Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
ロリポップ!マネージドクラウドを支えるコンテナ技術 / lolipop-mc-containers
Search
KONDO Uchio
June 16, 2018
Technology
0
2.8k
ロリポップ!マネージドクラウドを支えるコンテナ技術 / lolipop-mc-containers
@PHPカンファレンス福岡 2018
(スポンサートークです!)
https://phpcon.fukuoka.jp/2018/
KONDO Uchio
June 16, 2018
Tweet
Share
More Decks by KONDO Uchio
See All by KONDO Uchio
大規模レガシーテストを 倒すための CI基盤の作り方 / #CICD2023
udzura
5
2.1k
Ruby x BPF in Action / RubyKaigi 2022
udzura
0
130
Narrative of Ruby & Rust
udzura
0
140
開発者生産性指標の可視化 / pepabo-four-keys
udzura
3
1.4k
Talk of RBS
udzura
0
310
Re: みなさん最近どうですか? / FGN tech meetup in 2021
udzura
0
650
Dockerとやわらかい仮想化 - ProSec-IT/SECKUN 2021 edition -
udzura
2
580
Device access filtering in cgroup v2
udzura
1
670
"Story of Rucy" on RubyKaigi takeout 2021
udzura
0
570
Other Decks in Technology
See All in Technology
IaCジェネレーターとBedrockで詳細設計書を生成してみた
tsukasa_ishimaru
3
380
Java EE/Jakarta EEの現状と将来―クラウドネイティブ時代にJava EEは対応できるのか?―
takakiyo
1
170
EMとして2023年度に頑張ったこと / What we did well in FY2023 as a EM
pauli
1
170
アクセス制御にまつわる改善 / Improving access control
itkq
0
560
Building a RAG-poweredAI chat appwith Python and VS Code
pamelafox
0
110
開発生産性大幅アップ!Postman VS Code拡張機能
nagix
2
440
BPStudyの200回を中心にIT業界を振り返る。そしてこれから
haru860
2
200
「スニダン」開発組織の構造に込めた意図 ~組織作りはパッションや政治ではない!~
rinchsan
3
570
VS CodeでAWSを操作しよう
smt7174
8
1.7k
Azure Container Apps + Bicep 〜 こんな感じで運用しています
kaz29
3
540
地理空間データ可視化・解析・活用ソリューション Pacific Spatial Solutions (PSS)
pacificspatialsolutions
0
300
web-application-security
matsuihidetoshi
0
180
Featured
See All Featured
GitHub's CSS Performance
jonrohan
1025
450k
Making the Leap to Tech Lead
cromwellryan
124
8.5k
The Cult of Friendly URLs
andyhume
74
5.7k
Debugging Ruby Performance
tmm1
70
11k
Embracing the Ebb and Flow
colly
80
4.1k
Into the Great Unknown - MozCon
thekraken
10
1k
It's Worth the Effort
3n
180
27k
Automating Front-end Workflow
addyosmani
1356
200k
How to Ace a Technical Interview
jacobian
272
22k
Designing the Hi-DPI Web
ddemaree
276
33k
A Philosophy of Restraint
colly
197
16k
Robots, Beer and Maslow
schacon
PRO
155
7.9k
Transcript
ۙ౻͏͓ͪ(.01FQBCP *OD 1)1ΧϯϑΝϨϯεԬ ϩϦϙοϓʂ ϚωʔδυΫϥυΛࢧ͑Δ ίϯςφٕज़ͷશͯ
γχΞɾϓϦϯγύϧ ۙ౻͏͓ͪ!VE[VSB (.0ϖύϘɹٕज़෦ɹٕज़ج൫νʔϜ IUUQTCMPHVE[VSBKQ
'VLVPLBSC ! ԙϖύες (.0ϖύϘԬࢧࣾ'
None
<?php
None
IUUQTNDMPMJQPQKQ
Λ❗ Λ❗
8PSE1SFTTͳΒҰॠʂ 1)1ڥ͙͢ʹʂ 44)Ͱ͖Δʂ ಠࣗυϝΠϯγϡοͱʂ ແྉͰ5-4ରԠʂ
None
ίϯςφ
Linux containers, in short, contain applications in a way that
keep them isolated from the host system that they run on. IUUQTPQFOTPVSDFDPNSFTPVSDFTXIBUBSFMJOVYDPOUBJOFST
ίϯςφΛ͏ཧ༝ Ͱ
։ൃऀ༷ʹ ΞϓϦέʔγϣϯʹ ूத͍͖͍ͯͨͩͨ͠
αʔόͰۤ࿑ͨ͘͠ͳ͍ʂ wϛυϧΣΞͳͲΛࣗͰೖΕΔͷ᠘ଟͯ͘େม wಥવෛՙ͕ߴ·ͬͨΒͲ͏͠Α͏ʁ w৭ʑͳ੬ऑੑ͕ग़͖ͯͯΔ͚ͲɺͲ͏ରॲ͢Ε͍͍ͷʁ
ίϯςφͷಛ wίϯςφϙʔλϒϧ wˠඞཁͳͷʮશ෦ೖΓʯͷڥΛ͝ఏڙʂ wίϯςφىಈɾఀࢭ͕ߴ wˠඞཁʹԠͯ͡ͷىಈʢΦʔτεέʔϧʣ͍ʂ wˠෆཁͳ߹ͪΌΜͱఀࢭͯ͠ɺඅ༻͕͔͔Γ͗͢ͳ͍Α͏ʹ wˠίϯςφͷΞοϓάϨʔυɾೖΕସ͑࠶ىಈૉૣ͘ʂ
ίϯςφӡ༻ ϖύϘʹ͓ͤʂ
ίϯςφͷಛ ͷ
օ༷ʹͱͬͯίϯςφͱ
ίϯςφͷ͞Βʹਂ͍
ಛघͳϓϩηεͷ࡞ΓํΛ͢Δ
ʮίϯςφؔ࿈ػೳʯΛ༗ޮʹ cgroup Linux Namespace Capability chroot/ pivot_root seccomp
ίϯςφ ϓϩηε
ϓϩηε ؆୯ʹ࡞ΕΔ
ίϯςφ ࡞ΕΔʂ
։ൃऀ༷ʹ ΞϓϦέʔγϣϯʹ ूத͍͖͍ͯͨͩͨ͠ "HBJO
࠷ߴʹूதͰ͖Δ ίϯςφڥΛʂ
Haconiwa
)BDPOJXBͷΈ w-JOVYͷ༷ʑͳίϯςφػೳΛΈ߹ΘͤՄೳͳϥϯλΠϜ wγεςϜίʔϧΛɺɹɹɹɹΛܦ༝੍ͯ͠ޚͰ͖ΔΑ͏ʹ͠ɺ %4-ʹΑΓػೳͷΈ߹Θͤɺ༷ʑͳΠϕϯτʹԠͨ͡ϑοΫॲཧ Λهड़Ͱ͖Δɻ
ਤղ Linux Kernel mruby gems Haconiwa DSL Containers Syscalls: *
chroot * mount * prctl * unshare * setns * (cgroup op) * seccomp * setuid * setgid * ...... mruby-dir mruby-linux-namespace mruby-cgroup mruby-seccomp ...... sample.haco
Կ͕خ͍͠ʁ
৽͍͠ ίϯςφΞʔΩςΫνϟ
ίϯςφͱ͍͑Ͳɺ͍͠՝ w ͓٬༷ڥΛͳΔ͘շదɺ͔ͭߴूੵʹ ूੵΛߴ͘͠ͳ͚Εɺݱ࣮తͳ͓ஈͰఏڙ͠ଓ͚Δ͜ͱ͕Ͱ͖ ͳ͍ʂɹͦΕͰɺշదͰͳ͍ڥʹͨ͘͠ͳ͍ʂ w ίϯςφͱ͍͑ɺӡ༻ʹ͠ͳ͍ͱߴ͡Όͳ͍ ىಈɺఀࢭɺεέʔϧΞτͳͲΛ͍͍ͪͪखಈͰ͍ͬͯͯ ঢ়گʹԠͯ͡ͳΊΒ͔ʹίϯςφͷΛม͑ΒΕͳ͍͔ʁ
'BTU$POUBJOFS ΞʔΩςΫνϟ
ਤղ Web Proxy Web Request Dispatcher FastContainer Runtime CMDB ❌
FastContainer Killed 1. Check 2. Boot 3. Forward 4. Terminate
ίϯςφΛ॥ͤ͞Δʂ wίϯςφɺඞཁͳ࣌ʹ͔͠ىಈͤ͞ͳ͍ʂ ˠϗεταʔόͷϦιʔεΛඞཁҎ্ʹΘͳ͍ͷͰɺଟ͘ͷϢʔβ ༷ʹఏڙ͢Δ͜ͱ͕Ͱ͖ΔΑ͏ʹʂ wίϯςφͷʮੜଘ࣌ؒʯΛ۠ͬͯఏڙ͢Δʂ ˠίϯςφʹೖΕସ͑Λڧ੍ͤ͞ɺৗʹ৽͘͠อͨͤΔ͜ͱͰɺ ΞοϓάϨʔυɺΦʔτεέʔϧΛ༰қʹ࣮ݱͰ͖Δʂ ˠͬͱշదͳڥʹʂ
ݚڀ։ൃͷͱΓ͘Έ ͷ
IUUQTSBOEQFQBCPDPN
ΞʔΩςΫνϟ จԽ
αʔϏεͰٕͬͨज़Λจʹ wɹɹɹɹɹɹɹɹɹɹɹͰɺ ݚڀ։ൃͱࣄۀߩݙͷؔΘΓΛେࣄʹ͍ͯ͠·͢ wྫ͑'BTU$POUBJOFS w044จʹ)BDPOJXB
None
ىಈߴԽ $3*6
ΑΓշదͳίϯςφΛɻ w$3*6 $IFDLQPJOUBOE3FTUPSF*O6TFSTQBDF Λ༻͍ͯɺ ىಈ్தͷϓϩηεͷνΣοΫϙΠϯτΛ࡞ɺىಈΛߴԽ͢Δ ݚڀΛਐΊ͍ͯ·͢ɻ w$IFDLQPJOU3FTUPSF$3*6֤ॴͰݚڀ͕ਐΜͰ͍·͕͢ɺ TFDDPNQͱQUSBDFΛΈ߹ΘͤɺҙͷϓϩηεΛىಈߴԽ͢Δ ख๏Λ͍ͬͯͬͯ·͢ʂ IUUQTICNBUTVNPUPSKQFOUSZ
·ͱΊ
։ൃऀ༷͕։ൃʹ ूத͢ΔͨΊʹ શྗΛਚ͍ͯ͘͠·͢ʂ
1MFBTF "TLUIF4QFBLFS
ϓϥοτϑΥʔϜΛʮ࡞ͬͯʯΈ·ͤΜ͔ ࠷৽ͷ࠾༻ใΛνΣοΫˠ !QC@SFDSVJU IUUQIBUFOBOFXTDPNBSUJDMFT