Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Rubyで君もコンテナになる - Haconiwaのごく一部の機能の紹介 / learn-you-a-linux-namespace-for-great-good

Rubyで君もコンテナになる - Haconiwaのごく一部の機能の紹介 / learn-you-a-linux-namespace-for-great-good

ピクシブ福岡オフィス - オープン記念LT祭

2cf373725ded741824c50fd571eda6e1?s=128

KONDO Uchio

March 03, 2017
Tweet

Transcript

  1. 3VCZεΫϦϓτͰ܅΋ίϯςφʹͳΔ ۙ౻͏͓ͪ(.01FQBCP *OD QJYJWϐΫγϒ෱ԬΦϑΟεΦʔϓϯه೦-5ࡇ )BDPOJXBͷ࿩

  2. ΤϯδχΞ ۙ౻͏͓ͪ!VE[VSB (.0ϖύϘٕज़ج൫νʔϜϓϦϯγύϧ IUUQVE[VSBIBUFOBCMPHKQ

  3. (.0ϖύϘ'VLVPLBSC ۙ౻Ӊஐ࿕ ೥ΑΓ෱Ԭࡏॅ 3P3ΤϯδχΞˠ%FW0QTํ໘ͱܦ༝ͯ͠
 ؾ͍ͮͨΒ$ͱNSVCZͰ-JOVYίϯςφΛॻ͍ͯͨਓ ޷͖ͳγεςϜίʔϧ͸VOTIBSF  FYFDWF 

  4. 'VLVPLBSC ִि͍͍ͩͨਫ༵೔։࠵!ఱਆϖύϘ(SPPWFOBVUT0⒏DF

  5. )BDPOJXB

  6. )BDPOJXBͱ͸ wNSVCZͰग़དྷͨ-JOVYίϯςφϥϯλΠϜ w%PDLFSͳͲͷ-JOVYίϯςφ͸ɺ-JOVYΧʔωϧͷ ༷ʑͳػೳͷ૊Έ߹ΘͤͰͰ͖͍ͯΔɻ wͦΕΒػೳͷ૊Έ߹Θͤ΍ɺίϯςφͷ্ཱͪ͛ϑΣʔ ζ͝ͱͷϑοΫɺγάφϧϋϯυϥͳͲΛࣗ༝ʹɺ 3VCZʹΑΔ%4-Ͱهड़Ͱ͖Δͷ͕ಛ௃

  7. )BDPOJXBͷࢿྉ w໊ݹ԰3VCZձٞ
 Ͱ΋࿩͠·ͨ͠ʂʂ̍ w։ൃͷܦҢͳͲ
 ͸ͦͪΒʹ IUUQTTQFBLFSEFDLDPNVE[VSBIBDPOJXBBOEGVUVSFPT

  8. ୈճϑΫΦΧ3VCZେ৆ड৆ ͜Ε͔ΒདྷΔίϯςφϥϯλΠϜͷ͸ͣ

  9. -JOVYͷ༷ʑͳػೳ

  10. -JOVY/BNFTQBDF

  11. DHSPVQ

  12. ,FSOFM$BQBCJMJUZ

  13. ͬͯΑ͘Θ͔Βͳ͍εΑͶ

  14. ࠓ೔͸ -JOVY/BNFTQBDF͚ͩ ֮͑ͯؼΓ·͠ΐ͏

  15. -JOVY/BNFTQBDF w-JOVYͷ༷ʑͳϦιʔεʢྫ͑͹ϗετ໊ɺϚ΢ϯτ ϙΠϯτɺͳͲͳͲʣ͸ɺ໊લۭؒΛ͍࣋ͬͯΔɻ wͳͷͰɺಉ͡ϗετ্ʹ͋ͬͯ΋ɺ͋Δϓϩηεͱผ ͷϓϩηεͱͰɺผʑͷϗετ໊Λ͍࣋ͬͯΔΑ͏ʹ ݟ͔͚ͤΔ͜ͱ͕Ͱ͖Δɻ

  16. ΠϝʔδΘ͔ͳ͍͢ΑͶ

  17. ͦ͜Ͱ)BDPOJXB

  18. 6CVOUV9FOJBMʹΠϯετʔϧ $ curl -s https://packagecloud.io/install/repositories/ udzura/haconiwa/script.deb.sh | sudo bash #

    https://packagecloud.io/udzura/haconiwa/install $ sudo apt install haconiwa $ haconiwa version haconiwa: v0.6.2
  19. ʢࠓճ͸ʣEFCPPUTUSBQͰSPPUGTΛ༻ҙ $ sudo apt install debootstrap $ debootstrap --arch amd64

    jessie \ /var/lib/haconiwa/jessie-box \ http://ftp.jp.debian.org/debian I: Retrieving Release I: Retrieving Release.gpg I: Checking Release signature ...
  20. ͜͏͍͏3VCZͷεΫϦϓτΛॻ͘ Haconiwa.define do |config| config.name = "pixiv-example" config.init_command = ["/bin/bash"]

    config.chroot_to "/var/lib/haconiwa/jessie-box" end
  21. ͔֬ʹʮίϯςφʯʹೖΕΔɻ Ͱ΋͜Ε͸ɺͨͩͷDISPPUͰ͢Ͷ

  22. 654OBNFTQBDFΛ෼͚Δ diff --git a/sample.haco b/sample.haco index f163d45..fa15f50 100644 --- a/sample.haco

    +++ b/sample.haco @@ -2,4 +2,6 @@ Haconiwa.define do |config| config.name = "pixiv-example" config.init_command = ["/bin/bash"] config.chroot_to "/var/lib/haconiwa/jessie-box" + + config.namespace.unshare "uts" end
  23. ϗετ໊͕෼͔Εͨʂ ঃʑʹίϯςφͬΆ͘ $ hostname udzura.example.com # ίϯςφʹೖΔ $ sudo haconiwa

    run sample.haco Container fork success and going to wait: pid=14895 root@pixiv-example:/# hostname pixiv-example
  24. .PVOUOBNFTQBDFΛ෼͚Δɻ diff --git a/sample.haco b/sample.haco index fa15f50..83996c0 100644 --- a/sample.haco

    +++ b/sample.haco @@ -4,4 +4,7 @@ Haconiwa.define do |config| config.chroot_to "/var/lib/haconiwa/jessie-box" config.namespace.unshare "uts" + config.namespace.unshare "mount" + + config.mount_independent "procfs" end ҰॹʹQSPDͳͲΛίϯςφ಺෦ͰϚ΢ϯτ͢Δ
  25. Ϛ΢ϯτϙΠϯτ͕ಠཱͨ͠ QSPD΋ແࣄϚ΢ϯτͰ͖ɺ֎͔Βݟ͑ͳ͍ # on container root@pixiv-example:/# mount proc on /proc

    type proc (rw,relatime) # on host $ mount | grep proc proc on /proc type proc (rw,nosuid,nodev,noexec,relatime) systemd-1 on /proc/sys/fs/binfmt_misc type autofs (rw,relatime,fd=23,pgrp=1,timeout=300,minproto=5,maxproto=5,direct)
  26. 1*%OBNFTQBDFΛ෼͚Δ *1$OBNFTQBDF͸ɺͪΐͬͱྫ͕೉͍͠ͷͰলུ diff --git a/sample.haco b/sample.haco index 83996c0..b27d7be 100644 ---

    a/sample.haco +++ b/sample.haco @@ -5,6 +5,7 @@ Haconiwa.define do |config| config.namespace.unshare "uts" config.namespace.unshare "mount" + config.namespace.unshare "pid" config.mount_independent "procfs" end
  27. 1*%͕͔Βʹͳͬͨ root@pixiv-example:/# sleep 100 & [1] 3 root@pixiv-example:/# ps auxf

    USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND root 1 0.0 0.3 20228 3220 ? S 10:10 0:00 /bin/bash root 3 0.0 0.0 4236 668 ? S 10:10 0:00 sleep 100 root 4 0.0 0.2 17496 2128 ? R+ 10:10 0:00 ps auxf ঃʑʹಠཱ͖ͯͨ͠
  28. ࠷ޙʹOFUOTΛ࡞ΓɺWFUIΛҾ͘ ip netns add pixiv001 ip link add haco__991 type

    veth peer name eth2 ip addr add 172.29.89.1/24 broadcast 172.29.89.255 dev haco__991 ip link set haco__991 up ip link set eth2 netns pixiv001 ip netns exec pixiv001 ip addr add 172.29.89.2/24 dev eth2 # ίϯςφͷΞυϨε ip netns exec pixiv001 ip link set lo up ip netns exec pixiv001 ip link set eth2 up # ૄ௨֬ೝ ping 172.29.89.2 ip netns exec pixiv001 ping 172.29.89.1
  29. ͦͷ/FUXPSLOBNFTQBDFʹೖΔ diff --git a/sample.haco b/sample.haco index b27d7be..7835814 100644 --- a/sample.haco

    +++ b/sample.haco @@ -6,6 +6,8 @@ Haconiwa.define do |config| config.namespace.unshare "uts" config.namespace.unshare "mount" config.namespace.unshare "pid" + config.namespace.enter "net", via: "/var/run/netns/pixiv001" config.mount_independent "procfs" + config.mount_independent "sysfs" end TZT഑Լʹ΋ωοτϫʔΫσόΠεͷ৘ใ͕͋ΔͷͰɺϦϚ΢ϯτਪ঑
  30. ೖΕͨʂ $ sudo haconiwa run sample.haco Container fork success and

    going to wait: pid=12554 root@pixiv-example:/# ip a 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever inet6 ::1/128 scope host valid_lft forever preferred_lft forever 4: eth2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default link/ether 92:80:3b:32:32:6d brd ff:ff:ff:ff:ff:ff inet 172.29.89.2/24 scope global eth2 valid_lft forever preferred_lft forever inet6 fe80::9080:3bff:fe32:326d/64 scope link valid_lft forever preferred_lft forever
  31. શମ Haconiwa.define do |config| config.name = "pixiv-example" config.init_command = ["/bin/bash"]

    config.chroot_to "/var/lib/haconiwa/jessie-box" config.namespace.unshare "uts" config.namespace.unshare "mount" config.namespace.unshare "pid" config.namespace.enter "net", via: "/var/run/netns/pixiv001" config.mount_independent "procfs" config.mount_independent "sysfs" end DHSPVQDBQBCJMJUZSMJNJUͦͷଞ΋%4-ͰઃఆͰ͖·͢
  32. ิ଍ɺͦͷଞͷ/BNFTQBDF w*1$OBNFTQBDFTZTW104*9*1$ͷϦιʔε໊લۭؒͷ෼ׂɻ։ ൃऀ͕৮Δػձ͸গͳ͍͕ɺྫ͑͹IUUQEͷ಺෦Ͱ࢖͍ͬͯΔͷͰɺ IUUQEΛϗετʹ ୆ཱ͍ͯͨͱ͖ʹඞཁ  w6TFSOBNFTQBDFϗετͷಛఆͷϢʔβάϧʔϓ*%ͷൣғΛɺ ผͷ*%ʹݟ͔͚ͤΔ͜ͱ͕Ͱ͖ΔɻSPPUͰͳ͍ϢʔβΛVJEʹݟͤ ΔͳͲͰ͖Δɻ-JOVYͰ࣮૷׬ྃ Ͱ΋$FOU04Ͱ͸σϑΥϧτແޮ

     w$(SPVQOBNFTQBDFDHSPVQͷ໊લۭؒɻϗετͰDHSPVQπϦʔ Λෳ਺࡞ΕΔɻ-JOVY͔ΒೖͬͨΒ͍͠ IUUQICNBUTVNPUPSKQFOUSZ
  33. ·ͱΊ

  34. )BDPOJXBΛ࢖͑͹ wίϯςφͷ༷ʑͳػೳΛɺ޷͖ͳΑ͏ʹ૊Έ߹Θͤͯ ࢖͑ΔɻͦΕΛ3VCZͰॻ͚Δɻ w/BNFTQBDFपΓҎ֎΋ࣗࡏʹઃఆͰ͖Δ wίϯςφͷษڧʹ΋ศར͔΋ɻ wྫ͑͹ɺෳ਺ίϯςφΛڞ௨ͷ/FUXPSLOBNFTQBDF ʹॴଐͤ͞ΔɺͳͲ΋ՄೳʢDG࠷ޙͷྫʣ

  35. &OKPZ$POUBJOFS#V⒎FU

  36. ܅΋)BDPOJXBͰ΍Ζ͏ʂ ϖύϘͷ࠾༻ˠ !QC@SFDSVJU

  37. ϖύΧϨୈظ కΊ੾ΓഭΔ WJTJUIUUQTXXXXBOUFEMZDPNQSPKFDUT

  38. ը૾ʹ͍ͭͯ wλΠτϧഎܠը૾͸1VCMJDEPNBJO $$ ͷ΋ͷͷΈΛར༻͍ͯ͠· ͢ɻ wҰ෦ͷը૾͸ɺ஌ਓࡱӨͷ΋ͷɺ·ͨ͸(.0ϖύϘͷ࠾༻ϖʔδͷ ΋ͷΛར༻͓ͯ͠Γ·͢ɻແஅస༻ͳͲ͸͓߇͍͑ͩ͘͞ɻ