Firecracker、下から見るか？上から見るか？ / firecracker from low layer to hight

@ Serverless Meetup Fukuoka

Transcript

1. ۙ౻͏͓ͪ
   
   (.0
   1FQBCP
   *OD
   4FSWFSMFTT
   .FFUVQ
   'VLVPLB
    'JSFDSBDLFSɺ
   Լ͔ΒݟΔ͔ʁ
   ্͔ΒݟΔ͔ʁ
2. γχΞɾϓϦϯγύϧΤϯδχΞ ۙ౻ Ӊஐ࿕ / @udzura https://blog.udzura.jp/ Uchio Kondo ٕज़෦ ٕज़ج൫νʔϜ
5. Լ͔Β
6. 'JSFDSBDLFS "NB[POΑΓൃද͞Εͨ
   ʮϚΠΫϩ7.ʯΛ࡞੒ɾ؅ཧ͢ ΔϥϯλΠϜɻ
   ,7.Λར༻ͨ͠7.. 7JSUVBM
   .BDIJOF
   .POJUPS ʹ෼ྨ͞ΕΔ
7. ʮίϯςφʯϥϯλΠϜ w࣮͸͍Ζ͍Ζ͋Δʢ͍ΘΏΔ௿ϨϕϧϥϯλΠϜத৺ʹʣ ϓϩηε ϋΠύʔόΠβ
   .JDSP7. αϯυϘοΫε ϢχΧʔωϧ
8. 'JSFDSBDLFSͷಛ௃ wηΩϡΞ
   
   Ծ૝ϚγϯΛ࡞੒͢ΔͷͰִ཭ੑ͕ߴ͍
   wϋΠύϑΟΦʔϚϯε
   
   ىಈϛϦඵʢެশʣ
   w࣮੷
   
   -BNCEBɺ'BSHBUFͷόοΫΤϯυʂ
   w௿Φʔόϔου
   
   7.͋ͨΓ໿
   .J#ͷϝϞϦΛফඅʢެশʣ
   w044ʢ"QBDIF
   
   -JDFOTFʣ
   w3VTUͷେن໛ɾϓϩμΫγϣϯϢʔεϓϩδΣΫτͱͯ͠΋ڵຯਂ͍
9. ಋೖ IUUQTHJUIVCDPNpSFDSBDLFSNJDSPWNpSFDSBDLFSCMPCNBTUFSEPDTHFUUJOHTUBSUFENE
   
10. ಋೖ࣌ͷϝϞ w-JOVY
    
    w6CVOUV
    #JPOJDͷͳͲ
    w,7.ར༻Մೳ
    wύϒϦοΫΫϥ΢υͳΒ"84ͷϕΞϝλϧ΍ɺ($&Ͱ/FTUFE
    ,7. ༗ޮͷΠϯελϯεͳͲ
11. KBJMFS w'JSFDSBDLFSࣗମ͸ྫ͑͹OFUOT΍DHSPVQͳͲΛΑ͠ͳʹ͸͠ͳ͍ͷ ͰɺKBJMFSͱ͍͏؆қίϯςφϥούʔΛט·ͤΔͷ͕͍͍Β͍͠
    wޙड़͢Δ,BUB
    $POUBJOFSΛܦ༝ͯ͠΋͍͍ JAIL_ID=$(uuidgen) jailer --id $JAIL_ID \ --exec-file /usr/local/bin/firecracker \ --netns /var/run/netns/fc-test-1 \ --node 0 --uid=10001 --gid=1000
12. ωοτϫʔΫελοΫࣗ࡞੎޲͚
13. ,BUB
    $POUBJOFS w'JSFDSBDLFSΛݱ࣮తʹಈ্͔͢Ͱ͸ɺ,BUB
    $POUBJOFSͷΞμϓλΛ ར༻ͯ͠EPDLFSίϚϯυܦ༝ͰίϯςφΛ࡞Δͷ͕͍͍ͷͰ͸
    w͜͏͍͏ײ͡ [docker cli] -> [dockerd] -> [kata-containerͷshim] -> [firecracker]
14. ,BUB
    $PO
    
    LBUBGD w
    ΧλίϯςφΛೖΕɺ%PDLFSΛηοτΞοϓ
    w
    pSFDSBDLFSೖΓͷLBUB
    DPOUBJOFS
    UBSCBMMΛམͱͯ͠ల։
    w
    LBUBGD
    ΛϥϯλΠϜʹ࢖͏Α͏%PDLFSΛઃఆ
    w͜ΕͰಈ͘ɻৄࡉ͸ɺ׬શʹ௕͍खॱͳͷͰɺϒϩάʹ͠·͢
15. )FMMPXPSME root@firecracker-test-1:~# docker run -ti --runtime=kata-fc hello-world Hello from Docker! This message shows that your installation appears to be working correctly. To generate this message, Docker took the following steps: 1. The Docker client contacted the Docker daemon. 2. The Docker daemon pulled the "hello-world" image from the Docker Hub. (amd64) 3. The Docker daemon created a new container from that image which runs the executable that produces the output you are currently reading. 4. The Docker daemon streamed that output to the Docker client, which sent it to your terminal.
16. ௒؆қతͳ
    ൺֱ
17. ࣮ݧ؀ڥ wϗετ
    $16
    
    $PSF
    .FNPSZ
    (#
    w/FTUFE
    ,7.
    ༗ޮʢ͢ͳΘͪɺϗετ΋7.ʣ
    wDQVJOGP
    ˠ
    wͦͷଞඋߟ
    wઃఆ౳͸μ΢ϯϩʔυ
 ηοτΞοϓ࣌σϑΥ
    w/P
    UVOJOH
18. 344 wEFCJBOTMJN
    Ͱ
    TMFFQ
    ίϚϯυΛಈ͔ͨ͠ঢ়ଶ
19. 344 3VOUJNF WFSTJPO΄͔
    ʢҎԼͷൺֱ΋ಉ͡ʣ 344 SVOD SD EFW ,#
    TMFFQϓϩηε LBUBSVOUJNF SD LBUBTIJN
    .#
    
    
    LBUBQSPYZ
    .#
    
    
    RFNV
    .# LBUBGD 
    LBUB
    DPOUBJOFSಉࠝ LBUBTIJN
    .#
    
    pSFDSBDLFS
    .#
20. ىಈ଎౓ time docker run -ti --runtime=$RUNTIME hello-world 3VOUJNF 5JNF SFBM SVOD NT LBUBSVOUJNF NT LBUBGD NT
21. ύϑΥʔϚϯε΁ͷӨڹ wͦΕͧΕͷϥϯλΠϜͰ
    Ahttpd:2.4-alpineA
    Λ͋͛Δ
    wͦ͜ʹҎԼͷ৚݅ͰBC ab -n 10000 -c 10 http://localhost:$BOUND_PORT/
22. ݁Ռʢൈਮʣ SVOD LBUBSVOUJNF LBUBGD
23. ্͔Β
24. ,VCFSOFUFT͔Β
    'JSFDSBDLFSΛ࢖͑ͳ͍ͷʁ
25. ϥϯλΠϜͷϨΠϠΘ͚ ,VCFSOFUFT ߴϨϕϧϥϯλΠϜ ௿ϨϕϧϥϯλΠϜ $3* 0$*
26. ϨΠϠΛͭͳ͍Ͱ͍͘ ,VCFSOFUFT ߴϨϕϧϥϯλΠϜ ௿ϨϕϧϥϯλΠϜ $3* 0$*
27. ,VCFSOFUFT͔Β
    'JSFDSBDLFSΛ࢖͏
28. ઓུ w,VCFSOFUFTࣗମΛͲ͏ೖΕΔ
    wNJDSPLTΛ࢖ͬͯΠϯετʔϧʴΧελϚΠζ
    wϕʔλ൛ͷϦιʔε
    3VOUJNF$MBTT
    Λ࢖͑͹͍͍ͷͰ͸
    wίϯςφϥϯλΠϜΛࣗ෼Ͱબ΂Δʁ
    wߴϨϕϧϥϯλΠϜʹɺͲͷ௿ϨϕϧϥϯλΠϜΛ࢖͏͔ࢦࣔͰ͖Δ Β͍͠
29. NJDSPLT
    ͷϋοΫ wઃఆΛมߋͯ͠
    TOBQDSBGU
    ͠௚͢͜ͱͰɺ΅͚ͩ͘ͷ͍͖͞ΐ͏ͷ ,VCFSOFUFT؀ڥ͕Ͱ͖Δ
    wҎԼͷΑ͏ʹ͍͡Δ
    w'FBUVSF
    (BUFTͰ3VOUJNF$MBTTΛ༗ޮʹ͢Δ
    wNJDSPLTͷ%PDLFSͰ͸ͳࣗ͘෼ͨͪ؅ཧͷ%PDLFSʹ͢Δ
    wͳ͔ͥJQUBCMFTͷϦϯΫ͕ࣦഊ͢ΔɺMJCOFUpMUFS@DPOOUSBDLΛ ࣗ෼ͰೖΕͳ͍ͱ͍͚ͳ͍
30. EJ⒎ w͜Ε΋ϒϩάʹ·ͱΊΔΜͰ
31. 'FBUVSF
    (BUFT w,VCFSOFUFT͸ɺϕʔλ΍ΞϧϑΝͷػೳʹ͍ͭͯɺσϑΥϧτͰ͸ ͢΂͕ͯ༗ޮͳΘ͚Ͱ͸ͳ͍ɻ໌ࣔతʹ༗ޮʹ͢ΔͨΊͷػߏ
32. 3VOUJNF$MBTF
    $3% w$VTUPN3FTPVSDF%FpOJUJPO
    ͷҰͭͱͯ͠,VCFSOFUFTʹؚ·Ε͍ͯ Δɺ1PEͳͲ࡞੒࣌ͷϥϯλΠϜΛબ΂ΔΑ͏ʹ͢Δػೳ
    w"MQIB
    εςʔδͷػೳ
33. 3VOUJNF$MBTT
    ͷରԠঢ়گ wਖ਼֬ʹ͸ɺ
    $3*
    ͷΠϯλϑΣʔεΛܦ༝ͯ͠ɺ1PE࡞੒࣌ʹߴϨϕϧ ϥϯλΠϜʹ
    Aruntime_classA
    ͱ͍͏ύϥϝʔλΛૹΕΔ
    wߴϨϕϧϥϯλΠϜଆͰͦΕΛݟͯ௿ϨϕϧϥϯλΠϜΛબͿɺͭ· ΓɺߴϨϕϧଆͰͷઃఆ͕ඞཁ
    wEPDLFSE͸Ͳ͜Ͱઃఆͯ͠ΔΜͩ
    Θ͔ΒΜ
    
 ʢDSJP
    ͷηοτΞοϓ·Ͱ͸࣌ؒ੾Εʣ
34. ઓུ w,VCFSOFUFTࣗମ
    wNJDSPLTΛ࢖ͬͯΠϯετʔϧʴΧελϚΠζ
    wϕʔλ൛ͷϦιʔε
    3VOUJNF$MBTT
    Λ࢖͑͹͍͍ͷͰ͸
    wߴϨϕϧϥϯλΠϜʹɺͲͷ௿ϨϕϧϥϯλΠϜΛ࢖͏͔ࢦࣔͰ͖Δ Β͍͠
    wखݩͷ%PDLFSΛݟΔΑ͏ʹ͸Ͱ͖ͯΔͷͰɺͦͷσϑΥϧτϥϯλ ΠϜΛ
    LBUBGD
    ʹ͢Ε͹Α͘Ͷʁ
35. Ͱ͖ͨ
36. %FNP
37. ·ͱΊ
38. 'JSFDSBDLFSΛҰ௨Γ͍ͬͯ͡Έͯ w΋͏࢖͓͏ͱࢥ͑͹࢖͑Δʢʁʣ
    w0$*
    $3*
    ͳͲͷن໿͕ਁಁ͖ͯͯ͠ɺͭͳ͗͜Έ͕༰қʹͳ͍ͬͯΔ ͷΛײͨ͡
    wӡ༻໘ɺύϑΥʔϚϯεͷվળ΍ϊ΢ϋ΢͸͜Ε͔Βʁ
40. ;͘͹Ͷͯ͢
 !
     .PO
    ԙ
    தऱ઒୺