Kicking the Tyres of Kata Containers

A short presentation to the Microservices Zurich meetup group on a technology that I thought might be timely and interesting...

Transcript

1. Kicking the tyres of Kata Containers... ...just coz...
2. Outline • Why Kata Containers? • A little bit on architecture • What happens when a kata container is run • Setting up Kata Containers • Demo • Current status • Parting thoughts
3. Why Kata Containers? • Tagline: "The speed of containers, the security of VMs" • Security and isolation within container systems still not fully addressed ◦ Significant amount of work done on managing network level isolation... ▪ Openshift, calico etc ◦ ...isolation within the container runtimes themselves not fully mature • Important for hosted environments and/or enterprise production environments with significant security considerations • Merging of Intel Clear Containers, runV • While also providing… ◦ K8s integration, docker, Openstack ◦ Support for heterogeneous compute platforms ◦ Support for multiple hypervisors
4. Kata in a nutshell Typical solution today Kata solution
5. System architecture
6. System architecture
7. Starting a container…. • For example, when docker run -ti ubuntu date is run: ◦ The hypervisor will boot the mini-OS image using the guest kernel. ◦ systemd, running inside the mini-OS context, will launch the agent in the same context. ◦ The agent will create a new confined context to run the specified command in (date in this example). ◦ The agent will then execute the command (date in this example) inside this new context, first setting the root filesystem to the expected Ubuntu* root filesystem
8. Kata networking
9. Kata storage
10. Setting up Kata Containers (for tyre kickers!) • Prereqs for Ubuntu 17.10 ◦ go, gcc, make, docker ◦ linux-containers, qemu-lite (from clear-containers) • Build ◦ Runtime, proxy, shim ◦ Custom agent is optional • Generate images ◦ Rootfs builder ◦ OS image • Final config ◦ Install guest kernel images ◦ Modify docker configs ▪ Add kata-runtime as an option Install prereqs Build runtime Build proxy Build shim Build OS image Install kernel images Modify docker config docker run ... https://github.com/kata-containers/documentation/blob/master/Developer-Guide.md#check-hardware-requirements
11. A basic demo... • Q: What will I demo ◦ Demo how the system works… ▪ Show some basic docker commands working • Boot an nginx kata container • Show that it works • Docker inspect to show runtimes • Show systemctl noting where qemu process runs • Run a kata container with a non kata container and get them talking to each other • Run kata container talking to kata container ▪ Show cni config • Ip netns • Ip netns exec <cni> ip a • Show mac addr stuff inside container...
12. Current status • Project is quite new ◦ Started around Oct 2017 ◦ Support from many vendors claimed • Building (primarily) on previous work of Intel and Microsoft • Modest Github activity ◦ About 20 committers to key projects • Work on packaging still required • Operating under Openstack Foundation ◦ Although firmly rooted in container camp • Expecting to release v1.0 soon ◦ June 1st has been mooted
13. Parting thoughts • Interesting technology which will likely be rolled into existing container platforms ◦ Work on Openshift, swarm integration ongoing • Good solution addressing VM-container middleground ◦ Interesting from perspective of VM world and container world... • Why do I care? ◦ We're setting up a heterogeneous edge computing testbed ▪ Mixing containers, VMs over distributed infra ▪ Network isolation and runtime isolation is interesting
14. References... • Generously lifted from ◦ https://katacontainers.io/media/uploads/katacontainers/uploads/katacontainers/kata-containers- on-boarding-deck-for-website01022018.pdf • Build instructions ◦ https://github.com/kata-containers/documentation/blob/master/Developer-Guide.md