slide 20 text

ίϯςφͷ͞Βʹਂ͍࿩

Slide 21

Slide 21 text

ಛघͳϓϩηεͷ࡞ΓํΛ͢Δ

Slide 22

Slide 22 text

ʮίϯςφؔ࿈ػೳʯΛ༗ޮʹ cgroup Linux Namespace Capability chroot/ pivot_root seccomp

Slide 23

Slide 23 text

ίϯςφ͸ ϓϩηε

Slide 24

Slide 24 text

ϓϩηε͸ ؆୯ʹ࡞ΕΔ

Slide 25

Slide 25 text

ίϯςφ͸ ࡞ΕΔʂ

Slide 26

Slide 26 text

։ൃऀ༷ʹ ΞϓϦέʔγϣϯʹ ूத͍͖͍ͯͨͩͨ͠ "HBJO

Slide 27

Slide 27 text

࠷ߴʹूதͰ͖Δ ίϯςφ؀ڥΛʂ

Slide 28

Slide 28 text

Haconiwa

Slide 29

Slide 29 text

)BDPOJXBͷ࢓૊Έ w-JOVYͷ༷ʑͳίϯςφػೳΛ૊Έ߹ΘͤՄೳͳϥϯλΠϜ wγεςϜίʔϧ౳ΛɺɹɹɹɹΛܦ༝੍ͯ͠ޚͰ͖ΔΑ͏ʹ͠ɺ  %4-ʹΑΓػೳͷ૊Έ߹Θͤ΍ɺ༷ʑͳΠϕϯτʹԠͨ͡ϑοΫॲཧ Λهड़Ͱ͖Δɻ

Slide 30

Slide 30 text

ਤղ Linux Kernel mruby gems Haconiwa DSL Containers Syscalls: * chroot * mount * prctl * unshare * setns * (cgroup op) * seccomp * setuid * setgid * ...... mruby-dir mruby-linux-namespace mruby-cgroup mruby-seccomp ...... sample.haco

Slide 31

Slide 31 text

Կ͕خ͍͠ʁ

Slide 32

Slide 32 text

৽͍͠ ίϯςφΞʔΩςΫνϟ

Slide 33

Slide 33 text

ίϯςφͱ͍͑Ͳ΋ɺ೉͍͠՝୊ w ͓٬༷؀ڥΛͳΔ΂͘շదɺ͔ͭߴूੵʹ  ूੵ཰Λߴ͘͠ͳ͚Ε͹ɺݱ࣮తͳ͓஋ஈͰఏڙ͠ଓ͚Δ͜ͱ͕Ͱ͖ ͳ͍ʂɹͦΕͰ΋ɺշదͰͳ͍؀ڥʹ͸ͨ͘͠ͳ͍ʂ w ίϯςφͱ͸͍͑ɺӡ༻ʹ޻෉͠ͳ͍ͱߴ଎͡Όͳ͍  ىಈɺఀࢭɺεέʔϧΞ΢τͳͲΛ͍͍ͪͪखಈͰ΍͍ͬͯͯ͸  ঢ়گʹԠͯ͡ͳΊΒ͔ʹίϯςφͷ਺Λม͑ΒΕͳ͍͔ʁ

Slide 34

Slide 34 text

'BTU$POUBJOFS ΞʔΩςΫνϟ

Slide 35

Slide 35 text

ਤղ Web Proxy Web Request Dispatcher FastContainer Runtime CMDB ❌ FastContainer Killed 1. Check 2. Boot 3. Forward 4. Terminate

Slide 36

Slide 36 text

ίϯςφΛ॥؀ͤ͞Δʂ wίϯςφ͸ɺඞཁͳ࣌ʹ͔͠ىಈͤ͞ͳ͍ʂ  ˠϗεταʔόͷϦιʔεΛඞཁҎ্ʹ࢖Θͳ͍ͷͰɺଟ͘ͷϢʔβ ༷ʹఏڙ͢Δ͜ͱ͕Ͱ͖ΔΑ͏ʹʂ wίϯςφͷʮੜଘ࣌ؒʯΛ۠੾ͬͯఏڙ͢Δʂ  ˠίϯςφʹೖΕସ͑Λڧ੍ͤ͞ɺৗʹ৽͘͠อͨͤΔ͜ͱͰɺ  ΞοϓάϨʔυɺΦʔτεέʔϧΛ༰қʹ࣮ݱͰ͖Δʂ ˠ΋ͬͱշదͳ؀ڥʹʂ

Slide 37

Slide 37 text

ݚڀ։ൃͷͱΓ͘Έ ͷ

Slide 38

Slide 38 text

IUUQTSBOEQFQBCPDPN

Slide 39

Slide 39 text

ΞʔΩςΫνϟ౳ ࿦จԽ

Slide 40

Slide 40 text

αʔϏεͰ࢖ٕͬͨज़Λ࿦จʹ wɹɹɹɹɹɹɹɹɹɹɹͰ͸ɺ  ݚڀ։ൃͱࣄۀߩݙͷؔΘΓΛେࣄʹ͍ͯ͠·͢ wྫ͑͹'BTU$POUBJOFS  w044΋࿦จʹ)BDPOJXB

Slide 41

Slide 41 text

No content

Slide 42

Slide 42 text

ىಈߴ଎Խ $3*6

Slide 43

Slide 43 text

ΑΓշదͳίϯςφΛɻ w$3*6 $IFDLQPJOUBOE3FTUPSF*O6TFSTQBDF Λ༻͍ͯɺ  ىಈ్தͷϓϩηεͷνΣοΫϙΠϯτΛ࡞੒ɺىಈΛߴ଎Խ͢Δ  ݚڀΛਐΊ͍ͯ·͢ɻ w$IFDLQPJOU3FTUPSF$3*6͸֤ॴͰݚڀ͕ਐΜͰ͍·͕͢ɺ  TFDDPNQͱQUSBDFΛ૊Έ߹Θͤɺ೚ҙͷϓϩηεΛىಈߴ଎Խ͢Δ  ख๏Λ΍͍ͬͯͬͯ·͢ʂ IUUQTICNBUTVNPUPSKQFOUSZ

Slide 44

Slide 44 text

·ͱΊ

Slide 45

Slide 45 text

։ൃऀ༷͕։ൃʹ ूத͢ΔͨΊʹ શྗΛਚ͍ͯ͘͠·͢ʂ ͸

Slide 46

Slide 46 text

1MFBTF "TLUIF4QFBLFS

Slide 47

Slide 47 text

ϓϥοτϑΥʔϜΛʮ࡞ͬͯʯΈ·ͤΜ͔ ࠷৽ͷ࠾༻৘ใΛνΣοΫˠ !QC@SFDSVJU IUUQIBUFOBOFXTDPNBSUJDMFT