Firecracker、下から見るか？上から見るか？ / firecracker from low layer to hight

Slide 1

Slide 1 text

ۙ౻͏͓ͪ(.01FQBCP *OD 4FSWFSMFTT.FFUVQ'VLVPLB 'JSFDSBDLFSɺ Լ͔ΒݟΔ͔ʁ ্͔ΒݟΔ͔ʁ

Slide 2

Slide 2 text

γχΞɾϓϦϯγύϧΤϯδχΞ ۙ౻ Ӊஐ࿕ / @udzura https://blog.udzura.jp/ Uchio Kondo ٕज़෦ ٕज़ج൫νʔϜ

Slide 3

Slide 3 text

No content

Slide 4

Slide 4 text

No content

Slide 5

Slide 5 text

Լ͔Β

Slide 6

Slide 6 text

'JSFDSBDLFS "NB[POΑΓൃද͞Εͨ ʮϚΠΫϩ7.ʯΛ࡞੒ɾ؅ཧ͢ ΔϥϯλΠϜɻ ,7.Λར༻ͨ͠7.. 7JSUVBM .BDIJOF.POJUPS ʹ෼ྨ͞ΕΔ

Slide 7

Slide 7 text

ʮίϯςφʯϥϯλΠϜ w࣮͸͍Ζ͍Ζ͋Δʢ͍ΘΏΔ௿ϨϕϧϥϯλΠϜத৺ʹʣ ϓϩηε ϋΠύʔόΠβ .JDSP7. αϯυϘοΫε ϢχΧʔωϧ

Slide 8

Slide 8 text

'JSFDSBDLFSͷಛ௃ wηΩϡΞԾ૝ϚγϯΛ࡞੒͢ΔͷͰִ཭ੑ͕ߴ͍ wϋΠύϑΟΦʔϚϯεىಈϛϦඵʢެশʣ w࣮੷-BNCEBɺ'BSHBUFͷόοΫΤϯυʂ w௿Φʔόϔου7.͋ͨΓ໿.J#ͷϝϞϦΛফඅʢެশʣ w044ʢ"QBDIF-JDFOTFʣ w3VTUͷେن໛ɾϓϩμΫγϣϯϢʔεϓϩδΣΫτͱͯ͠΋ڵຯਂ͍

Slide 9

Slide 9 text

ಋೖ IUUQTHJUIVCDPNpSFDSBDLFSNJDSPWNpSFDSBDLFSCMPCNBTUFSEPDTHFUUJOHTUBSUFENE

Slide 10

Slide 10 text

ಋೖ࣌ͷϝϞ w-JOVY w6CVOUV#JPOJDͷͳͲ w,7.ར༻Մೳ wύϒϦοΫΫϥ΢υͳΒ"84ͷϕΞϝλϧ΍ɺ($&Ͱ/FTUFE,7. ༗ޮͷΠϯελϯεͳͲ

Slide 11

Slide 11 text

KBJMFS w'JSFDSBDLFSࣗମ͸ྫ͑͹OFUOT΍DHSPVQͳͲΛΑ͠ͳʹ͸͠ͳ͍ͷ ͰɺKBJMFSͱ͍͏؆қίϯςφϥούʔΛט·ͤΔͷ͕͍͍Β͍͠ wޙड़͢Δ,BUB$POUBJOFSΛܦ༝ͯ͠΋͍͍ JAIL_ID=$(uuidgen) jailer --id $JAIL_ID \ --exec-file /usr/local/bin/firecracker \ --netns /var/run/netns/fc-test-1 \ --node 0 --uid=10001 --gid=1000

Slide 12

Slide 12 text

ωοτϫʔΫελοΫࣗ࡞੎޲͚

Slide 13

Slide 13 text

,BUB$POUBJOFS w'JSFDSBDLFSΛݱ࣮తʹಈ্͔͢Ͱ͸ɺ,BUB$POUBJOFSͷΞμϓλΛ ར༻ͯ͠EPDLFSίϚϯυܦ༝ͰίϯςφΛ࡞Δͷ͕͍͍ͷͰ͸ w͜͏͍͏ײ͡ [docker cli] -> [dockerd] -> [kata-containerͷshim] -> [firecracker]

Slide 14

Slide 14 text

,BUB$POLBUBGD w ΧλίϯςφΛೖΕɺ%PDLFSΛηοτΞοϓ w pSFDSBDLFSೖΓͷLBUBDPOUBJOFSUBSCBMMΛམͱͯ͠ల։ w LBUBGDΛϥϯλΠϜʹ࢖͏Α͏%PDLFSΛઃఆ w͜ΕͰಈ͘ɻৄࡉ͸ɺ׬શʹ௕͍खॱͳͷͰɺϒϩάʹ͠·͢

Slide 15

Slide 15 text

)FMMPXPSME root@firecracker-test-1:~# docker run -ti --runtime=kata-fc hello-world Hello from Docker! This message shows that your installation appears to be working correctly. To generate this message, Docker took the following steps: 1. The Docker client contacted the Docker daemon. 2. The Docker daemon pulled the "hello-world" image from the Docker Hub. (amd64) 3. The Docker daemon created a new container from that image which runs the executable that produces the output you are currently reading. 4. The Docker daemon streamed that output to the Docker client, which sent it to your terminal.

Slide 16

Slide 16 text

௒؆қతͳ ൺֱ

Slide 17

Slide 17 text

࣮ݧ؀ڥ wϗετ$16$PSF .FNPSZ(# w/FTUFE,7.༗ޮʢ͢ͳΘͪɺϗετ΋7.ʣ wDQVJOGPˠ wͦͷଞඋߟ wઃఆ౳͸μ΢ϯϩʔυ  ηοτΞοϓ࣌σϑΥ w/PUVOJOH

Slide 18

Slide 18 text

344 wEFCJBOTMJNͰTMFFQίϚϯυΛಈ͔ͨ͠ঢ়ଶ

Slide 19

Slide 19 text

344 3VOUJNF WFSTJPO΄͔ ʢҎԼͷൺֱ΋ಉ͡ʣ 344 SVOD SDEFW ,# TMFFQϓϩηε LBUBSVOUJNF SD LBUBTIJN.# LBUBQSPYZ.# RFNV.# LBUBGD LBUBDPOUBJOFSಉࠝ LBUBTIJN.# pSFDSBDLFS.#

Slide 20

Slide 20 text

ىಈ଎౓ time docker run -ti --runtime=$RUNTIME hello-world 3VOUJNF 5JNF SFBM SVOD NT LBUBSVOUJNF NT LBUBGD NT

Slide 21

Slide 21 text

ύϑΥʔϚϯε΁ͷӨڹ wͦΕͧΕͷϥϯλΠϜͰAhttpd:2.4-alpineAΛ͋͛Δ wͦ͜ʹҎԼͷ৚݅ͰBC ab -n 10000 -c 10 http://localhost:$BOUND_PORT/

Slide 22

Slide 22 text

݁Ռʢൈਮʣ SVOD LBUBSVOUJNF LBUBGD

Slide 23

Slide 23 text

্͔Β

Slide 24

Slide 24 text

,VCFSOFUFT͔Β 'JSFDSBDLFSΛ࢖͑ͳ͍ͷʁ

Slide 25

Slide 25 text

ϥϯλΠϜͷϨΠϠΘ͚ ,VCFSOFUFT ߴϨϕϧϥϯλΠϜ ௿ϨϕϧϥϯλΠϜ $3* 0$*

Slide 26

Slide 26 text

ϨΠϠΛͭͳ͍Ͱ͍͘ ,VCFSOFUFT ߴϨϕϧϥϯλΠϜ ௿ϨϕϧϥϯλΠϜ $3* 0$*

Slide 27

Slide 27 text

,VCFSOFUFT͔Β 'JSFDSBDLFSΛ࢖͏

Slide 28

Slide 28 text

ઓུ w,VCFSOFUFTࣗମΛͲ͏ೖΕΔ wNJDSPLTΛ࢖ͬͯΠϯετʔϧʴΧελϚΠζ wϕʔλ൛ͷϦιʔε3VOUJNF$MBTTΛ࢖͑͹͍͍ͷͰ͸ wίϯςφϥϯλΠϜΛࣗ෼Ͱબ΂Δʁ wߴϨϕϧϥϯλΠϜʹɺͲͷ௿ϨϕϧϥϯλΠϜΛ࢖͏͔ࢦࣔͰ͖Δ Β͍͠

Slide 29

Slide 29 text

NJDSPLTͷϋοΫ wઃఆΛมߋͯ͠TOBQDSBGU͠௚͢͜ͱͰɺ΅͚ͩ͘ͷ͍͖͞ΐ͏ͷ ,VCFSOFUFT؀ڥ͕Ͱ͖Δ wҎԼͷΑ͏ʹ͍͡Δ w'FBUVSF(BUFTͰ3VOUJNF$MBTTΛ༗ޮʹ͢Δ wNJDSPLTͷ%PDLFSͰ͸ͳࣗ͘෼ͨͪ؅ཧͷ%PDLFSʹ͢Δ wͳ͔ͥJQUBCMFTͷϦϯΫ͕ࣦഊ͢ΔɺMJCOFUpMUFS@DPOOUSBDLΛ ࣗ෼ͰೖΕͳ͍ͱ͍͚ͳ͍

Slide 30

Slide 30 text

EJ⒎ w͜Ε΋ϒϩάʹ·ͱΊΔΜͰ

Slide 31

Slide 31 text

'FBUVSF(BUFT w,VCFSOFUFT͸ɺϕʔλ΍ΞϧϑΝͷػೳʹ͍ͭͯɺσϑΥϧτͰ͸ ͢΂͕ͯ༗ޮͳΘ͚Ͱ͸ͳ͍ɻ໌ࣔతʹ༗ޮʹ͢ΔͨΊͷػߏ

Slide 32

Slide 32 text

3VOUJNF$MBTF$3% w$VTUPN3FTPVSDF%FpOJUJPOͷҰͭͱͯ͠,VCFSOFUFTʹؚ·Ε͍ͯ Δɺ1PEͳͲ࡞੒࣌ͷϥϯλΠϜΛબ΂ΔΑ͏ʹ͢Δػೳ w"MQIBεςʔδͷػೳ

Slide 33

Slide 33 text

3VOUJNF$MBTTͷରԠঢ়گ wਖ਼֬ʹ͸ɺ$3*ͷΠϯλϑΣʔεΛܦ༝ͯ͠ɺ1PE࡞੒࣌ʹߴϨϕϧ ϥϯλΠϜʹAruntime_classAͱ͍͏ύϥϝʔλΛૹΕΔ wߴϨϕϧϥϯλΠϜଆͰͦΕΛݟͯ௿ϨϕϧϥϯλΠϜΛબͿɺͭ· ΓɺߴϨϕϧଆͰͷઃఆ͕ඞཁ wEPDLFSE͸Ͳ͜Ͱઃఆͯ͠ΔΜͩΘ͔ΒΜ  ʢDSJPͷηοτΞοϓ·Ͱ͸࣌ؒ੾Εʣ

Slide 34

Slide 34 text

ઓུ w,VCFSOFUFTࣗମ wNJDSPLTΛ࢖ͬͯΠϯετʔϧʴΧελϚΠζ wϕʔλ൛ͷϦιʔε3VOUJNF$MBTTΛ࢖͑͹͍͍ͷͰ͸ wߴϨϕϧϥϯλΠϜʹɺͲͷ௿ϨϕϧϥϯλΠϜΛ࢖͏͔ࢦࣔͰ͖Δ Β͍͠ wखݩͷ%PDLFSΛݟΔΑ͏ʹ͸Ͱ͖ͯΔͷͰɺͦͷσϑΥϧτϥϯλ ΠϜΛLBUBGDʹ͢Ε͹Α͘Ͷʁ

Slide 35

Slide 35 text

Ͱ͖ͨ

Slide 36

Slide 36 text

%FNP

Slide 37

Slide 37 text

·ͱΊ

Slide 38

Slide 38 text

'JSFDSBDLFSΛҰ௨Γ͍ͬͯ͡Έͯ w΋͏࢖͓͏ͱࢥ͑͹࢖͑Δʢʁʣ w0$* $3*ͳͲͷن໿͕ਁಁ͖ͯͯ͠ɺͭͳ͗͜Έ͕༰қʹͳ͍ͬͯΔ ͷΛײͨ͡ wӡ༻໘ɺύϑΥʔϚϯεͷվળ΍ϊ΢ϋ΢͸͜Ε͔Βʁ