Upgrade to Pro — share decks privately, control downloads, hide ads and more …

ロリポップ!マネージドクラウドを支えるコンテナ技術 / lolipop-mc-containers

ロリポップ!マネージドクラウドを支えるコンテナ技術 / lolipop-mc-containers

@PHPカンファレンス福岡 2018
(スポンサートークです!)

https://phpcon.fukuoka.jp/2018/

KONDO Uchio

June 16, 2018
Tweet

More Decks by KONDO Uchio

Other Decks in Technology

Transcript

  1. ۙ౻͏͓ͪ(.01FQBCP *OD
    1)1ΧϯϑΝϨϯε෱Ԭ
    ϩϦϙοϓʂ
    ϚωʔδυΫϥ΢υΛࢧ͑Δ
    ίϯςφٕज़ͷશͯ

    View full-size slide

  2. γχΞɾϓϦϯγύϧ
    ۙ౻͏͓ͪ!VE[VSB
    (.0ϖύϘɹٕज़෦ɹٕज़ج൫νʔϜ
    IUUQTCMPHVE[VSBKQ

    View full-size slide

  3. 'VLVPLBSC
    !
    ԙϖύες
    (.0ϖύϘ෱Ԭࢧࣾ'

    View full-size slide

  4. IUUQTNDMPMJQPQKQ

    View full-size slide

  5. 8PSE1SFTTͳΒҰॠʂ
    1)1؀ڥ΋͙͢ʹʂ
    44)΋Ͱ͖Δʂ
    ಠࣗυϝΠϯ΋γϡοͱʂ
    ແྉͰ5-4ରԠ΋ʂ

    View full-size slide

  6. Linux containers, in short, contain
    applications in a way that keep them
    isolated from the host system that
    they run on.
    IUUQTPQFOTPVSDFDPNSFTPVSDFTXIBUBSFMJOVYDPOUBJOFST

    View full-size slide

  7. ίϯςφΛ࢖͏ཧ༝
    Ͱ

    View full-size slide

  8. ։ൃऀ༷ʹ
    ΞϓϦέʔγϣϯʹ
    ूத͍͖͍ͯͨͩͨ͠

    View full-size slide

  9. αʔόͰۤ࿑ͨ͘͠ͳ͍ʂ
    wϛυϧ΢ΣΞͳͲΛࣗ෼ͰೖΕΔͷ͸᠘΋ଟͯ͘େม
    wಥવෛՙ͕ߴ·ͬͨΒͲ͏͠Α͏ʁ
    w৭ʑͳ੬ऑੑ͕ग़͖ͯͯΔ͚ͲɺͲ͏ରॲ͢Ε͹͍͍ͷʁ

    View full-size slide

  10. ίϯςφͷಛ௃
    wίϯςφ͸ϙʔλϒϧ
    wˠඞཁͳ΋ͷʮશ෦ೖΓʯͷ؀ڥΛ͝ఏڙʂ
    wίϯςφ͸ىಈɾఀࢭ͕ߴ଎
    wˠඞཁʹԠͯ͡ͷىಈʢΦʔτεέʔϧʣ΋଎͍ʂ
    wˠෆཁͳ৔߹͸ͪΌΜͱఀࢭͯ͠ɺඅ༻͕͔͔Γ͗͢ͳ͍Α͏ʹ
    wˠίϯςφͷΞοϓάϨʔυɾೖΕସ͑࠶ىಈ΋ૉૣ͘ʂ

    View full-size slide

  11. ίϯςφӡ༻͸
    ϖύϘʹ͓೚ͤʂ

    View full-size slide

  12. ίϯςφͷಛ௃
    ͷ

    View full-size slide

  13. օ༷ʹͱͬͯίϯςφͱ͸

    View full-size slide

  14. ίϯςφͷ͞Βʹਂ͍࿩

    View full-size slide

  15. ಛघͳϓϩηεͷ࡞ΓํΛ͢Δ

    View full-size slide

  16. ʮίϯςφؔ࿈ػೳʯΛ༗ޮʹ
    cgroup
    Linux

    Namespace
    Capability
    chroot/

    pivot_root
    seccomp

    View full-size slide

  17. ίϯςφ͸
    ϓϩηε

    View full-size slide

  18. ϓϩηε͸
    ؆୯ʹ࡞ΕΔ

    View full-size slide

  19. ίϯςφ͸
    ࡞ΕΔʂ

    View full-size slide

  20. ։ൃऀ༷ʹ
    ΞϓϦέʔγϣϯʹ
    ूத͍͖͍ͯͨͩͨ͠
    "HBJO

    View full-size slide

  21. ࠷ߴʹूதͰ͖Δ
    ίϯςφ؀ڥΛʂ

    View full-size slide

  22. )BDPOJXBͷ࢓૊Έ
    w-JOVYͷ༷ʑͳίϯςφػೳΛ૊Έ߹ΘͤՄೳͳϥϯλΠϜ
    wγεςϜίʔϧ౳ΛɺɹɹɹɹΛܦ༝੍ͯ͠ޚͰ͖ΔΑ͏ʹ͠ɺ

    %4-ʹΑΓػೳͷ૊Έ߹Θͤ΍ɺ༷ʑͳΠϕϯτʹԠͨ͡ϑοΫॲཧ
    Λهड़Ͱ͖Δɻ

    View full-size slide

  23. ਤղ
    Linux

    Kernel mruby gems Haconiwa

    DSL Containers
    Syscalls:

    * chroot

    * mount

    * prctl

    * unshare

    * setns

    * (cgroup op)

    * seccomp

    * setuid

    * setgid

    * ......
    mruby-dir
    mruby-linux-namespace
    mruby-cgroup
    mruby-seccomp
    ......
    sample.haco

    View full-size slide

  24. Կ͕خ͍͠ʁ

    View full-size slide

  25. ৽͍͠
    ίϯςφΞʔΩςΫνϟ

    View full-size slide

  26. ίϯςφͱ͍͑Ͳ΋ɺ೉͍͠՝୊
    w
    ͓٬༷؀ڥΛͳΔ΂͘շదɺ͔ͭߴूੵʹ

    ूੵ཰Λߴ͘͠ͳ͚Ε͹ɺݱ࣮తͳ͓஋ஈͰఏڙ͠ଓ͚Δ͜ͱ͕Ͱ͖
    ͳ͍ʂɹͦΕͰ΋ɺշదͰͳ͍؀ڥʹ͸ͨ͘͠ͳ͍ʂ
    w
    ίϯςφͱ͸͍͑ɺӡ༻ʹ޻෉͠ͳ͍ͱߴ଎͡Όͳ͍

    ىಈɺఀࢭɺεέʔϧΞ΢τͳͲΛ͍͍ͪͪखಈͰ΍͍ͬͯͯ͸

    ঢ়گʹԠͯ͡ͳΊΒ͔ʹίϯςφͷ਺Λม͑ΒΕͳ͍͔ʁ

    View full-size slide

  27. 'BTU$POUBJOFS
    ΞʔΩςΫνϟ

    View full-size slide

  28. ਤղ
    Web

    Proxy
    Web

    Request

    Dispatcher
    FastContainer
    Runtime
    CMDB

    FastContainer
    Killed
    1. Check
    2. Boot
    3. Forward
    4. Terminate

    View full-size slide

  29. ίϯςφΛ॥؀ͤ͞Δʂ
    wίϯςφ͸ɺඞཁͳ࣌ʹ͔͠ىಈͤ͞ͳ͍ʂ

    ˠϗεταʔόͷϦιʔεΛඞཁҎ্ʹ࢖Θͳ͍ͷͰɺଟ͘ͷϢʔβ
    ༷ʹఏڙ͢Δ͜ͱ͕Ͱ͖ΔΑ͏ʹʂ
    wίϯςφͷʮੜଘ࣌ؒʯΛ۠੾ͬͯఏڙ͢Δʂ

    ˠίϯςφʹೖΕସ͑Λڧ੍ͤ͞ɺৗʹ৽͘͠อͨͤΔ͜ͱͰɺ

    ΞοϓάϨʔυɺΦʔτεέʔϧΛ༰қʹ࣮ݱͰ͖Δʂ
    ˠ΋ͬͱշదͳ؀ڥʹʂ

    View full-size slide

  30. ݚڀ։ൃͷͱΓ͘Έ
    ͷ

    View full-size slide

  31. IUUQTSBOEQFQBCPDPN

    View full-size slide

  32. ΞʔΩςΫνϟ౳
    ࿦จԽ

    View full-size slide

  33. αʔϏεͰ࢖ٕͬͨज़Λ࿦จʹ
    wɹɹɹɹɹɹɹɹɹɹɹͰ͸ɺ

    ݚڀ։ൃͱࣄۀߩݙͷؔΘΓΛେࣄʹ͍ͯ͠·͢
    wྫ͑͹'BTU$POUBJOFS

    w044΋࿦จʹ)BDPOJXB

    View full-size slide

  34. ىಈߴ଎Խ
    $3*6

    View full-size slide

  35. ΑΓշదͳίϯςφΛɻ
    w$3*6 $IFDLQPJOUBOE3FTUPSF*O6TFSTQBDF
    Λ༻͍ͯɺ

    ىಈ్தͷϓϩηεͷνΣοΫϙΠϯτΛ࡞੒ɺىಈΛߴ଎Խ͢Δ

    ݚڀΛਐΊ͍ͯ·͢ɻ
    w$IFDLQPJOU3FTUPSF$3*6͸֤ॴͰݚڀ͕ਐΜͰ͍·͕͢ɺ

    TFDDPNQͱQUSBDFΛ૊Έ߹Θͤɺ೚ҙͷϓϩηεΛىಈߴ଎Խ͢Δ

    ख๏Λ΍͍ͬͯͬͯ·͢ʂ
    IUUQTICNBUTVNPUPSKQFOUSZ

    View full-size slide

  36. ։ൃऀ༷͕։ൃʹ
    ूத͢ΔͨΊʹ
    શྗΛਚ͍ͯ͘͠·͢ʂ
    ͸

    View full-size slide

  37. 1MFBTF
    "TLUIF4QFBLFS

    View full-size slide

  38. ϓϥοτϑΥʔϜΛʮ࡞ͬͯʯΈ·ͤΜ͔
    ࠷৽ͷ࠾༻৘ใΛνΣοΫˠ !QC@SFDSVJU
    IUUQIBUFOBOFXTDPNBSUJDMFT

    View full-size slide