Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
Containerization primatives
Search
Sam Kottler
November 05, 2014
Technology
0
150
Containerization primatives
Sam Kottler
November 05, 2014
Tweet
Share
More Decks by Sam Kottler
See All by Sam Kottler
This is your database on Linux
skottler
0
290
How to Debug Anything - DevOpsDay PGH
skottler
1
1.2k
Icinga at DigitalOcean
skottler
1
1k
PuppetConf '14
skottler
0
230
Configuration Management Anti-Patterns
skottler
2
1.2k
Other Decks in Technology
See All in Technology
Shirankedo NOCで見えてきたeduroam/OpenRoaming運用ノウハウと課題 - BAKUCHIKU BANBAN #2
marokiki
0
150
業務自動化プラットフォーム Google Agentspace に入門してみる #devio2025
maroon1st
0
190
関係性が駆動するアジャイル──GPTに人格を与えたら、対話を通してふりかえりを習慣化できた話
mhlyc
0
130
実装で解き明かす並行処理の歴史
zozotech
PRO
1
420
定期的な価値提供だけじゃない、スクラムが導くチームの共創化 / 20251004 Naoki Takahashi
shift_evolve
PRO
3
320
英語は話せません!それでも海外チームと信頼関係を作るため、対話を重ねた2ヶ月間のまなび
niioka_97
0
120
OCI Network Firewall 概要
oracle4engineer
PRO
1
7.8k
20201008_ファインディ_品質意識を育てる役目は人かAIか___2_.pdf
findy_eventslides
1
440
【新卒研修資料】LLM・生成AI研修 / Large Language Model・Generative AI
brainpadpr
24
17k
多野優介
tanoyusuke
1
450
SoccerNet GSRの紹介と技術応用:選手視点映像を提供するサッカー作戦盤ツール
mixi_engineers
PRO
1
180
Escaping_the_Kraken_-_October_2025.pdf
mdalmijn
0
140
Featured
See All Featured
VelocityConf: Rendering Performance Case Studies
addyosmani
332
24k
Facilitating Awesome Meetings
lara
56
6.6k
Reflections from 52 weeks, 52 projects
jeffersonlam
352
21k
Dealing with People You Can't Stand - Big Design 2015
cassininazir
367
27k
Gamification - CAS2011
davidbonilla
81
5.5k
Put a Button on it: Removing Barriers to Going Fast.
kastner
60
4k
4 Signs Your Business is Dying
shpigford
185
22k
A Tale of Four Properties
chriscoyier
160
23k
Building an army of robots
kneath
306
46k
Why Our Code Smells
bkeepers
PRO
339
57k
How to train your dragon (web standard)
notwaldorf
96
6.3k
Context Engineering - Making Every Token Count
addyosmani
5
190
Transcript
CONTAINERIZATION PRIMITIVES Sam Kottler @samkottler
ABOUT ME • Work at DigitalOcean as a systems engineer
• Formerly of Red Hat, Venmo, Acquia • Committer/core for Puppet, Ansible, Fedora, CentOS, RubyGems, Bundler
WE’RE GONNA BE TALKING ABOUT LINUX
GOOD TO KNOW’S • What is a syscall • Basic
understanding of linux networking • Containers vs. virtualization
WHY DO WE CARE ABOUT ANY OF THIS?
CONTAINERS ARE THE PAST *, PRESENT, AND FUTURE * Most
of the linux ideas are poached from other OS’s
VIRTUALIZATION HAS BECOME MASSIVELY POPULAR BECAUSE OF ITS ECONOMICS
CONTAINERS ARE BECOMING MASSIVELY POPULAR BECAUSE THEY ALLOW LOGICAL SEPARATION
APPLICATION VS. FULL CONTAINERS
NETWORKS, USERS, AND PROCESSES
NAMESPACES • mnt: filesystem • pid: process • net: network
• ipc: SysV IPC • uts: hostname • user: UID
THE BASICS • Namespaces do not have names • Six
inodes exist under /proc/<pid>/ns • Each namespace has a unique inode
USERSPACE TOOLING • iproute2 • util-linux • systemd
NAMESPACE SYSCALLS • unshare() • moves existing process into a
new namespace • clone() • creates new process and namespace • setns() • joins an existing namespace
NETWORK ISOLATION • One namespace per networking device • Single
default namespace, init_net(*nets) • A lo device is included in every ns_net.
NETWORK NAMESPACES IN PRACTICE • ip netns add testns1 •
creates /var/run/netns/testns1 • route management per-NS • prevents cross-NS bonds • setns(int fd, int nstype) • validates namespace type vs. FD
SOCKET ISOLATION • Sockets are mapped into network namespaces •
Also part of a single network namespace • sk_net is part of the sock struct • sock_net()/sock_net_set() getter/setter
SOCKET ACTIVATION • Listen on a socket, but have no
services behind it • Request arrives, service is spun up, responds • Enabling 10k+ low-usage services on a VM
USER ISOLATION • Allows non-privileged usage • Often used as
the start of a namespace chain • UID’s come from the overflow rules
CGROUPS • Resource management • Around since 2006/2007 • Widely
used by userspace management tools
CGROUPS + NAMESPACES • “This PID can only see part
of the filesystem” • “This PID can only see part of the filesystem, use 384mb of memory, and utilize a single CPU.”
CGROUP IMPLEMENTATION • Hooks into fork() and exit() • VFS
of a new type called “cgroup” • More complex descriptors for task_struct • Procfs entry in /proc/<pid>/cgroup • All actions take place on the FS
CGROUP MANAGEMENT • 4 files per-cgroup • tasks • cgroup.procs
• cgroup.event_control • notify_on_release
CPU • Split into “shares” • Default is 2048 shares
• Linear CPU time use
MEMORY • Exposes most of the memory subsystem • NUMA
management • Most complex type of cgroup
LETS TALK ABOUT SECURITY…
SHARING A KERNEL IS INHERENTLY LESS SECURE
KERNEL VULNERABILITIES AROUND BREAKOUT ARE USUALLY MITIGATED BY RUNNING SERVICES
NON- PRIVILEGED
THANKS! • @samkottler • https://github.com/skottler •
[email protected]