Containers outside Containers

Lightning talk about techniques containers use but that could be used outside a container's context.

There is a missing video demo that didn't worked out when importing the slides. You can check it out here: https://www.youtube.com/watch?v=EQbc2CPgMbU

Transcript

1. CONTAINERS OUTSIDE CONTAINERS
2. WHAT MAKES A CONTAINER A CONTAINER?
3. WHAT MAKES A CONTAINER A CONTAINER? CGROUPS “cgroups is a Linux kernel feature that limits, accounts for, and isolates the resource usage (CPU, memory, disk I/O, network, etc.) of a collection of processes.” NAMESPACES “Namespaces are a feature of the Linux kernel that isolates and virtualizes system resources of a collection of processes. Examples of resources that can be virtualized include process IDs, hostnames, user IDs, network access, interprocess communication, and filesystems.”
4. WHAT MAKES A CONTAINER A CONTAINER? ISOLATION RESOURCE MANAGEMENT
5. WHY?
6. I need to Throttle my backup process to not eat all my disk i/o!
7. I want to fetch system metrics for my running apps
8. CGROUPS What?
9. Each subsystem limits things in one topic: • cpu - uses the scheduler to provide cgroup tasks access to the CPU • cpuset - assigns individual CPUs and memory nodes to tasks in a cgroup • memory - sets limits on memory use by tasks in a cgroup • blkio - sets limits on input/output access to and from block devices • devices - allows or denies access to devices by tasks in a cgroup • ... SUBSYSTEMS
10. Each subsystem limits things in one topic: • /sys/fs/cgroup/cpu • /sys/fs/cgroup/cpuset • /sys/fs/cgroup/memory • /sys/fs/cgroup/devices • /sys/fs/cgroup/blkio • ... SUBSYSTEMS
11. ANATOMY OF A SUBSYSTEM ( ls cgroup/memory ) cgroup.clone_children cgroup.sane_behavior memory.kmem.failcnt memory.kmem.slabinfo memory.kmem.tcp.max_usage_in_bytes memory.limit_in_bytes memory.memsw.limit_in_bytes memory.move_charge_at_immigrate memory.soft_limit_in_bytes memory.usage_in_bytes release_agent cgroup.event_control memory.failcnt memory.kmem.limit_in_bytes memory.kmem.tcp.failcnt memory.kmem.tcp.usage_in_bytes memory.max_usage_in_bytes memory.max_usage_in_bytes memory.memsw.max_usage_in_bytes memory.oom_control memory.stat memory.use_hierarchy tasks cgroup.procs memory.force_empty memory.kmem.max_usage_in_bytes memory.kmem.tcp.limit_in_bytes memory.kmem.usage_in_bytes memory.memsw.failcnt memory.memsw.usage_in_bytes memory.pressure_level memory.swappiness notify_on_release
12. EVERYTHING IS A FILE Write to the files to set values to limits
13. ./cgroup.procs List of pids belonging to this cgroup. EVERYTHING IS A FILE Write to the files to set values to limits ./<directory> Creates a subgroup in the group. Inherits parent’s files when not specified.
14. One process (PID) may belong to more than one cgroup NOTES Everything is done at PID level
15. E.G. 1: Limit <APP> memory IN 10Mb # create a group mkdir /sys/fs/cgroup/memory/my-example # add the app to the new created group echo “<app-pid>” >> /sys/fs/cgroup/memory/my-example/cgroup.procs # add a limit to the group echo “10M” > /sys/fs/cgroup/memory/my-example/memory.limit_in_bytes
16. # show current usage for memory cat /../memory/my-example/memory.usage_in_bytes => 7036928 # show the number of memory usage hits limits cat /../memory/my-example/memory.failcnt => 0 # show max memory usage recordedits cat /../memory/my-example/memory.max_usage_in_bytes => 7716864 E.g. 2: READ STATISTICS FOR <APP> FROM MEM CGROUP
17. ... memory.memsw.usage_in_bytes # show current usage for memory+Swap memory.failcnt # show the number of memory usage hits limits memory.memsw.failcnt # show the number of memory+Swap hits limits memory.max_usage_in_bytes # show max memory usage recorded memory.memsw.max_usage_in_bytes # show max memory+Swap usage recorded memory.soft_limit_in_bytes # set/show soft limit of memory usage memory.stat # show various statistics memory.kmem.limit_in_bytes # set/show hard limit for kernel memory memory.kmem.usage_in_bytes # show current kernel memory allocation memory.kmem.max_usage_in_bytes # show max kernel memory usage recorded memory.kmem.failcnt # show the number of kernel memory usage hits limits ... AVAILABLE METRICS FOR MEMORY
18. THIS ALSO APPLIES TO: Disk IO • Reads • Writes Memory Network
19. https://www.kernel.org/doc/Documentation/cgroup-v1/ MORE ABOUT CGROUPS
20. THANKS!