ロリポップ！マネージドクラウドを支えるコンテナ技術 / lolipop-mc-containers

@PHPカンファレンス福岡 2018
（スポンサートークです！）

https://phpcon.fukuoka.jp/2018/

Transcript

1. ۙ౻͏͓ͪ(.01FQBCP *OD
   1)1ΧϯϑΝϨϯε෱Ԭ
   ϩϦϙοϓʂ
   ϚωʔδυΫϥ΢υΛࢧ͑Δ
   ίϯςφٕज़ͷશͯ
   

   View Slide

2. γχΞɾϓϦϯγύϧ
   ۙ౻͏͓ͪ!VE[VSB
   (.0ϖύϘɹٕज़෦ɹٕज़ج൫νʔϜ
   IUUQTCMPHVE[VSBKQ
   

   View Slide

3. 'VLVPLBSC
   !
   ԙϖύες
   (.0ϖύϘ෱Ԭࢧࣾ'
   

   View Slide

4. View Slide

5. View Slide

6. View Slide

7. IUUQTNDMPMJQPQKQ
   

   View Slide

8. Λ❗ Λ❗
   

   View Slide

9. 8PSE1SFTTͳΒҰॠʂ
   1)1؀ڥ΋͙͢ʹʂ
   44)΋Ͱ͖Δʂ
   ಠࣗυϝΠϯ΋γϡοͱʂ
   ແྉͰ5-4ରԠ΋ʂ
   

   View Slide

10. View Slide

11. ίϯςφ
    

    View Slide

12. Linux containers, in short, contain
    applications in a way that keep them
    isolated from the host system that
    they run on.
    IUUQTPQFOTPVSDFDPNSFTPVSDFTXIBUBSFMJOVYDPOUBJOFST
    

    View Slide

13. ίϯςφΛ࢖͏ཧ༝
    Ͱ
    

    View Slide

14. ։ൃऀ༷ʹ
    ΞϓϦέʔγϣϯʹ
    ूத͍͖͍ͯͨͩͨ͠
    

    View Slide

15. αʔόͰۤ࿑ͨ͘͠ͳ͍ʂ
    wϛυϧ΢ΣΞͳͲΛࣗ෼ͰೖΕΔͷ͸᠘΋ଟͯ͘େม
    wಥવෛՙ͕ߴ·ͬͨΒͲ͏͠Α͏ʁ
    w৭ʑͳ੬ऑੑ͕ग़͖ͯͯΔ͚ͲɺͲ͏ରॲ͢Ε͹͍͍ͷʁ
    

    View Slide

16. ίϯςφͷಛ௃
    wίϯςφ͸ϙʔλϒϧ
    wˠඞཁͳ΋ͷʮશ෦ೖΓʯͷ؀ڥΛ͝ఏڙʂ
    wίϯςφ͸ىಈɾఀࢭ͕ߴ଎
    wˠඞཁʹԠͯ͡ͷىಈʢΦʔτεέʔϧʣ΋଎͍ʂ
    wˠෆཁͳ৔߹͸ͪΌΜͱఀࢭͯ͠ɺඅ༻͕͔͔Γ͗͢ͳ͍Α͏ʹ
    wˠίϯςφͷΞοϓάϨʔυɾೖΕସ͑࠶ىಈ΋ૉૣ͘ʂ
    

    View Slide

17. ίϯςφӡ༻͸
    ϖύϘʹ͓೚ͤʂ
    

    View Slide

18. ίϯςφͷಛ௃
    ͷ
    

    View Slide

19. օ༷ʹͱͬͯίϯςφͱ͸
    

    View Slide

20. ίϯςφͷ͞Βʹਂ͍࿩
    

    View Slide

21. ಛघͳϓϩηεͷ࡞ΓํΛ͢Δ
    

    View Slide

22. ʮίϯςφؔ࿈ػೳʯΛ༗ޮʹ
    cgroup
    Linux
    
    Namespace
    Capability
    chroot/
    
    pivot_root
    seccomp
    

    View Slide

23. ίϯςφ͸
    ϓϩηε
    

    View Slide

24. ϓϩηε͸
    ؆୯ʹ࡞ΕΔ
    

    View Slide

25. ίϯςφ͸
    ࡞ΕΔʂ
    

    View Slide

26. ։ൃऀ༷ʹ
    ΞϓϦέʔγϣϯʹ
    ूத͍͖͍ͯͨͩͨ͠
    "HBJO
    

    View Slide

27. ࠷ߴʹूதͰ͖Δ
    ίϯςφ؀ڥΛʂ
    

    View Slide

28. Haconiwa
    

    View Slide

29. )BDPOJXBͷ࢓૊Έ
    w-JOVYͷ༷ʑͳίϯςφػೳΛ૊Έ߹ΘͤՄೳͳϥϯλΠϜ
    wγεςϜίʔϧ౳ΛɺɹɹɹɹΛܦ༝੍ͯ͠ޚͰ͖ΔΑ͏ʹ͠ɺ

    %4-ʹΑΓػೳͷ૊Έ߹Θͤ΍ɺ༷ʑͳΠϕϯτʹԠͨ͡ϑοΫॲཧ
    Λهड़Ͱ͖Δɻ
    

    View Slide

30. ਤղ
    Linux
    
    Kernel mruby gems Haconiwa
    
    DSL Containers
    Syscalls:
    
    * chroot
    
    * mount
    
    * prctl
    
    * unshare
    
    * setns
    
    * (cgroup op)
    
    * seccomp
    
    * setuid
    
    * setgid
    
    * ......
    mruby-dir
    mruby-linux-namespace
    mruby-cgroup
    mruby-seccomp
    ......
    sample.haco
    

    View Slide

31. Կ͕خ͍͠ʁ
    

    View Slide

32. ৽͍͠
    ίϯςφΞʔΩςΫνϟ
    

    View Slide

33. ίϯςφͱ͍͑Ͳ΋ɺ೉͍͠՝୊
    w
    ͓٬༷؀ڥΛͳΔ΂͘շదɺ͔ͭߴूੵʹ

    ूੵ཰Λߴ͘͠ͳ͚Ε͹ɺݱ࣮తͳ͓஋ஈͰఏڙ͠ଓ͚Δ͜ͱ͕Ͱ͖
    ͳ͍ʂɹͦΕͰ΋ɺշదͰͳ͍؀ڥʹ͸ͨ͘͠ͳ͍ʂ
    w
    ίϯςφͱ͸͍͑ɺӡ༻ʹ޻෉͠ͳ͍ͱߴ଎͡Όͳ͍

    ىಈɺఀࢭɺεέʔϧΞ΢τͳͲΛ͍͍ͪͪखಈͰ΍͍ͬͯͯ͸

    ঢ়گʹԠͯ͡ͳΊΒ͔ʹίϯςφͷ਺Λม͑ΒΕͳ͍͔ʁ
    

    View Slide

34. 'BTU$POUBJOFS
    ΞʔΩςΫνϟ
    

    View Slide

35. ਤղ
    Web
    
    Proxy
    Web
    
    Request
    
    Dispatcher
    FastContainer
    Runtime
    CMDB
    ❌
    FastContainer
    Killed
    1. Check
    2. Boot
    3. Forward
    4. Terminate
    

    View Slide

36. ίϯςφΛ॥؀ͤ͞Δʂ
    wίϯςφ͸ɺඞཁͳ࣌ʹ͔͠ىಈͤ͞ͳ͍ʂ

    ˠϗεταʔόͷϦιʔεΛඞཁҎ্ʹ࢖Θͳ͍ͷͰɺଟ͘ͷϢʔβ
    ༷ʹఏڙ͢Δ͜ͱ͕Ͱ͖ΔΑ͏ʹʂ
    wίϯςφͷʮੜଘ࣌ؒʯΛ۠੾ͬͯఏڙ͢Δʂ

    ˠίϯςφʹೖΕସ͑Λڧ੍ͤ͞ɺৗʹ৽͘͠อͨͤΔ͜ͱͰɺ

    ΞοϓάϨʔυɺΦʔτεέʔϧΛ༰қʹ࣮ݱͰ͖Δʂ
    ˠ΋ͬͱշదͳ؀ڥʹʂ
    

    View Slide

37. ݚڀ։ൃͷͱΓ͘Έ
    ͷ
    

    View Slide

38. IUUQTSBOEQFQBCPDPN
    

    View Slide

39. ΞʔΩςΫνϟ౳
    ࿦จԽ
    

    View Slide

40. αʔϏεͰ࢖ٕͬͨज़Λ࿦จʹ
    wɹɹɹɹɹɹɹɹɹɹɹͰ͸ɺ

    ݚڀ։ൃͱࣄۀߩݙͷؔΘΓΛେࣄʹ͍ͯ͠·͢
    wྫ͑͹'BTU$POUBJOFS

    w044΋࿦จʹ)BDPOJXB
    

    View Slide

41. View Slide

42. ىಈߴ଎Խ
    $3*6
    

    View Slide

43. ΑΓշదͳίϯςφΛɻ
    w$3*6 $IFDLQPJOUBOE3FTUPSF*O6TFSTQBDF
    Λ༻͍ͯɺ

    ىಈ్தͷϓϩηεͷνΣοΫϙΠϯτΛ࡞੒ɺىಈΛߴ଎Խ͢Δ

    ݚڀΛਐΊ͍ͯ·͢ɻ
    w$IFDLQPJOU3FTUPSF$3*6͸֤ॴͰݚڀ͕ਐΜͰ͍·͕͢ɺ

    TFDDPNQͱQUSBDFΛ૊Έ߹Θͤɺ೚ҙͷϓϩηεΛىಈߴ଎Խ͢Δ

    ख๏Λ΍͍ͬͯͬͯ·͢ʂ
    IUUQTICNBUTVNPUPSKQFOUSZ
    

    View Slide

44. ·ͱΊ
    

    View Slide

45. ։ൃऀ༷͕։ൃʹ
    ूத͢ΔͨΊʹ
    શྗΛਚ͍ͯ͘͠·͢ʂ
    ͸
    

    View Slide

46. 1MFBTF
    "TLUIF4QFBLFS
    

    View Slide

47. ϓϥοτϑΥʔϜΛʮ࡞ͬͯʯΈ·ͤΜ͔
    ࠷৽ͷ࠾༻৘ใΛνΣοΫˠ !QC@SFDSVJU
    IUUQIBUFOBOFXTDPNBSUJDMFT
    

    View Slide