Containers from Scratch Eric Chiang Software Engineer @erchiang | github.com/ericchiang

Agenda 1. Dive into containers! 2. Talk about the problems they solve.

No content

No content

Containers Like a mini virtual machine.

Virtual machines

OS OS OS Virtual machines

Virtual machines: Isolated operating systems.

Virtual machines: problems

Virtual machines: problems Expensive!

Like mini virtual machines. What’s a container?

Like mini virtual machines. Just an isolated process. No virtualizing a kernel. What’s a container?

Like mini virtual machines. What’s a container? Hypervisor VM (kernel) VM (kernel) VM (kernel) Kernel

Like mini virtual machines. What’s a container? Hypervisor VM (kernel) VM (kernel) VM (kernel) Kernel Kernel

$ sudo chroot rootfs /bin/bash # Containers: chroot

Containers: namespaces

$ sudo unshare -p -f \ --mount-proc=$PWD/rootfs/proc \ chroot rootfs /bin/bash # Containers: namespaces

$ sudo unshare -p -f \ --mount-proc=$PWD/rootfs/proc \ chroot rootfs /bin/bash # $ sudo nsenter --pid=/proc/7897/ns/pid \ chroot rootfs /bin/bash # Containers: namespaces

Containers: cgroups

$ ls /sys/fs/cgroup/ $ sudo # mkdir /sys/fs/cgroup/memory/demo # echo "100000000" > /sys/fs/cgroup/memory/demo/memory.limit_in_bytes # echo "0" > /sys/fs/cgroup/memory/demo/memory.swappiness # echo $$ > /sys/fs/cgroup/memory/demo/tasks (to clean up kill the process and run rmdir /sys/fs/cgroup/memory/demo) Containers: cgroups

Containers: security ● Capabilities: limit the power of root ○ sudo setcap CAP_NET_BIND_SERVICE+ep ./hello ● seccomp: limit the syscalls you can make ● SELinux: fine grained access control policies on processes

Container runtimes

Container runtimes

$ sudo rkt run \ quay.io/ericchiang/python:3.5.2 \ --exec=python3 -- -m http.server Container runtimes: rkt

Container runtimes ● Metadata and tarball formats ● Discovery of those tarballs ○ rkt run quay.io/coreos/dex ● Coordinates the underlying technologies

Why containers? Amazingly good at moving applications around.

$ tree . ├── bin │ └── my-awesome-app ├── server │ ├── app.py │ └── templates.py ├── public │ └── main.css └── README.md An app

$ tree . ├── bin │ └── my-awesome-app ├── server │ ├── app.py │ └── templates.py ├── public │ └── main.css └── README.md An app python3 bin/my-awesome-app \ --port 80 \ --db postgres://db.com/mydb

$ tree . ├── bin │ └── my-awesome-app ├── server │ ├── app.py │ └── templates.py ├── public │ └── main.css └── README.md An app python3 bin/my-awesome-app \ --port 80 \ --db postgres://db.com/mydb Additional code or resources.

$ tree . ├── bin │ └── my-awesome-app ├── server │ ├── app.py │ └── templates.py ├── public │ └── main.css └── README.md An app How to run it python3 bin/my-awesome-app \ --port 80 \ --db postgres://db.com/mydb Additional code or resources.

Problems: Dependencies Source code doesn’t tell us:

Problems: Dependencies Source code doesn’t tell us: ● What version(s) of Python can run it? ● What third-party Python packages does it import? ● What system packages does it depend on?

Solutions: Package management Take your source code, add a bit of metadata, and put it on the internet.

from distutils.core import setup setup( name = 'my-awesome-app', scripts = ['bin/my-awesome-app'], version = '0.1', description = 'That thing I wrote', author = 'Eric Chiang', url = 'https://github.com/ericchiang/app', download_url = 'https://github.com/ericcchiang/app/tarball/0.1', keywords = ['webapp', 'awesome'], install_requires = ["flask", "jinja2", "Psycopg2"], ) A PyPI example

from distutils.core import setup setup( name = 'my-awesome-app', scripts = ['bin/my-awesome-app'], version = '0.1', description = 'That thing I wrote', author = 'Eric Chiang', url = 'https://github.com/ericchiang/app', download_url = 'https://github.com/ericcchiang/app/tarball/0.1', keywords = ['webapp', 'awesome'], install_requires = ["flask", "jinja2", "Psycopg2"], ) A PyPI example Package name How to run Where to download Dependencies

$ pip install my-awesome-app A PyPI example

Package management: problems Lots of potential conflicts: ● What if two apps depend on different versions of the same package? ● What if one app hogs memory or disk? ● What if one gets hacked?

Containers: easy deployments ● What kind of problems do you run into when it’s extremely easy to deploy an app? ● How do you manage a high number of apps on a single machine?

Containers: easy deployments ● What kind of problems do you run into when it’s extremely easy to deploy an app? ● How do you manage a high number of apps on a single machine? (Hint: you should stay around for the next talk.)

[email protected] @erchiang QUESTIONS? Thanks! We’re hiring: coreos.com/careers Let’s talk! IRC More events: coreos.com/community LONGER CHAT?