Slide 1
Slide 1 text
© 2022 SRE Holdings Corporation
1
2980
© 2022 SRE Holdings Corporation
Fargate PID namespace sharing
2023/10/16
Slide 2
Slide 2 text
© 2022 SRE Holdings Corporation
2
•
• SRE Holdings
•
⁃ Web
⁃
Twitter: Lam（@boy_hap）
Slide 3
Slide 3 text
© 2022 SRE Holdings Corporation
3
• namespace
• Fargate PID namespace sharing
•
•
•
Slide 4
Slide 4 text
© 2022 SRE Holdings Corporation
4
SRE Holdings
2014 2019
SRE
/
AI
DX
DX IT
Slide 5
Slide 5 text
© 2022 SRE Holdings Corporation
5
namespace
• Linux
• PID namespace namespace
名前 機能
network namespace ネットワークの分離
pid namespace プロセスIDの分離
uts namespace ホスト、ドメインの分離
mount namespace マウントポイントの分離
Slide 6
Slide 6 text
© 2022 SRE Holdings Corporation
6
9.5 namespace
• namespace
: 9.5 namespace
•
namespace
• PID namespace
Slide 7
Slide 7 text
© 2022 SRE Holdings Corporation
7
Fargate PID namespace
• ECS on EC2 ⾒ pid namespace
• ECS on Fargate ⾒ namespace
• Fargete
Slide 8
Slide 8 text
© 2022 SRE Holdings Corporation
8
Fargate pid namespace sharing
• pidMode task
pid namespace sharing
⾒ pid namespace =
• pid namespace sharing
⁃
⁃
Slide 9
Slide 9 text
© 2022 SRE Holdings Corporation
9
• Fargate
⾒
⁃
⁃
引⽤）https://dev.classmethod.jp/articles/sysdig-secure-ecs-fargate-setting-up-terraform-overview/ 引⽤）https://paper.dropbox.com/doc/ECS-Fargate-CyCA4uBm581OgeBIYq37b
Slide 10
Slide 10 text
© 2022 SRE Holdings Corporation
10
AWS
• nginx sleeper
⁃ nginx nginx main
⁃ sleeper sleep in nity
sleeper ecs exec
nginx
pid Mode
Slide 11
Slide 11 text
© 2022 SRE Holdings Corporation
11
(pidMode
{
…
"containerDefinitions": [
{
"name": "nginx",
"image": "public.ecr.aws/nginx/nginx:1.25-perl",
"essential": true
},
{
"name": "sleeper",
"image": "public.ecr.aws/amazonlinux/amazonlinux:2",
"essential": true,
"command": [
"sleep",
"infinity"
],
…
"cpu": "256",
"memory": "512"
}
Slide 12
Slide 12 text
© 2022 SRE Holdings Corporation
12
pidMode ⾒ sleeper
•
• ID 1
Slide 13
Slide 13 text
© 2022 SRE Holdings Corporation
13
pidMode ⾒ nginx
•
• ID 1
Slide 14
Slide 14 text
© 2022 SRE Holdings Corporation
14
(pidMode
{
…
"containerDefinitions": [
{
"name": "nginx",
"image": "public.ecr.aws/nginx/nginx:1.25-perl",
"essential": true
},
{
"name": "sleeper",
"image": "public.ecr.aws/amazonlinux/amazonlinux:2",
"essential": true,
"command": [
"sleep",
"infinity"
],
…
"cpu": "256",
"memory": "512",
"pidMode": "task"
}
Slide 15
Slide 15 text
© 2022 SRE Holdings Corporation
15
pidMode task ⾒ sleeper)
•
• pause PID 1
pause https://text.superbrothers.dev/200328-how-to-avoid-pid-1-problem-in-kubernetes/
• ID ID
Slide 16
Slide 16 text
© 2022 SRE Holdings Corporation
16
• /proc/( PID)/root
•
Slide 17
Slide 17 text
© 2022 SRE Holdings Corporation
17
strace
Slide 18
Slide 18 text
© 2022 SRE Holdings Corporation
18
kill kill
Slide 19
Slide 19 text
© 2022 SRE Holdings Corporation
19
• Fargate ⾒ pidMode=task pid namespace
•
•
Slide 20
Slide 20 text
© 2022 SRE Holdings Corporation
20
• "NB[PO&$4PO"84'BSHBUFͰઃఆՄೳͳ-JOVYύϥϝʔλͷՃ
https://aws.amazon.com/jp/blogs/news/announcing-additional-linux-controls-for-amazon-ecs-tasks-on-aws-fargate/
• λεΫఆٛύϥϝʔλ
https://docs.aws.amazon.com/ja_jp/AmazonECS/latest/developerguide/task_de nition_parameters.html#other_task_de
nition_params
• 'BSHBUFͰ1*%OBNFTQBDFڞ༗Λࢼ͢
https://qiita.com/hoogee/items/1555312b385605246253
• &$4PO'BSHBUFͰαΠυΧʔ͔ΒϓϩηεγεςϜίʔϧࢹ͕؆୯ʹͰ͖ΔΑ͏ʹͳΓ·ͨ͠ʂ
https://dev.classmethod.jp/articles/ecs-on-fargate-support-shared-pid-namespace/
Slide 21
Slide 21 text
© 2022 SRE Holdings Corporation
21
• &$4'BSHBUFͰແྉͰূཧ͍ͨ͠
https://paper.dropbox.com/doc/ECS-Fargate-CyCA4uBm581OgeBIYq37b
• 4FSWFSMFTT"HFOUTΛར༻ͯ͠&$4'BSHBUFڥͰ4ZTEJH4FDVSFΛར༻ͯ͠Έͨʙ5FSSBGPSNฤʙ
https://dev.classmethod.jp/articles/sysdig-secure-ecs-fargate-setting-up-terraform-overview/
• &$4PO'BSHBUFͷηΩϡϦςΟରࡦԿΛΔ͖ʁ։ൃऀઢͰߟ͑Δ
https://speakerdeck.com/tomoki10/security-for-ecs-on-fargate-secjawsdays