Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Linuxコンテナ入門 〜コンテナの基礎と最新情報〜 (2013/10/05)

tenforward
October 05, 2013

Linuxコンテナ入門 〜コンテナの基礎と最新情報〜 (2013/10/05)

『第2回 コンテナ型仮想化の情報交換会@東京』での発表資料です.speakerdeck だと資料中のリンクがクリックできないようになるようなので,参考資料もみたい場合はダウンロードするか https://guinan.ten-forward.ws/container-20131005.pdf をご覧ください.

tenforward

October 05, 2013
Tweet

More Decks by tenforward

Other Decks in Technology

Transcript

  1. Linux ίϯςφೖ໳
    ίϯςφͷجૅͱ࠷৽৘ใ
    Ճ౻ହจ
    ୈ2ճ ίϯςφܕԾ૝Խͷ৘ใަ׵ձˏ౦ژ

    View full-size slide

  2. ͜ͷࢿྉʹ͍ͭͯ
    ͜ͷࢿྉ͸ 10/5 ʹߦͬͨʰୈ2ճ ίϯςφܕԾ૝Խͷ৘ใަ׵ձˏ౦ژʱͰͷൃද
    ࢿྉʹҰ෦ՃචΛߦͳ͓ͬͯΓ·͢ɽ
    3/52

    View full-size slide

  3. ࣗݾ঺հ
    ໊લ: Ճ౻ହจ
    ॴଐ:
    OSS ؔ܎׆ಈ
    ·
    http://www.ten-forward.ws/
    twitter: @ten_forward
    g+: http://gplus.to/tenforward
    http://d.hatena.ne.jp/defiant (ٕज़ܥωλͷϒϩά)
    -
    -
    -
    -
    ·
    ϑΝʔεταʔόגࣜձࣾ ։ൃ෦
    -
    ·
    Plamo Linux ϝϯςφɼWeb ϖʔδίϯςϯπ؅ཧ
    lxc man pages ຋༁
    Jetspeed 2 υΩϡϝϯτ຋༁
    -
    -
    -
    4/52

    View full-size slide

  4. ࠓ೔ͷ໨ඪ
    (ॳ৺ऀͷํ޲͚) ίϯςφͷ֓ཁͱ LXC ͷ؆୯ͳ࢖͍ํΛཧղ͍ͨͩ͘
    Linux Kernel ͷίϯςφؔ࿈ػೳͱ LXC ͷߋ৽৘ใʹ͍ͭͯ঺հ͢Δ
    Χʔωϧ΋ LXC ΋ࣗ෼͕ڵຯͷ͋Δ෦෼Λݟ͍ͯΔ͚ͩͳͷͰɼؒҧ͍΍ൈ͚΋
    ͋Δ͔΋͠Ε·ͤΜɽ
    ίϯςφؔ࿈ͷ࠷৽৘ใ͸͘͝࠷ۙͷॏཁͳ΋ͷΛ঺հ͠·͢ɽͦΕҎ֎͸ୈҰ
    ճษڧձͷࢿྉΛ͝ࢀর͍ͩ͘͞ɽ
    εϥΠυதʹ͸ࢀߟจݙ΁ͷϦϯΫΛషͬͯ͋Γ·͢ɽޙ೔ެ։͢ΔࢿྉͰ֬͝
    ೝ͍ͩ͘͞ɽ
    ·
    ·
    લճษڧձࢿྉ͔Βͷ Update Λத৺ʹ (kernel 3.8~, LXC 1.0)
    -
    ·
    ·
    ·
    5/52

    View full-size slide

  5. Agenda
    ίϯςφͷجૅ
    Linux ʹ͓͚Δίϯςφͷ࣮૷
    Linux ίϯςφ͜ͱ͸͡Ί
    Linux ʹ͓͚Δίϯςφͷ࢓૊Έ
    Linux Kernel ࠷৽ಈ޲
    LXC ࠷৽ಈ޲
    ࠷ޙʹ
    ·
    ·
    ·
    ·
    ·
    ·
    ·
    6/52

    View full-size slide

  6. ίϯςφͷجૅ
    7/52

    View full-size slide

  7. ίϯςφͱ͸
    OS ϨϕϧͷԾ૝Խ
    ΧʔωϧͷػೳͰ (ෳ਺ͷ) ಠཱۭͨؒ͠Λ࡞Γग़͠ɼϦιʔεΛ෼ׂɾ෼഑͢Δ
    ·
    ·
    ϓϩηεΛάϧʔϓԽͯ͠ଞͷάϧʔϓͱϦιʔεۭؒΛִ཭
    άϧʔϓԽͨ͠ϓϩηεʹର͢ΔϦιʔε੍ݶ
    -
    -
    8/52

    View full-size slide

  8. ίϯςφͷಛ௃
    ߴີ౓Խ͕Մೳ
    Φʔόʔϔου͕খ͍͞
    ىಈ͕ૣ͍
    ඞͣ͠΋γεςϜΛಈ͔͢ඞཁ͸ͳ͍ (ΞϓϦέʔγϣϯίϯςφ)
    Ծ૝Ϛγϯͷ্Ͱ΋໰୊ͳ͘ಈͥ͘!w
    ҟͳΔ OS ͷγεςϜ / ϓϩάϥϜ͸ಈ͔ͤͳ͍
    ΧʔωϧʹؔΘΔૢ࡞͸Ͱ͖ͳ͍
    ·
    ← 1 ͭͷ OS (Χʔωϧ) ͷΈ͕ಈ࡞͍ͯ͠Δ
    -
    ·
    ← ϋʔυ΢ΣΞͷԾ૝Խ͕ෆཁ
    -
    ·
    ·
    ྫ͑͹ίϯςφ಺Ͱ͸ httpd ͷΈ͕ಈ͍͍ͯΔ
    -
    ·
    ·
    ·
    ίϯςφຖʹϩʔυ͢ΔϞδϡʔϧΛม͑ΔͳͲ
    -
    9/52

    View full-size slide

  9. Linux ʹ͓͚Δίϯςφͷ࣮૷
    10/52

    View full-size slide

  10. Linux ʹ͓͚Δίϯςφ࣮૷
    Χʔωϧͷػೳ (+ ύον) + ΧʔωϧͷػೳΛ࢖͏ userspace πʔϧ
    Χʔωϧ + ύον + userspace πʔϧ
    Χʔωϧ + userspace πʔϧ
    ·
    OpenVZ / Virtuozzo(঎༻)
    Linux VServer
    -
    -
    ·
    LXC
    libvirt (lxc υϥΠό)
    systemd(systemd-nspawn)
    vzctl for upstream kernel
    -
    -
    -
    -
    11/52

    View full-size slide

  11. LXC
    LXC (http://lxc.sourceforge.net/)
    libvirt (ͷLXCίϯςφυϥΠό) (http://libvirt.org/)
    ͲͪΒ΋ಉ͡ "LXC" ͱ͍͏໊લΛ࢖͍ͬͯΔ͕ɼઃఆϑΝΠϧ͸ผʑɽΧʔωϧ
    ͷಉ͡ػೳΛ࢖ͬͨผͷ࣮૷ɽ
    ͜ͷηογϣϯͰ͸ɼ"LXC" ͸લऀΛࢦͯ͠࢖͍·͢ɽޙऀ͸ "libvirt" ͱ͠·
    ͢ɽ
    ·
    Linux ͷίϯςφΛૢ࡞͢Δ userspace πʔϧ (ίϚϯυ܈)
    ݱࡏͷ stable ͸ 0.9.0
    ʰUbuntuʱͷίϯςφπʔϧΩοτͷੑ͕֨ڧ͍
    -
    -
    -
    ·
    LXC ଆͰʰΦϨͨͪͷ API Ͱ libvirt ͷίϯςφυϥΠόΛॻ͖௚ͦ͏ʱΈͨ
    ͍ͳ࿩͸͋Δ
    ݱ࣌఺Ͱ·ͩಈ͖͸ඍົ...
    -
    -
    ·
    ·
    12/52

    View full-size slide

  12. Linux ίϯςφ͜ͱ͸͡Ί
    13/52

    View full-size slide

  13. Ubuntu ͰͱΓ͋͑ͣίϯςφΛىಈͯ͠ΈΔ
    ݱࡏͷ LXC ͷࣄ্࣮ͷ։ൃϓϥοτϑΥʔϜ
    lxc σϕϩούʔ = Ubuntu σϕϩούʔ
    ͓ͦΒ͘ Ubuntu ͕ओཁͳ։ൃͷϕʔεɽͦΕҎ֎͸ޙ௥͍ɽ
    ·
    ·
    ·
    # apt-get install lxc
    # lxc-create -n ct01 -t ubuntu
    # lxc-start -n ct01 -d
    # lxc-console -n ct01
    12.04LTS Λ࢖ͬͯΔ৔߹ Ubuntu ࠷৽൛ͷ kernel ͷόοΫϙʔτͰ͋Δ linux-
    current-generic ΛೖΕΔͱ޾͔ͤ΋?
    ·
    ೖΕͳͯ͘΋ͪΌΜͱಈ͖·͢
    3.8 kernel ͕ೖΔͷͰɼ৭ʑͳ໘ͰศརʹͳΔՄೳੑ͕͋Γ·͢ (3.8 kernel
    ʹ͍ͭͯ͸ޙड़)
    -
    -
    # apt-get install linux-current-generic
    14/52

    View full-size slide

  14. ίϯςφͷϓϩηεͷ༷ࢠ
    ਌؀ڥ্ͰίϯςφͷϓϩηεΛݟΔͱ...
    ίϯςφ಺ͰݟΔͱ
    # pstree -p
    init(1)!"!acpid(1041)
    :(snip)
    #!lxc-start(15592)!!!init(15597)!"!cron(15877)
    $ #!dhclient3(15817)
    $ #!getty(15867)
    $ #!getty(15871)
    :(snip)
    init(1)-+-cron(252)
    |-dhclient3(192)
    |-getty(242)
    |-getty(246)
    :(snip)
    15/52

    View full-size slide

  15. ΞϓϦέʔγϣϯίϯςφ
    ίϯςφ಺Ͱ /sbin/init Λىಈ͠ͳͯ͘΋ɼ໨తͷϓϩάϥϜͷΈىಈՄೳ (͜ͷྫ
    ͸ແཧ໼ཧײ͋Γ·͢w)ɽ
    # lxc-start -n ct01 -- /usr/sbin/apache2 -DFOREGROUND
    # pstree -p 15535
    bash(15535)!"!lxc-start(19577)
    %!lxc-start(19708)!!!apache2(19714)!"!apache2(19740)!"!{apache2}(19771)
    $ #!{apache2}(19772)
    $ #!{apache2}(19773)
    :(snip)
    docker ͸ 0.6 ΑΓલ͸ΞϓϦέʔγϣϯίϯςφઐ༻Ͱͨ͠ (γεςϜͷ
    /sbin/init ͸࣮ߦͰ͖ͳ͔ͬͨ)ɽ
    ·
    16/52

    View full-size slide

  16. CentOS 6 Ͱಈ͔͍ͨ͠ΜͰ͚͢Ͳ...
    ύοέʔδ͸ͳ͠
    ࠷৽Ͱͳ͘ɼ0.8.0 or 0.7.5 ลΓΛιʔε͔ΒίϯύΠϧͯ͠ೖΕ·͠ΐ͏ɽ
    ඪ४ʹ͸ςϯϓϨʔτ (lxc-centos) ؚ͕·Εͳ͍ɽgithub/gist Λ୳Ε͹͋Γ·͢
    → lxc-centos
    RedHat ͸ libvirt ࿏ઢͬΆ͍...
    ·
    ·
    CentOS 6 ͷ kernel ͸ 2.6.32 ͰɼίϯςφతʹݟΔͱଠݹͷੲɽഇࢭ͞Εͨ
    ػೳͱ͔ɼະ࣮૷ͷػೳͱ͔...
    ͳͷͰੲͷ࣌఺Ͱͷόʔδϣϯͷํ͕͖ͪΜͱςετ͞Ε͍ͯͯಈ͖·͢ɽ
    ҰԠ࠷৽ (0.9.0) Ͱ΋ಈ͘Α͏ʹ͸࣮૷͞Ε͍ͯ·͕͢...
    ࣮૷͕ෆे෼ͳ net_prio, perf_event cgroup ͸Ϛ΢ϯτ͠ͳ͍
    -
    ns(namespace) cgroup (3.0 Ͱഇࢭ)
    -
    -
    -
    ·
    ·
    RHEL7 ͸ίϯςφαϙʔτͱݴΘΕͯ·͢ͷͰɼlibvirt Ͱ͖ͪΜͱಈ͘Α͏
    ʹௐ੔ͯ͠ग़ՙ͞ΕΔ?
    -
    17/52

    View full-size slide

  17. Linux ʹ͓͚Δίϯςφͷ࢓૊Έ
    18/52

    View full-size slide

  18. Linux ͰίϯςφΛ࣮ݱ͢ΔͨΊͷػೳ
    ϓϩηεΛάϧʔϓԽͯ͠ଞͷάϧʔϓͱִ཭
    άϧʔϓԽͨ͠ϓϩηεʹର͢ΔϦιʔε੍ݶ
    ͦͷଞ
    ·
    → Namespace (໊લۭؒ)
    -
    ·
    → Cgroups (control groups)
    -
    ·
    ωοτϫʔΫ (veth, macvlan)
    έʔύϏϦςΟ
    Checkpoint/Restore (CRIU)
    ͳͲͳͲ...
    -
    -
    -
    -
    19/52

    View full-size slide

  19. Namespace ͷछྨ (1)
    Mount Namespace: 2.4.19
    UTS Namespace: 2.6.19
    PID Namespace: 2.6.24
    ·
    ϓϩηε͔Βݟ͍͑ͯΔϚ΢ϯτͷू߹ɼૢ࡞Λ෼཭͢ΔɽNamespace ಺
    ͷ mount, umount ͸ଞͷ Namespace ʹ͸Өڹ͠ͳ͍
    (ࢀߟ) Ϛ΢ϯτ໊લۭؒΛద༻͢Δ(IBM developerWorks)
    -
    -
    ·
    ϗετ໊ͳͲɼuname(2) ͕ฦ͢஋ͷू߹Λ෼཭ɽsetdomainname(2),
    sethostname(2) Ͱ Namespace ಺ͷ஋ͷΈมߋͰ͖Δ
    -
    ·
    PID ۭؒͷ෼཭ɽ৽͍͠ PID NamespaceͰ͸ PID 1 ͔Β࢝·Δ PID ׂ͕Γ
    ౰ͯΒΕΔɽ਌͔Βࢠͷ PID Namespace ͸ݟ͑Δ (਌ͷۭؒͷ PID Λ࣋ͭ)
    ͕ɼࢠ͔Β਌͸ݟ͑ͳ͍
    -
    20/52

    View full-size slide

  20. Namespace ͷछྨ (2)
    IPC Namespace: 2.6.19
    User Namespace: 2.6.23 ~ 3.8
    Network Namespace: 2.6.26
    ·
    SysV IPC ΦϒδΣΫτɼPOSIX ϝοηʔδΩϡʔͷִ཭
    -
    ·
    ಠཱͨ͠ UID/GID ۭؒͱ֎෦ۭؒͷϚοϐϯά (ྫ͑͹ɼִ཭ۭؒͰ͸
    uid/gid 0/0ɼ֎෦Ͱ͸ 1000/1000 ͱ͔ՄೳʹͳΔ)
    -
    ·
    ωοτϫʔΫϦιʔεͷִ཭ɽωοτϫʔΫσόΠεɼΞυϨεɼϧʔςΟ
    ϯάςʔϒϧɼιέοτɼϑΟϧλϦϯά
    -
    21/52

    View full-size slide

  21. Namespace ͷૢ࡞
    clone(2) Ͱ৽͍͠ϓϩηε Λੜ੒
    unshare(2) Ͱ৽͍͠ϓϩ ηεΛੜ੒ͤͣʹ࣮ߦίϯςΩετΛ੍ޚ͢Δ
    setns(2) ͰϓϩηεΛطଘ ͷNamespaceʹؔ࿈෇͚Δ
    ·
    ·
    unshareͷ࢖༻ྫ
    -
    ·
    22/52

    View full-size slide

  22. Cgroup (1)
    ϓϩηεΛάϧʔϓԽ͠ɼάϧʔϓʹରͯ͠Ϧιʔε੍ݶΛߦ͏ɽผʹίϯςφઐ
    ༻ͷ࢓૊ΈͰ͸ͳ͍ɽ
    cpu
    cpuacct
    cpuset
    ·
    CFS(Completely Fair Scheduler) bandwidth controlɽ୯Ґ࣌ؒ಺ͷάϧʔϓ
    ಺ͷλεΫ͕࣮ߦͰ͖Δ߹ܭ࣌ؒΛ੍ݶ͢Δ (3.2 Ͱ࣮૷)
    ૬ର഑෼ɽάϧʔϓؒͷ CPU ࣌ؒͷׂ౰ͷׂ߹Λࢦఆ͢Δɽྫ͑͹
    GroupA=100, GroupB=50 ͱ͢Δͱ A:B = 2:1
    -
    (ࢀߟ) Linux 3.2 ͷ CFS bandwidth control
    -
    -
    ·
    άϧʔϓ಺ͷ CPU ϦιʔεͷϨϙʔτ (CPU ࣌ؒ)
    -
    ·
    ׂΓ౰ͯΔ CPU, ϝϞϦϊʔυͷׂ౰
    -
    23/52

    View full-size slide

  23. Cgroup (2)
    device
    freezer
    memory
    blkio (Block IO)
    ·
    σόΠε΁ͷΞΫηεڐՄɼ੍ݶͷࢦఆ
    -
    ·
    άϧʔϓ಺ͷϓϩηεΛશͯҰ࣌ఀࢭ͢Δ
    -
    ·
    ϝϞϦϦιʔεͷ੍ݶ (ϢʔβϝϞϦɼΧʔωϧϝϞϦ)
    -
    ·
    I/O weight controller (2.6.33 Ҏ߱) άϧʔϓͷ༏ઌ౓Λࢦఆ͢Δ
    I/O throttling (2.6.37 Ҏ߱) άϧʔϓ಺ͷϓϩηεͷσόΠεʹର͢Δ
    bytes/second ͷ߹ܭͷࢦఆ
    -
    -
    (ࢀߟ) Linux 2.6.37 ͷ৽ػೳ "I/O throttling"
    -
    24/52

    View full-size slide

  24. Cgroup (3)
    hugetlb
    perf_event
    net_cls
    net_prio
    ·
    hugetlb ʹର͢Δ੍ݶ (3.6 Ҏ߱)
    mm/hugetlb: add new HugeTLB cgroup
    -
    -
    ·
    άϧʔϓ୯ҐͰ perf πʔϧͰϞχλϦϯά (ύϑΥʔϚϯεղੳ)
    -
    ·
    ύέοτʹࣝผࢠΛ͚ͭɼτϥϑΟοΫίϯτϩʔϧ (tc) ͰίϯτϩʔϧՄ
    ೳʹ
    -
    ·
    άϧʔϓؒͰͷωοτϫʔΫͷ༏ઌ౓ΛΠϯλʔϑΣʔεຖʹࢦఆ͢Δ
    Linux 3.3 ͷ৽ػೳ Network priority cgroup
    Linux 3.3 ͷ৽ػೳ Network priority cgroup (2)
    -
    -
    -
    25/52

    View full-size slide

  25. Cgroup (4)
    Cgroup ͸ίϯςφͱؔ܎ͳ͘࢖༻Մೳ
    # mount -t tmpfs cgroup_root /sys/fs/cgroup
    # mkdir /sys/fs/cgroup/memory
    # mount -t cgroup -o memory cgroup /sys/fs/cgroup/memory (ϝϞϦαϒγεςϜͷϚ΢ϯτ)
    # mkdir /sys/fs/cgroup/memory/test01 ("test01" ͱ͍͏άϧʔϓͷ࡞੒)
    # echo $$ > /sys/fs/cgroup/memory/test01/tasks (ϓϩηεΛάϧʔϓʹొ࿥)
    # cat /sys/fs/cgroup/memory/test01/tasks (άϧʔϓ಺ͷϓϩηεͷ֬ೝ)
    2824
    2837
    # echo 30M > /sys/fs/cgroup/memory/test01/memory.limit_in_bytes
    (άϧʔϓʹରͯ͠ϝϞϦ্ݶ 30M ͱ͍͏੍ݶΛઃఆ)
    # cat /sys/fs/cgroup/memory/test01/memory.limit_in_bytes (੍ݶ஋ͷ֬ೝ)
    31457280
    # cat /sys/fs/cgroup/memory/test01/memory.usage_in_bytes (ݱࡏͷ࢖༻ྔͷ֬ೝ)
    565248
    26/52

    View full-size slide

  26. LXC Ͱ࢖͏ωοτϫʔΫػೳ ʙ veth
    OpenVZ/Virtuozzo ༝དྷͷػೳ
    ରͱͳΔΠϯλʔϑΣʔεΛੜ੒͠ɼΠϯλʔ
    ϑΣʔεؒͰ௨৴Λߦ͏ (Layer2 ͷτϯωϧ)
    ରͷยํΛϗετଆͷϒϦοδʹɼยํΛίϯ
    ςφʹ઀ଓ (ίϯςφଆͷΠϯλʔϑΣʔε͸
    ίϯςφͷ Network Namespace ʹଐ͢ΔΑ͏
    ʹઃఆ͞ΕΔͷͰϗετ͔Β͸ݟ͑ͳ͍)
    ·
    ·
    ·
    27/52

    View full-size slide

  27. LXC Ͱ࢖͏ωοτϫʔΫػೳ ʙ macvlan
    ෺ཧΠϯλʔϑΣʔεʹผͷ MAC ΞυϨε͕෇͍ͨ৽͍͠ΠϯλʔϑΣʔεΛ
    ࡞੒ɽ͜ͷΠϯλʔϑΣʔεΛίϯςφʹׂ౰
    ෺ཧΠϯλʔϑΣʔεΛͦͷ··࢖͏ͷʹ͍ۙͷͰෛՙ͕௿͘ɼύϑΥʔϚϯε
    ͕ྑ͍܏޲
    (ࢀߟ) macvlanΛ࢖ͬͯΈΔ (ᱜӍͷΧʔωϧ୳ݕୂʢ୞ࠓૺ೉த͆)
    lxc ͷԾ૝ωοτϫʔΫͷύϑΥʔϚϯεଌఆ
    ·
    ෺ཧΠϯλʔϑΣʔεΛ promiscuous Ϟʔυʹͯ֘͠౰ MAC ΞυϨεͷύ
    έοτΛड͚औΔ
    Ϟʔυͷઃఆ͕ଘࡏ: private, vepa, bridge
    -
    -
    ·
    ·
    ·
    28/52

    View full-size slide

  28. Linux Kernel ࠷৽ಈ޲
    29/52

    View full-size slide

  29. Linux 3.8
    LXC తͳࢹ఺͔Β͢Δͱɼίϯςφ࣮ݱʹඞཁͳओཁػೳ͕ἧͬͨόʔδϣϯɽ
    30/52

    View full-size slide

  30. Linux 3.8 ͷ৽ػೳ - User Namespace
    User Namespace
    ·
    LXC ͷηΩϡϦςΟ͸? ͱ͍͏ FAQ ʹର͢Δճ౴
    ͨͩ͠ɼ3.8 ͰͱΓ͋͑ͣ׬੒ͨ͠΋ͷͷɼରԠ͢Δ࣮૷͕ͳ͞Ε͍ͯͳ͍
    filesystem ͕ଟ͘ɼࣄ্࣮࢖͑ͳ͍ঢ়ଶɽ3.9 Ͱ XFS Λআ͍࣮ͯ૷׬ྃ
    /proc/PID/uid_map, /proc/PID/gid_map ϑΝΠϧʹϚοϐϯά৘ใΛॻ͘
    -
    -
    -
    0 100000 10000 (Namespace಺ͷIDͷ։࢝ Namespace֎ͷIDͷ։࢝ ൣғ)
    Linux 3.8 ͷ User Namespace ػೳ(1), (2), (3), (4)
    ·
    31/52

    View full-size slide

  31. Linux 3.8 ͷ৽ػೳ - setns(2) ͕࣮༻తʹ (1)
    ࣮͸ User Namespace Ҏ্ʹॏཁͳ৽ػೳ
    Namespace Λࢦࣔ͢͠ಛघͳϑΝΠϧ͕ /proc/PID/ns ҎԼʹଘࡏ͢Δɽ3.8 Α
    Γલ͸͜ͷϑΝΠϧ͕ ipc, net, uts ͷΈ͔͠ଘࡏ͠ͳ͔ͬͨ
    ϓϩηεΛطଘͷ Namespace ʹೖΕΔʹ͸ setns ʹ͜ͷಛघͳϑΝΠϧͷϑΝ
    ΠϧσΟεΫϦϓλΛ༩͑Δඞཁ͕͋Δ
    ·
    ·
    -r-------- 1 root root 0 Mar 1 15:41 ipc
    -r-------- 1 root root 0 Mar 1 15:41 net
    -r-------- 1 root root 0 Mar 1 15:41 uts
    ·
    ͭ·Γ 3.8 ΑΓલ͸ Namespace ֎෦͔Β Namespace ಺ͰίϚϯυΛ࣮ߦ
    ͢Δࣄ͕Ͱ͖ͳ͍έʔε͕΄ͱΜͲͩͬͨ
    -
    32/52

    View full-size slide

  32. Linux 3.8 ͷ৽ػೳ - setns(2) ͕࣮༻తʹ (2)
    3.8 Ͱશͯͷ Namespace ʹର͢ΔಛघͳϦϯΫ͕ଘࡏ͢ΔΑ͏ʹͳͬͨ
    ·
    lrwxrwxrwx 1 root root 0 3݄ 1೔ 14:59 ipc -> ipc:[4026532301]
    lrwxrwxrwx 1 root root 0 3݄ 1೔ 15:06 mnt -> mnt:[4026532299]
    lrwxrwxrwx 1 root root 0 3݄ 1೔ 15:06 net -> net:[4026532304]
    lrwxrwxrwx 1 root root 0 3݄ 1೔ 15:06 pid -> pid:[4026532302]
    lrwxrwxrwx 1 root root 0 3݄ 1೔ 15:06 uts -> uts:[4026532300]
    3.8 ͰͲͷ Namespace ʹରͯ͠΋ setns ͕࣮ߦͰ͖ΔΑ͏ʹͳΓɼίϯςφ֎
    ෦͔Β಺෦ͷίϚϯυΛ࣮ߦՄೳʹͳͬͨɽ
    ಉ͡ Namespace ʹଐ͍ͯ͠Δ৔߹ɼϦϯΫ͸ಉ͡ inode Λࢦ͢ (stat() Ͱ؆୯ʹ
    ௐ΂ΒΕΔ)
    Linux 3.8 Ͱվྑ͞Εͨ Namespace ػೳͱ lxc-attach ίϚϯυ
    ·
    ·
    ·
    33/52

    View full-size slide

  33. Linux 3.8 ͷ৽ػೳ - Memory Cgroup ͷ Kernel
    Memory αϙʔτ
    TCP Buffer ʹର͢Δ੍ݶ͸ 3.3 Ͱ࣮૷ (ଞͷ Memory controller ͷ࣮૷ͱ͸͔ͳ
    Γҧ͏)
    ελοΫͱεϥϒͷΞΧ΢ϯςΟϯάΛαϙʔτ
    Linux 3.8 Ͱվྑ͞Εͨ memory cgroup (2)
    ·
    Linux 3.3 ͷ৽ػೳ Per-cgroup TCP buffer limits, (2), (3)
    -
    ·
    ·
    34/52

    View full-size slide

  34. Linux 3.9 ͷ৽ػೳ
    User Namespace ػೳͷ༷ʑͳ෦෼΁ͷ࣮૷͕ਐΉ
    blkio ͷ I/O weight controller ͷ׬શ֊૚ߏ଄αϙʔτ
    ·
    userns: Allow the unprivileged users to mount mqueue fs
    userns: Allow the userns root to mount of devpts
    userns: Allow the userns root to mount ramfs.
    userns: Allow the userns root to mount tmpfs.
    userns: Allow unprivileged reboot
    ͦͷଞɼxfs Λআ֤͘छϑΝΠϧγεςϜͳͲ
    -
    -
    -
    -
    -
    -
    ·
    35/52

    View full-size slide

  35. Linux 3.10 ͷ৽ػೳ
    perf_event cgroup ͷ֊૚ߏ଄αϙʔτ
    device cgroup ͷΞΫηεݖมߋ࣌ͷࢠଙํ޲΁ͷ఻ൖ
    sane_behavior Φϓγϣϯ
    memory cgroup ͷ memory pressure Ϩϕϧͷ௨஌αϙʔτ
    ·
    ·
    ·
    ·
    36/52

    View full-size slide

  36. Linux 3.10 ͷ৽ػೳ memory cgroup ͷ memory
    pressure Ϩϕϧͷ௨஌
    ैདྷ͔Β͋Δ eventfd Λ࢖ͬͨ௨஌ͱಉ༷ͷํ๏ͰϝϞϦͷ Pressure Ϩϕϧͷ
    ௨஌͕ड͚ΒΕΔΑ͏ʹͳͬͨɽ
    "low", "medium", "critical" ͷ 3 Ϩϕϧ
    Linux 3.10 Ͱ memory cgroup ʹ௥Ճ͞Εͨ Memory Pressure ௨஌ػೳ
    ·
    ैདྷ͸ɼϝϞϦͷ͖͍͠஋Λઃఆͯ͠஋Λ·͍ͨͩ࣌ɼOOM Killer ͕ൃಈ͠
    ͨ࣌ͷ௨஌
    -
    ·
    ·
    37/52

    View full-size slide

  37. Linux 3.11 ͷ৽ػೳ
    blkio I/O throttling ͷ׬શ֊૚ߏ଄αϙʔτ
    ·
    ͨͩ͠ɼ"sane_behavior" ΦϓγϣϯΛ෇͚ͨͱ͖ͷΈ
    -
    38/52

    View full-size slide

  38. cgroup ࠶ઃܭ ʙ ݱࡏͷ cgroup ͷ໰୊఺
    ࠓͷ cgroup ͸·ͱ΋͡Όͳ͍!
    (ࢀߟ) Linux Χʔωϧͷ͢΂ͯ: cgroup ͷ࠶ઃܭ (ݪจ)
    (ࢀߟ) Changes coming for systemd and control groups
    ·
    ඪ४తͳΧʔωϧͷ API ͔Β͔ͳΓҳ୤͍ͯ͠Δ
    ϑΝΠϧγεςϜ͔ͩΒΞΫηεݖ͑͋͞Ε͹୭Ͱ΋ΧʔωϧΛ੍ޚͰ͖Δ
    αϒγεςϜຖʹগͣͭ͠ಈ͖͕ҧͬͨΓ
    ৭ʑͳॴʹϚ΢ϯτͰ͖ͨΓ
    ෆඞཁʹෳࡶ
    -
    -
    -
    -
    -
    ·
    ·
    39/52

    View full-size slide

  39. cgroup ࠶ઃܭ
    Ͱ΋ࠓͷ cgroup ͱޓ׵ੑΛอͬͨ··શ෦·ͱ΋ʹ͢Δͷ͸ෆՄೳ
    ͡Ό͋ɼͱΓ͋͑ͣग़དྷͦ͏ͳॴΛ΍Ζ͏
    ·
    ·
    ୯Ұ֊૚ߏ଄
    sane_behavior Φϓγϣϯ
    -
    cgroup ͸ systemd (΍ଞͷιϑτ)
    ͕࡞੒ͯ͠؅ཧ͢ΔΑ͏ʹͯ͠ɼ୭Ͱ
    ΋ cgroup Λ௚઀͍͡Δ͜ͱ͕Ͱ͖ͳ͍Α͏ʹ͠Α͏!
    -
    -
    αϒγεςϜಠಛͷมͳػೳΛࢭΊͯҰ؏ੑͷ͋Δಈ͖Λڧ੍͢Δ
    cgroupfs ͷϚ΢ϯτΦϓγϣϯ noprefix ͱ clone_children ͕ڐՄ͞Ε
    ͳ͘ͳΔ
    remount Ͱ͖ͳ͍ ͳͲ
    (ࢀߟ) cgroup: introduce sane_behavior mount option
    -
    -
    -
    -
    40/52

    View full-size slide

  40. Kernel ͷίϯςφؔ܎ػೳͷࠓޙ ~ ͦͷଞ
    XFS ͷ User Namespace ରԠ (3.12)
    quota
    Device Namespace
    ·
    ·
    ఆظతʹ༙͍ͯग़ͯ͘Δ࿩୊
    container disk quota (2012೥5݄)
    ͦͷޙͲ͏ͳͬͨͷ͔௥͍ͬͯ·ͤΜ
    -
    -
    -
    ·
    DeviceNamespace (Cellrox)
    -
    Android ͳͲͷϞόΠϧσόΠεͰෳ਺ͷ؀ڥΛ੾Γସ͑ͳ͕Β࢖͏ͷ
    Λ໨తʹ։ൃ͞Ε͍ͯΔΑ͏ͩ
    Device Namespaces (lxc-devel, containers ML) ลΓ͔Βٞ࿦͕੝Γ্
    ͕͍ͬͯΔ
    -
    -
    41/52

    View full-size slide

  41. Kernel ͷίϯςφؔ܎ػೳͷࠓޙ ~ ͦͷଞ
    Syslog Namespace
    /proc ͷ memory ͳͲͷ౷ܭ஋
    checkpoint/restore ؔ܎ػೳͷػೳ௥Ճ͕සൟʹߦΘΕ͍ͯΔ
    ·
    Stepping closer to practical containers: "syslog" namespaces (lwn.net)
    Add namespace support for syslog
    -
    -
    ·
    ·
    42/52

    View full-size slide

  42. LXC ࠷৽ಈ޲
    43/52

    View full-size slide

  43. LXC ͷݱঢ়
    Ubuntu 12.04LTS
    ࠷৽൛ 0.9.0
    ·
    0.7.5 ͕ͩɼத਎͸΄΅ 0.8.0
    ηΩϡϦςΟతʹϠό͍ॴ͸ AppArmor Ͱ཈͑͜ΜͰͻͱ·ͣ࠷௿ݶ࢖͑Δ
    ঢ়ଶʹ
    ࣗ෼Ͱίϯςφ࡞੒ɼىಈͯࣗ͠෼Ͱܰ͘࢖͏ʹ͸े෼
    -
    -
    -
    ·
    API ެ։(liblxc)ɼpython3, lua όΠϯσΟϯά
    seccomp αϙʔτ
    ίϯςφىಈɼఀࢭ࣌ͷ֤ஈ֊ͰͷϑοΫ͕Մೳʹ
    -
    -
    -
    44/52

    View full-size slide

  44. LXC ։ൃͷݱঢ়
    ։ൃମ੍ͷมߋ
    1.0 ʹ޲͚ͯઈࢍ࢓্͛த
    ·
    ϝΠϯͷϝϯςφ͕ɼDaniel Lezcano ࢯଟ๩ͷͨΊɼSerge Hallyn,
    Stéphane Graber ྆ࢯ (Ubuntu) ʹมߋ
    ϦϙδτϦ΋ sourceforge ͔Β github ΁
    -
    -
    ·
    ݱࡏ 1.0 alpha1 (Linux Plumbers ʹ޲͚ͯͱΓ͋͑ͣ·ͱΊͨײ)
    10݄: alpha2ɼ11݄: alpha3ɼ12݄: rc1ɼ1݄: rc2ɼ2݄ 1.0final
    Ubuntu ͷ࣍ͷ LTS ͕λʔήοτɽ(= 1.0 ͸ 5 ೥ؒαϙʔτ͞ΕΔ)
    -
    alpha1 ͷλά͕ଧͨΕͨޙ΋ɼ·ͩ·ͩ৽ػೳ͕௥Ճ͞Ε·͍ͬͯ͘Δ
    ͷͰɼ1.0 ʹͳΔ࣌ʹͲ͏ͳΔ͔͸ಡΊͯ·ͤΜ (^_^;)
    -
    -
    -
    45/52

    View full-size slide

  45. lxc-1.0 (1)
    ໨৽͍͠ػೳͱ͍͏ΑΓ͸ɼ1.0 ͱͯ͠;͞Θ͘͠ͳΔΑ͏ʹॾʑ੔උΛ͍ͯ͠Δײ
    ͡ɽ
    API ͷ੔උ (stable ͳ API ΁) ͱ֤ίϚϯυΛ API ϕʔεͰॻ͖௚͠
    Ϋϩʔϯɼεφοϓγϣοτػೳͷ৽͍࣮͠૷
    console ͷѻ͍ͷվྑ
    ςϯϓϨʔτͷվྑɼόάϑΟοΫε
    ඇಛݖίϯςφʹ޲͚ͯͷ࠷ॳͷҰา (User Namespace)
    ·
    ·
    announcing lxc-snapshot (S3hh's Blog)
    -
    ·
    ·
    ·
    (ࢀߟ) Creating and using containers – without privilege (S3hh's Blog) ... ࢼ
    ͯ͠Έͨ΋ͷͷ͏·͍͔͘ͳ͔ͬͨ (;_;)
    lxc-user-nic (veth ϖΞ࡞ΔͷʹϗετଆͰ͸ಛݖඞཁ)
    lxc-usernsexec (ఆٛ͞Εͨ uid/gid ϚοϐϯάΛ࢖ͬͯϢʔβ Namespace
    ͰϓϩάϥϜΛىಈ)
    shadow ΋ಉ࣌ʹ্͛Δඞཁ͕͋Δ (newuidmap, newgidmap ίϚϯυ)
    -
    -
    -
    -
    46/52

    View full-size slide

  46. lxc-1.0 (2)
    ετϨʔδόοΫΤϯυ
    ϞχλϦϯάͷվྑ
    Android NDK ͰͷϏϧυ
    ೔ຊޠ man (!!)
    ·
    ࠶ઃܭɼ੔උ
    overlayfs ରԠɼoverlayfs Λ࢖ͬͨ clone
    zfs ରԠ (create, clone, snapshot)
    -
    -
    -
    ·
    ࠓ·Ͱಉ࣌ʹෳ਺ͷίϯςφͷϞχλϦϯάͱ͔Ͱ͖ͳ͔ͬͨ
    -
    ·
    ·
    47/52

    View full-size slide

  47. ࠷ޙʹ
    48/52

    View full-size slide

  48. ϝʔϦϯάϦετ / ຋༁
    lxc JP άϧʔϓ
    lxc man pages ຋༁
    ·
    ίϯςφͷ࿩Λ·ͬͨΓ΍͍ͬͯ·͢ɽͨ·ʔʹ͔͠ϝʔϧ͸དྷ·ͤΜɽ
    lxc-jp ͱ͍͏໊લͰ͕͢ɼ࿩୊͸ LXC ʹݶΒͣԿͰ΋ OK Ͱ͢ɽ
    -
    ·
    https://github.com/tenforward/lxc-doc-ja Ͱ΍ͬͯ·͕ͨ͠ɼlxc ຊՈʹϚ
    ʔδ͞ΕͨͷͰͲ͏຋༁Λ͢͢Ί͍͔ͯ͘ߟ͑ͯ·͢ɽڠྗ௖͚Δํ͕͍Β
    ͬ͠ΌΕ͹͝࿈བྷ͍͚ͨͩΕ͹ͱࢥ͍·͢ɽ຋༁࡞ۀࣗମ͸ผͷॴͰ΍ͬͯ
    ͔Β͋Δఔ౓·ͱΊͯຊՈʹ Pull Request ͨ͠ํ͕ྑ͍͔ͱࢥ͍ͬͯ·͢ɽ
    -
    49/52

    View full-size slide

  49. ࠓޙฉ͍ͯΈ͍ͨ࿩
    RHEL7 / libvirt ͷίϯςφ࣮૷
    docker ํ໘ͷॾʑ
    ׆༻ࣄྫ
    ίϯςφؔ࿈࣮૷ͷ΋ͬͱਂ͍࿩
    Apache Mesos
    CRIU
    ·
    ·
    ·
    ·
    ·
    ·
    50/52

    View full-size slide


  50. Important contact information goes here.
    twitter @ten_forward
    www www.ten-forward.ws/
    github github.com/tenforward

    View full-size slide