Slide 1
Slide 1 text
Write Container Runtime in Go
Go Conference 2019 Autumn
Koki Tomoshige (@towocy)
Slide 2
Slide 2 text
Write Container Runtime in Go
Slide 3
Slide 3 text
Write Container Runtime in Go
Slide 4
Slide 4 text
ίϯςφϥϯλΠϜʹ͍ͭͯ
Slide 5
Slide 5 text
ίϯςφٕज़
ίϯςφϥϯλΠϜͱ
ίϯςφΠϝʔδ
Slide 6
Slide 6 text
ίϯςφϥϯλΠϜ
OCI runtimeʹ४ڌ͍ͯ͠Δ
Slide 7
Slide 7 text
OCIʢOpen Container Initiativeʣ
ίϯςφٕज़ͷඪ४ن֨Λ
࡞͢ΔͨΊͷஂମ
Slide 8
Slide 8 text
No content
Slide 9
Slide 9 text
runtime.me
ίϯςφϥϯλΠϜͱͯ͠ͷ
ঢ়ଶͱৼΔ͍
https://github.com/opencontainers/runtime-spec/blob/master/runtime.md
Slide 10
Slide 10 text
Query State state
Create create
Start start
Kill kill
Delete delete
Slide 11
Slide 11 text
No content
Slide 12
Slide 12 text
Standard Go Project Layout
/cmd
https://github.com/golang-standards/project-layout#cmd
Slide 13
Slide 13 text
No content
Slide 14
Slide 14 text
CLI pkg
github.com/urfave/cli
Slide 15
Slide 15 text
No content
Slide 16
Slide 16 text
No content
Slide 17
Slide 17 text
No content
Slide 18
Slide 18 text
No content
Slide 19
Slide 19 text
No content
Slide 20
Slide 20 text
InterfaceͰͷநԽ
༻ऀଆ͕
ٻΊΔৼΔ͍Λఆٛ͢Δ
https://github.com/golang/go/wiki/CodeReviewComments#interfaces
Slide 21
Slide 21 text
No content
Slide 22
Slide 22 text
ίϯςφϥϯλΠϜͷ࣮ʹ͍ͭͯ
Slide 23
Slide 23 text
ίϯςφϥϯλΠϜ
ϗετOS্ͷ
Ϧιʔεִ͕ɺ੍ݶ͞Εͨϓϩηε
Slide 24
Slide 24 text
‘Contain’er
ʙΛด͡ࠐΊΔ
Slide 25
Slide 25 text
ίϯςφϥϯλΠϜ
How to contain a process
Slide 26
Slide 26 text
https://employment.en-japan.com/engineerhub/entry/2019/02/05/103000#ίϯςφͱ
ΧʔωϧϦιʔεɺϑΝΠϧγεςϜͷִ
Namespaceɺchroot/pivot_root
ϋʔυΣΞϦιʔεͷ੍ݶ
cgroup
ݖݶͷ੍
Capabilityɺseccomp
Slide 27
Slide 27 text
No content
Slide 28
Slide 28 text
Fork
Slide 29
Slide 29 text
Fork
ϓϩηε
ࢠϓϩηε
Slide 30
Slide 30 text
Fork
ϓϩηε
ࢠϓϩηε
Contain
Slide 31
Slide 31 text
No content
Slide 32
Slide 32 text
Build Constraints
ϑΝΠϧ໊Ͱ
ϏϧυରΛ͚Δ
https://golang.org/pkg/go/build/#hdr-Build_Constraints
Slide 33
Slide 33 text
No content
Slide 34
Slide 34 text
No content
Slide 35
Slide 35 text
No content
Slide 36
Slide 36 text
No content
Slide 37
Slide 37 text
Fork
ϓϩηε
ࢠϓϩηε
Contain
Slide 38
Slide 38 text
https://github.com/rrreeeyyy/container-internship/tree/master/02#linux-namespaces
IPC ϓϩηεؒ௨৴Ͱ͏Ϧιʔε
Network ωοτϫʔΫσόΠεɺϧʔςΟϯάςʔϒϧ
Mount ϑΝΠϧγεςϜπϦʔ
PID ϓϩηε ID
User Ϣʔβ IDɺάϧʔϓ ID
UTS nodenameɺdomainname
Slide 39
Slide 39 text
No content
Slide 40
Slide 40 text
Fork
Slide 41
Slide 41 text
No content
Slide 42
Slide 42 text
Filesystem bundle
config.jsonͱrootfs
https://github.com/opencontainers/runtime-spec/blob/master/bundle.md
Slide 43
Slide 43 text
ࢠϓϩηεͷϧʔτ༻ʹ
Slide 44
Slide 44 text
ࢠϓϩηεͷϧʔτ༻ʹ
mount͍ͯ͘͠
Slide 45
Slide 45 text
ࢠϓϩηεͷϧʔτ༻ʹ
mount͍͖ͯ͠
ͦͯ͠pivot_root͢Δ
Slide 46
Slide 46 text
ࢠϓϩηεʹ
/ ʹݟ͑Δ
Slide 47
Slide 47 text
cgroup
ϓϩηεʹରͯ͠
ڞ௨ͷϦιʔεཧΛ͢Δ
https://gihyo.jp/admin/serial/01/linux_containers/0003
Slide 48
Slide 48 text
No content
Slide 49
Slide 49 text
No content
Slide 50
Slide 50 text
No content
Slide 51
Slide 51 text
No content
Slide 52
Slide 52 text
No content
Slide 53
Slide 53 text
No content
Slide 54
Slide 54 text
No content
Slide 55
Slide 55 text
No content
Slide 56
Slide 56 text
No content
Slide 57
Slide 57 text
No content
Slide 58
Slide 58 text
No content
Slide 59
Slide 59 text
No content
Slide 60
Slide 60 text
Write Container Runtime in Go
Slide 61
Slide 61 text
͋Γ͕ͱ͏͍͟͝·ͨ͠ɻ
Slide 62
Slide 62 text
https://github.com/opencontainers/runtime-spec/blob/master/runtime.md
https://github.com/opencontainers/runtime-spec/blob/master/bundle.md
https://github.com/golang-standards/project-layout#cmd
https://github.com/golang/go/wiki/CodeReviewComments#interfaces
https://employment.en-japan.com/engineerhub/entry/2019/02/05/103000#ίϯςφͱ
https://golang.org/pkg/go/build/#hdr-Build_Constraints
https://github.com/rrreeeyyy/container-internship/tree/master/02#linux-namespaces
https://employment.en-japan.com/engineerhub/entry/2019/02/05/103000
https://github.com/tomocy/gocon
ࢀߟจݙ
https://speakerdeck.com/kyohmizu/windowskontenaru-men?slide=26
https://speakerdeck.com/tenforward/cndt2019
https://sil.hatenablog.com/entry/why-container-is-secure