Slide 1
Slide 1 text
Introduction to Handmade Containers!!
Uchio Kondo / GMO Pepabo, Inc.
2017.06.27 Geeks Who Drink
Creating Containers
Using Golang
Slide 2
Slide 2 text
Hello
Slide 3
Slide 3 text
Engineer
Uchio Kondo @udzura
GMO Pepabo / Dev Productivity Team
System Programming Newbie
Favorite syscall: ptrace(2)
Favorite ramen: ΒʔΊΜཾ (in Kitakyu)
Slide 4
Slide 4 text
Our company
GMO Pepabo, Inc.
Slide 5
Slide 5 text
runs the web service
minne
Slide 6
Slide 6 text
GMO Pepabo
promotes
a handmade market
Slide 7
Slide 7 text
So I’m talking
about
handmade containers !!
Slide 8
Slide 8 text
Containers in Golang
Slide 9
Slide 9 text
libcontainer
•RunC: Internal container engine of Docker, written in Golang
•libcontainer: Internal library of RunC
•Using libcontainer, you can create containers for your own purpose.
• You can get GitHub 2,000 stars⭐ with your own container!!
Slide 10
Slide 10 text
Casual handcraft
Slide 11
Slide 11 text
Go-native container features
•Golang itself supports container features, such as:
•syscall package:
• func syscall.Chroot
• func syscall.Exec
•exec.Cmd’s SysProcAttr member
IUUQTHPMBOHPSHQLHPTFYFD$NE
IUUQTHPMBOHPSHQLHTZTDBMM
Slide 12
Slide 12 text
Chroot’ing and Exec
Slide 13
Slide 13 text
Setting up root filesystems
•Using docker export
$ sudo su -
# mkdir -p /tmp/gwd && docker export $(docker run -d \
debian:stretch /bin/sleep 9999) | tar xvf - -C /tmp/gwd
## Provision: name resolution in container
# cp /etc/resolv.conf /tmp/gwd/etc/resolv.conf
# cp `which ps` /tmp/gwd/bin/ ## installs just ps...
# cp /lib/x86_64-linux-gnu/libprocps.so.4 \
/tmp/gwd/lib/x86_64-linux-gnu/
Slide 14
Slide 14 text
Smallest implementation of chroot(1)
package main
import (
"os"
"syscall"
)
func must(e error) {
if e != nil {
panic(e)
}
}
func main() {
must(syscall.Chroot(os.Args[1]))
must(syscall.Chdir("/"))
must(syscall.Exec("/bin/sh", []string{}, os.Environ()))
}
Slide 15
Slide 15 text
It works!!
Compiling source with GOOS=linux
Move it to vagrant box, then kick
And now I’m in the Debian!!
Slide 16
Slide 16 text
More isolation required...
I can accidentally see
the host’s processes
Slide 17
Slide 17 text
Linux namespace
Slide 18
Slide 18 text
A namespace wraps a global system resource in an
abstraction that makes it appear to the processes within
the namespace that they have their own isolated instance
of the global resource...
“man 7 namespaces”
Slide 19
Slide 19 text
In a picture
Global UTS namespace
hostname: foo.example.com
unshared namespace
hostname: bar.example.com
hostname: xxx.example.com
hostname: zzz.example.com
A Process
Slide 20
Slide 20 text
In a picture
Global UTS namespace
hostname: foo.example.com
unshared namespace
hostname: bar.example.com
hostname: xxx.example.com
hostname: zzz.example.com
A Process
If some of processes unshared
its UTS namespace, these processes
can have their own hostname
even in the same machine
Slide 21
Slide 21 text
For other resources, it’s same as UTS
Slide 22
Slide 22 text
Then we’re going to try
Let’s unshare
PID namespaces!
Slide 23
Slide 23 text
exec.Cmd ’s member
unshare on fork() (= clone(2))
Slide 24
Slide 24 text
Write some code
package main
import (
"os"
"os/exec"
"syscall"
)
func must(e error) {
if e != nil { panic(e) }
}
func main() {
must(syscall.Chroot(os.Args[1]))
must(syscall.Chdir("/"))
cmd := exec.Command("/bin/sh")
cmd.Stdin = os.Stdin
cmd.Stdout = os.Stdout
cmd.Stderr = os.Stderr
cmd.SysProcAttr = &syscall.SysProcAttr{Cloneflags: syscall.CLONE_NEWPID}
must(cmd.Run())
}
Slide 25
Slide 25 text
Then build and run...
Slide 26
Slide 26 text
Check the PID starts with one!!!!!!
Slide 27
Slide 27 text
Newborn
handmade container!!
Slide 28
Slide 28 text
Summary:
creating your own container is
easier than you think!!
Slide 29
Slide 29 text
Summary:
creating your own container is
easier than you think!!
......Maybe ;)
Slide 30
Slide 30 text
You can get 2,000 stars⭐
with your container
Slide 31
Slide 31 text
As pt did!!!
Slide 32
Slide 32 text
More container talk on YAPC::Fukuoka
Slide 33
Slide 33 text
See also (many in Japanese...)
•Full golang source code by @hayajo
•ʮGoͰͭ͘ΔLinuxίϯςφʯPresentation
•...And his movie
•Thanks @hayajo for the basic idea and implementation!!!
IUUQTHJTUHJUIVCDPNIBZBKPDBCBCGECFGF
IUUQTTQFBLFSEFDLDPNIBZBKPDUTUVEZ
IUUQTZPVUVCFHJ2DKD:QMX