Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Linuxコンテナの基本と最新情報 (2014-11-14)

tenforward
November 14, 2014

Linuxコンテナの基本と最新情報 (2014-11-14)

第5回コンテナ型仮想化の情報交換会の発表資料です。
参考となる情報にはPDF中からリンクをしていますが、資料中のリンクは Speaker Deck 上ではクリックできないので PDF をダウンロードしてご覧ください。

tenforward

November 14, 2014
Tweet

More Decks by tenforward

Other Decks in Technology

Transcript

  1. Linuxίϯςφͷجຊͱ࠷৽৘ใ
    ୈ 5 ճ ίϯςφܕԾ૝Խͷ৘ใަ׵ձˏେࡕ
    Ճ౻ହจ
    2014-11-14
    Ճ౻ହจ Linux ίϯςφͷجຊͱ࠷৽৘ใ 2014-11-14 1 / 30

    View full-size slide

  2. ୭?
    Ճ౻ହจ
    ϑΝʔεταʔόגࣜձࣾɹج൫։ൃ෦
    ΤϯδχΞืूதͰ͢
    http://www.ten-forward.ws/
    @ten forward
    http://gplus.to/tenforward
    https://github.com/tenforward
    http://d.hatena.ne.jp/defiant/
    Ճ౻ହจ Linux ίϯςφͷجຊͱ࠷৽৘ใ 2014-11-14 2 / 30

    View full-size slide

  3. ୭?
    2010 ೥ࠒʹ cgroup ͷௐࠪΛ࢝Ίͨͷ͕͖͔͚ͬͰίϯςφ
    पลΛ৭ʑ͓͔͚ͬͯͨͷ͕ߴͯ͜͡ͷษڧձΛ΍ͬͯ·͢
    LXC ΁ͷίϛοτ
    ೔ຊޠ man pages
    ࠷ۙ͸গ͠ίʔυ΋
    Ճ౻ହจ Linux ίϯςφͷجຊͱ࠷৽৘ใ 2014-11-14 3 / 30

    View full-size slide

  4. ୭?
    Plamo Linux ϝϯςφ
    LXC ͰֶͿίϯςφೖ໳ɹʔܰྔԾ૝Խ؀ڥΛ࣮ݱ͢Δٕज़
    gihyo.jp Ͱ࿈ࡌ
    ʲվగ৽൛ʳLinux ΤϯδχΞཆ੒ಡຊ (ٕज़ධ࿦ࣾ)
    Ճ౻ହจ Linux ίϯςφͷجຊͱ࠷৽৘ใ 2014-11-14 4 / 30

    View full-size slide

  5. Linuxίϯςφͷجૅ
    (͓͞Β͍)
    Ճ౻ହจ Linux ίϯςφͷجຊͱ࠷৽৘ใ 2014-11-14 5 / 30

    View full-size slide

  6. ίϯςφͱ͸
    Χʔωϧ͕࣋ͭػೳͰಠཱۭͨؒ͠Λ࡞Γग़͠ɺϦιʔεΛ
    ෼ׂɾ෼഑͢Δ
    ϓϩηεΛάϧʔϓԽͯ͠ଞͷάϧʔϓͱϦιʔεۭؒΛִ཭
    άϧʔϓԽͨ͠ϓϩηεʹର͢ΔϦιʔε੍ݶ
    Ճ౻ହจ Linux ίϯςφͷجຊͱ࠷৽৘ใ 2014-11-14 6 / 30

    View full-size slide

  7. LinuxͰίϯςφΛ࣮ݱ͢ΔͨΊͷओͳػೳ
    Namespace(໊લۭؒ)
    ϓϩηεΛάϧʔϓԽͯ͠ଞͷάϧʔϓͱִ཭
    Cgroup
    άϧʔϓԽͨ͠ϓϩηεʹର͢ΔϦιʔε੍ݶ
    ωοτϫʔΫ (veth, macvlan)
    chroot (pivot root)
    έʔύϏϦςΟ
    ͳͲʜ
    Ճ౻ହจ Linux ίϯςφͷجຊͱ࠷৽৘ใ 2014-11-14 7 / 30

    View full-size slide

  8. Namespace
    Mount (2.4.19)
    ϓϩηε͔Βݟ͍͑ͯΔϚ΢ϯτͷू߹ɺૢ࡞Λ෼཭
    UTS (2.6.19)
    ϗετ໊ͳͲ uname(2) ͕ฦ͢஋ͷू߹Λ෼཭
    PID (2.6.24)
    PID ۭؒͷ෼཭
    IPC (2.6.19)
    SysV IPC ΦϒδΣΫτɺPOSIX ϝοηʔδΩϡʔ
    User (3.8)
    ಠཱͨ͠ UID/GID ۭؒͱ਌ۭؒͷϚοϐϯά
    Network (2.6.26)
    ωοτϫʔΫϦιʔεͷ෼཭
    Ճ౻ହจ Linux ίϯςφͷجຊͱ࠷৽৘ใ 2014-11-14 8 / 30

    View full-size slide

  9. Cgroup
    cpu
    ୯Ґ࣌ؒ಺ʹάϧʔϓ಺ͷλεΫ͕࣮ߦͰ͖Δ࣌ؒͷ੍ݶ
    (2.6.24)
    άϧʔϓؒͰͷ CPU ࣌ؒͷׂ౰ͷׂ߹Λࢦఆ (3.2)
    cpuacct (2.6.24)
    άϧʔϓ಺ͷ CPU ࣌ؒͷϨϙʔτ
    cpuset (2.6.24)
    ׂΓ౰ͯΔ CPUɺϝϞϦϊʔυͷׂ౰
    device (2.6.26)
    σόΠε΁ͷΞΫηεڐՄɺ੍ݶ
    freezer (2.6.28)
    άϧʔϓ಺ͷϓϩηε͢΂ͯʹରͯ͠Ұ࣌ఀࢭɺ࠶։
    Ճ౻ହจ Linux ίϯςφͷجຊͱ࠷৽৘ใ 2014-11-14 9 / 30

    View full-size slide

  10. Cgroup
    blkio
    άϧʔϓؒͰͷ I/O ͷ༏ઌ౓Λࢦఆ (2.6.33)
    άϧʔϓ಺ͷϓϩηεͷσόΠεʹର͢Δ I/O Λ bps/iops ஋
    Ͱ੍ݶ (2.6.37)
    memory (2.6.29)
    ϝϞϦ࢖༻ྔͷ੍ݶɻϢʔβϝϞϦͱϖʔδΩϟογϡ
    hugetlb (3.6)
    perf event (2.6.39)
    άϧʔϓ୯ҐͰ perf πʔϧͰϞχλϦϯάՄೳ
    net cls (2.6.29)
    άϧʔϓ಺ͷϓϩηε͔Βग़ΔύέοτʹࣝผࢠΛ͚ͭ
    tc,netfilter Ͱ੍ݶ (netfilter ͸ 3.14)
    net prio (3.3)
    άϧʔϓؒͰͷωοτϫʔΫͷΠϯλʔϑΣʔε͝ͱͷ༏ઌ౓
    Ճ౻ହจ Linux ίϯςφͷجຊͱ࠷৽৘ใ 2014-11-14 10 / 30

    View full-size slide

  11. ωοτϫʔΫ
    veth
    ରͱͳΔΠϯλʔϑΣʔεΛ࡞੒͠ɺΠϯλʔϑΣʔεؒͰ௨
    ৴ (L2 τϯωϦϯά)
    macvlan
    ෺ཧΠϯλʔϑΣʔεʹผͷ MAC ΞυϨε͕෇͍ͨ৽͍͠
    ΠϯλʔϑΣʔεΛ࡞੒
    Ճ౻ହจ Linux ίϯςφͷجຊͱ࠷৽৘ใ 2014-11-14 11 / 30

    View full-size slide

  12. Linuxίϯςφ࠷৽৘ใ
    Ճ౻ହจ Linux ίϯςφͷجຊͱ࠷৽৘ใ 2014-11-14 12 / 30

    View full-size slide

  13. ίϯςφؔ࿈ͷࠓޙͷಈ͖
    Cgroup ͷେվ଄
    Memory Cgroup
    Namespace ؔ܎ͷػೳ௥Ճ
    CRIU
    LXC/LXD
    overlayfs
    Ճ౻ହจ Linux ίϯςφͷجຊͱ࠷৽৘ใ 2014-11-14 13 / 30

    View full-size slide

  14. Cgroupେվ଄ (1)
    Cgroup ͷಛ௃͓͞Β͍
    ػೳ͝ͱʹαϒγεςϜʹ෼͔ΕΔ
    cgroupfs ΛϚ΢ϯτͯ͠σΟϨΫτϦͰάϧʔϓΛද͢
    ϓϩηεΛάϧʔϓ಺ͷ tasks ϑΝΠϧʹ௥Ճ͢Δͱؔ࿈͢Δ
    λεΫ͕εϨου୯ҐͰάϧʔϓʹ௥Ճ͞ΕΔ
    ෳ਺֊૚ߏ଄ɻվ଄ߏ଄͝ͱʹҟͳΔπϦʔΛ࡞੒Ͱ͖Δɻͨ
    ͩ͠ɺҰͭͷαϒγεςϜ͕ॴଐͰ͖ΔπϦʔ͸Ұͭ
    πϦʔͷͲͷϨϕϧͷάϧʔϓʹ΋λεΫ͕ॴଐͰ͖Δ
    Ճ౻ହจ Linux ίϯςφͷجຊͱ࠷৽৘ใ 2014-11-14 14 / 30

    View full-size slide

  15. Cgroupେվ଄ (2)
    Cgroup ͷ໰୊఺
    ΧΦε
    ෳ਺ͷ֊૚ͰҟͳΔπϦʔΛ࡞Δ
    αϒγεςϜ͝ͱʹ֊૚ߏ଄ͷಈ͖͕ҧ͏ (਌ͷӨڹ)
    ਌ࢠؒͷάϧʔϓͷؔ܎
    ਌άϧʔϓʹଐ͢Δϓϩηεͱࢠάϧʔϓʹଐ͢Δϓϩηεͷ
    ؔ܎͸? ͔͠΋ͦΕͧΕͷϓϩηεͷࢠϓϩηε΍εϨου·
    Ͱߟ͑Δͱ!?
    ؅ཧ୯Ґͷ໰୊
    ϝϞϦ͸ϓϩηε୯Ґͷ؅ཧͳͷʹεϨου୯ҐͰొ࿥
    αϒγεςϜ͕ػೳ͝ͱʹΘ͔Ε͍ͯͯɺෳ਺֊૚ߏ଄͕࣋ͯ
    ΔͷͰɺαϒγεςϜಉ࢜ͷڠௐಈ࡞͕೉͍͠
    Ճ౻ହจ Linux ίϯςφͷجຊͱ࠷৽৘ใ 2014-11-14 15 / 30

    View full-size slide

  16. Cgroupେվ଄ (3)
    sane behavior Φϓγϣϯ (·ͱ΋ͳৼΔ෣͍!!)
    3.16 ͔ΒࢼͤΔ (ͨͩ͋͘͠·Ͱ͓ࢼ͠)

    mount -t cgroup -o __DEVEL__sane_behavior \
    cgroup /path/to/cgroup

    Ճ౻ହจ Linux ίϯςφͷجຊͱ࠷৽৘ใ 2014-11-14 16 / 30

    View full-size slide

  17. Cgroupେվ଄(4)
    ୯Ұ֊૚ߏ଄
    ϓϩηε୯ҐͰ؅ཧ
    ϓϩηε͕ॴଐ͠ͳ͍άϧʔϓ͚͕ͩࢠάϧʔϓΛ࣋ͯΔ
    (ϧʔτΛআ͘)
    ֊૚͝ͱʹ༗ޮʹͰ͖ΔαϒγεςϜΛࢦఆͰ͖Δɻͨͩ͠ɺ
    ਌άϧʔϓͰ༗ޮʹͳ͍ͬͯΔαϒγεςϜͷΈ࢖༻Մೳ
    άϧʔϓʹଐ͢Δϓϩηε͕ͳ͘ͳͬͨ௨஌Λ poll ͱ
    [id]notify Ͱड͚औΕΔ (release agent ഇࢭ)
    ৄ͘͠͸
    Linux 3.16 ͔ΒࢼͤΔ cgroup ͷ୯Ұ֊૚ߏ଄ (1)
    Linux 3.16 ͔ΒࢼͤΔ cgroup ͷ୯Ұ֊૚ߏ଄ (2)
    Ճ౻ହจ Linux ίϯςφͷجຊͱ࠷৽৘ใ 2014-11-14 17 / 30

    View full-size slide

  18. Memory CgroupͷKernel Memory੍ݶ
    memory αϒγεςϜͰΧʔωϧϝϞϦͷ੍ݶ
    ػೳͱͯ͠͸ଘࡏ͢Δ͕ɺઈࢍ։ൃத
    Ճ౻ହจ Linux ίϯςφͷجຊͱ࠷৽৘ใ 2014-11-14 18 / 30

    View full-size slide

  19. Namespaceؔ࿈
    σόΠεؔ࿈ͷٞ࿦͕೤͍
    ݱࡏɺσόΠε͸Ծ૝Խ͞Ε͓ͯΒͣϗετͱڞ௨ (Cgroup
    ʹΑΔ੍ݶͷΈ)
    ৽͍͠σόΠε͕௥Ճ͞Ε͔ͨΒͱݴͬͯશίϯςφʹ udev
    ͷΠϕϯτ͕ඈͿҙຯ͸͋·Γͳ͍
    ͔͠͠ҙຯͷ͋ΔσόΠε΋͋ΔͩΖ͏
    Loop
    Fuse
    console, X display, iscsi ͳΜ͔΋ඞཁͱ͍͏࿩΋
    User Namespace ͷ root ͕ߦ͑Δಈ࡞ͷݕ౼
    ίϯςφ಺͔ΒϑΝΠϧγεςϜͷϚ΢ϯτ
    ৽͍͠ Namespace ͷύονͷఏҊ
    Log Namespace
    Cgroup Namespace (!)
    Ҏલ ns cgroup ͱ͍͏΋ͷ͕͕͋ͬͨͦΕͱ͸ผ
    Ճ౻ହจ Linux ίϯςφͷجຊͱ࠷৽৘ใ 2014-11-14 19 / 30

    View full-size slide

  20. CRIU(1)
    http://criu.org/
    OpenVZ ϓϩδΣΫτͷ Checkpoint/Restore ࣮૷
    ΞϓϦέʔγϣϯͷ͋Δ࣌఺ͷঢ়ଶΛอଘ͠ɺ࠶։Ͱ͖Δ
    Χʔωϧ 3.11 Ҏ߱Ͱ࢖༻Մೳ
    Ճ౻ହจ Linux ίϯςφͷجຊͱ࠷৽৘ใ 2014-11-14 20 / 30

    View full-size slide

  21. CRIU(2)

    ubuntu@criu1:~$ sudo lxc-start -n ct01
    ubuntu@criu1:~$ sudo lxc-checkpoint -v -n ct01 -s -D /tmp/checkpoint (νΣο
    ΫϙΠϯτॲཧޙʹίϯςφఀࢭ)
    ubuntu@criu1:~$ sudo lxc-ls --fancy
    NAME STATE IPV4 IPV6 GROUPS AUTOSTART
    --------------------------------------------
    ct01 STOPPED - - - NO
    ubuntu@criu1:~$ ls /tmp/criu/
    cgroup.img fdinfo-17.img inventory.img pages-15.img
    core-170.img fdinfo-18.img ipcns-msg-9.img pages-16.img
    core-176.img fdinfo-2.img ipcns-sem-9.img pages-17.img
    core-1.img fdinfo-3.img ipcns-shm-9.img pages-1.img
    core-260.img fdinfo-4.img ipcns-var-9.img pages-2.img
    core-261.img fdinfo-5.img iptables-8.img pages-3.img
    : (snip)
    ubuntu@criu1:~$ sudo rsync -avz --devices --rsync-path="sudo rsync" \
    /var/lib/lxc/ct01 [email protected]:/var/lib/lxc
    ubuntu@criu1:~$ sudo rsync -avz --rsync-path="sudo rsync" \
    /tmp/checkpoint [email protected]:/tmp

    Ճ౻ହจ Linux ίϯςφͷجຊͱ࠷৽৘ใ 2014-11-14 21 / 30

    View full-size slide

  22. CRIU(3)

    ubuntu@criu2:~$ ls /tmp/criu/
    cgroup.img fdinfo-3.img ipcns-sem-9.img pages-3.img
    core-1.img fdinfo-4.img ipcns-shm-9.img pages-4.img
    core-255.img fdinfo-5.img ipcns-var-9.img pages-5.img
    core-260.img fdinfo-6.img iptables-8.img pages-6.img
    : (snip)
    ubuntu@criu2:~$ sudo lxc-checkpoint -n ct01 -r -D /tmp/checkpoint -v -d
    ubuntu@criu2:~$ sudo lxc-ls -f
    NAME STATE IPV4 IPV6 GROUPS AUTOSTART
    --------------------------------------------------
    ct01 RUNNING 10.0.3.200 - - NO

    Ճ౻ହจ Linux ίϯςφͷجຊͱ࠷৽৘ใ 2014-11-14 22 / 30

    View full-size slide

  23. LXCؔ࿈
    LXC 1.1.0 ʹ޲͚ͯ։ൃத
    LXC 1.1.0.alpha2 Ͱগ͠଍౿Έ
    CRIU ରԠ (lxc-checkpoint ίϚϯυ)
    lxc-start ίϚϯυ͸σʔϞϯϞʔυ͕σϑΥϧτʹ
    nbd ετϨʔδόοΫΤϯυ
    lxc-execute Ͱىಈ͢ΔΞϓϦέʔγϣϯίϯςφͷ४උ͕
    ָʹ
    download ςϯϓϨʔτΛ࢖ͬͨ৔߹ɺ࡞੒͞ΕΔίϯςφ
    Ͱ͸Ϣʔβઃఆ͕ඞཁɻroot ͷύεϫʔυ΍σϑΥϧτϢʔ
    β͸࡞੒͞Εͳ͍
    LXD
    αΠτϦχϡʔΞϧ (४උத)
    Ճ౻ହจ Linux ίϯςφͷجຊͱ࠷৽৘ใ 2014-11-14 23 / 30

    View full-size slide

  24. LXD
    LXD The Linux Container Daemon
    ϦϞʔτ͔Β REST API Λ࢖ͬͯ LXC ίϯςφΛૢ࡞Մೳ
    ͳσʔϞϯͱ
    ίϚϯυϥΠϯ I/F (୯ҰͷίϚϯυ)
    OpenStack ϓϥάΠϯ
    Go ݴޠͰهड़ (go-lxc Λ࢖༻)
    https://github.com/lxc/lxd
    Ճ౻ହจ Linux ίϯςφͷجຊͱ࠷৽৘ใ 2014-11-14 24 / 30

    View full-size slide

  25. overlayfs
    Union Filesystem (aufs ͱҰॹ)
    ίϯςφͱ͸௚઀ؔ܎͋Γ·ͤΜ
    3.10 ͷࠒϚʔδ͞ΕΔͱ͍͏࿩͕͕͋ͬͨ 3.18 ͰϚʔδ͞
    Εͦ͏
    ίϯςφͷΫϩʔϯΛ࡞੒͢Δͱ͖ͷϑΝΠϧγεςϜͱ͠
    ͯ LXC ͔Βར༻Ͱ͖Δ
    Ubuntu/Plamo ͩͱඇಛݖίϯςφͷΫϩʔϯʹ΋࢖͑·͢
    Ubuntu 14.04 LTSɺPlamo Linux 5.2(࠷৽Χʔωϧ) Ͱར
    ༻Մೳ
    Ճ౻ହจ Linux ίϯςφͷجຊͱ࠷৽৘ใ 2014-11-14 25 / 30

    View full-size slide

  26. overlayfs(2)

    # ls -F
    lower/ overlay/ upper/ work/
    # touch lower/lower
    # touch upper/upper
    # mount -n -t overlayfs -o lowerdir=lower,upperdir=upper,workdir=work \
    overlayfs overlay
    # ls overlay/
    lower upper
    # touch overlay/overlay
    # ls overlay/
    lower overlay upper
    # umount overlay
    # ls upper/
    overlay upper

    ˞ Ubuntu 14.04 LTS ͷΧʔωϧͷ overlayfs ͷόʔδϣϯ͸ݹ
    ͍ͷͰ workdir Φϓγϣϯ͸ෆཁ
    Ճ౻ହจ Linux ίϯςφͷجຊͱ࠷৽৘ใ 2014-11-14 26 / 30

    View full-size slide

  27. ࠷ޙʹ
    Ճ౻ହจ Linux ίϯςφͷجຊͱ࠷৽৘ใ 2014-11-14 27 / 30

    View full-size slide

  28. ίϯςφք۾
    ·ͩ·ͩมԽ͕ܹ͍͠Ͱ͢Ͷ (Kernel, LXC, Docker)
    ৭ʑ஫໨ͯ͠ௐ΂͓ͯ͘ඞཁ͕͋Γ·͢
    Ճ౻ହจ Linux ίϯςφͷجຊͱ࠷৽৘ใ 2014-11-14 28 / 30

    View full-size slide

  29. ڠྗऀืू
    ڠྗऀืूத
    ೔ຊޠ man pages
    linuxcontainers.org ϦχϡʔΞϧͰ຋༁த
    ϨϏϡʔɺ຋༁
    ͜ͷษڧձ
    Ճ౻ହจ Linux ίϯςφͷجຊͱ࠷৽৘ใ 2014-11-14 29 / 30

    View full-size slide

  30. ͝ਗ਼ௌ͋Γ͕ͱ͏͍͟͝·ͨ͠
    Ճ౻ହจ Linux ίϯςφͷجຊͱ࠷৽৘ใ 2014-11-14 30 / 30

    View full-size slide