Upgrade to Pro — share decks privately, control downloads, hide ads and more …

ロリポップ!マネージドクラウドを支えるコンテナ技術 / lolipop-mc-containers

ロリポップ!マネージドクラウドを支えるコンテナ技術 / lolipop-mc-containers

@PHPカンファレンス福岡 2018
(スポンサートークです!)

https://phpcon.fukuoka.jp/2018/

KONDO Uchio

June 16, 2018
Tweet

More Decks by KONDO Uchio

Other Decks in Technology

Transcript

  1. ۙ౻͏͓ͪ(.01FQBCP *OD
    1)1ΧϯϑΝϨϯε෱Ԭ
    ϩϦϙοϓʂ
    ϚωʔδυΫϥ΢υΛࢧ͑Δ
    ίϯςφٕज़ͷશͯ

    View Slide

  2. γχΞɾϓϦϯγύϧ
    ۙ౻͏͓ͪ!VE[VSB
    (.0ϖύϘɹٕज़෦ɹٕज़ج൫νʔϜ
    IUUQTCMPHVE[VSBKQ

    View Slide

  3. 'VLVPLBSC
    !
    ԙϖύες
    (.0ϖύϘ෱Ԭࢧࣾ'

    View Slide

  4. View Slide

  5. View Slide

  6. View Slide

  7. IUUQTNDMPMJQPQKQ

    View Slide

  8. Λ❗ Λ❗

    View Slide

  9. 8PSE1SFTTͳΒҰॠʂ
    1)1؀ڥ΋͙͢ʹʂ
    44)΋Ͱ͖Δʂ
    ಠࣗυϝΠϯ΋γϡοͱʂ
    ແྉͰ5-4ରԠ΋ʂ

    View Slide

  10. View Slide

  11. ίϯςφ

    View Slide

  12. Linux containers, in short, contain
    applications in a way that keep them
    isolated from the host system that
    they run on.
    IUUQTPQFOTPVSDFDPNSFTPVSDFTXIBUBSFMJOVYDPOUBJOFST

    View Slide

  13. ίϯςφΛ࢖͏ཧ༝
    Ͱ

    View Slide

  14. ։ൃऀ༷ʹ
    ΞϓϦέʔγϣϯʹ
    ूத͍͖͍ͯͨͩͨ͠

    View Slide

  15. αʔόͰۤ࿑ͨ͘͠ͳ͍ʂ
    wϛυϧ΢ΣΞͳͲΛࣗ෼ͰೖΕΔͷ͸᠘΋ଟͯ͘େม
    wಥવෛՙ͕ߴ·ͬͨΒͲ͏͠Α͏ʁ
    w৭ʑͳ੬ऑੑ͕ग़͖ͯͯΔ͚ͲɺͲ͏ରॲ͢Ε͹͍͍ͷʁ

    View Slide

  16. ίϯςφͷಛ௃
    wίϯςφ͸ϙʔλϒϧ
    wˠඞཁͳ΋ͷʮશ෦ೖΓʯͷ؀ڥΛ͝ఏڙʂ
    wίϯςφ͸ىಈɾఀࢭ͕ߴ଎
    wˠඞཁʹԠͯ͡ͷىಈʢΦʔτεέʔϧʣ΋଎͍ʂ
    wˠෆཁͳ৔߹͸ͪΌΜͱఀࢭͯ͠ɺඅ༻͕͔͔Γ͗͢ͳ͍Α͏ʹ
    wˠίϯςφͷΞοϓάϨʔυɾೖΕସ͑࠶ىಈ΋ૉૣ͘ʂ

    View Slide

  17. ίϯςφӡ༻͸
    ϖύϘʹ͓೚ͤʂ

    View Slide

  18. ίϯςφͷಛ௃
    ͷ

    View Slide

  19. օ༷ʹͱͬͯίϯςφͱ͸

    View Slide

  20. ίϯςφͷ͞Βʹਂ͍࿩

    View Slide

  21. ಛघͳϓϩηεͷ࡞ΓํΛ͢Δ

    View Slide

  22. ʮίϯςφؔ࿈ػೳʯΛ༗ޮʹ
    cgroup
    Linux

    Namespace
    Capability
    chroot/

    pivot_root
    seccomp

    View Slide

  23. ίϯςφ͸
    ϓϩηε

    View Slide

  24. ϓϩηε͸
    ؆୯ʹ࡞ΕΔ

    View Slide

  25. ίϯςφ͸
    ࡞ΕΔʂ

    View Slide

  26. ։ൃऀ༷ʹ
    ΞϓϦέʔγϣϯʹ
    ूத͍͖͍ͯͨͩͨ͠
    "HBJO

    View Slide

  27. ࠷ߴʹूதͰ͖Δ
    ίϯςφ؀ڥΛʂ

    View Slide

  28. Haconiwa

    View Slide

  29. )BDPOJXBͷ࢓૊Έ
    w-JOVYͷ༷ʑͳίϯςφػೳΛ૊Έ߹ΘͤՄೳͳϥϯλΠϜ
    wγεςϜίʔϧ౳ΛɺɹɹɹɹΛܦ༝੍ͯ͠ޚͰ͖ΔΑ͏ʹ͠ɺ

    %4-ʹΑΓػೳͷ૊Έ߹Θͤ΍ɺ༷ʑͳΠϕϯτʹԠͨ͡ϑοΫॲཧ
    Λهड़Ͱ͖Δɻ

    View Slide

  30. ਤղ
    Linux

    Kernel mruby gems Haconiwa

    DSL Containers
    Syscalls:

    * chroot

    * mount

    * prctl

    * unshare

    * setns

    * (cgroup op)

    * seccomp

    * setuid

    * setgid

    * ......
    mruby-dir
    mruby-linux-namespace
    mruby-cgroup
    mruby-seccomp
    ......
    sample.haco

    View Slide

  31. Կ͕خ͍͠ʁ

    View Slide

  32. ৽͍͠
    ίϯςφΞʔΩςΫνϟ

    View Slide

  33. ίϯςφͱ͍͑Ͳ΋ɺ೉͍͠՝୊
    w
    ͓٬༷؀ڥΛͳΔ΂͘շదɺ͔ͭߴूੵʹ

    ूੵ཰Λߴ͘͠ͳ͚Ε͹ɺݱ࣮తͳ͓஋ஈͰఏڙ͠ଓ͚Δ͜ͱ͕Ͱ͖
    ͳ͍ʂɹͦΕͰ΋ɺշదͰͳ͍؀ڥʹ͸ͨ͘͠ͳ͍ʂ
    w
    ίϯςφͱ͸͍͑ɺӡ༻ʹ޻෉͠ͳ͍ͱߴ଎͡Όͳ͍

    ىಈɺఀࢭɺεέʔϧΞ΢τͳͲΛ͍͍ͪͪखಈͰ΍͍ͬͯͯ͸

    ঢ়گʹԠͯ͡ͳΊΒ͔ʹίϯςφͷ਺Λม͑ΒΕͳ͍͔ʁ

    View Slide

  34. 'BTU$POUBJOFS
    ΞʔΩςΫνϟ

    View Slide

  35. ਤղ
    Web

    Proxy
    Web

    Request

    Dispatcher
    FastContainer
    Runtime
    CMDB

    FastContainer
    Killed
    1. Check
    2. Boot
    3. Forward
    4. Terminate

    View Slide

  36. ίϯςφΛ॥؀ͤ͞Δʂ
    wίϯςφ͸ɺඞཁͳ࣌ʹ͔͠ىಈͤ͞ͳ͍ʂ

    ˠϗεταʔόͷϦιʔεΛඞཁҎ্ʹ࢖Θͳ͍ͷͰɺଟ͘ͷϢʔβ
    ༷ʹఏڙ͢Δ͜ͱ͕Ͱ͖ΔΑ͏ʹʂ
    wίϯςφͷʮੜଘ࣌ؒʯΛ۠੾ͬͯఏڙ͢Δʂ

    ˠίϯςφʹೖΕସ͑Λڧ੍ͤ͞ɺৗʹ৽͘͠อͨͤΔ͜ͱͰɺ

    ΞοϓάϨʔυɺΦʔτεέʔϧΛ༰қʹ࣮ݱͰ͖Δʂ
    ˠ΋ͬͱշదͳ؀ڥʹʂ

    View Slide

  37. ݚڀ։ൃͷͱΓ͘Έ
    ͷ

    View Slide

  38. IUUQTSBOEQFQBCPDPN

    View Slide

  39. ΞʔΩςΫνϟ౳
    ࿦จԽ

    View Slide

  40. αʔϏεͰ࢖ٕͬͨज़Λ࿦จʹ
    wɹɹɹɹɹɹɹɹɹɹɹͰ͸ɺ

    ݚڀ։ൃͱࣄۀߩݙͷؔΘΓΛେࣄʹ͍ͯ͠·͢
    wྫ͑͹'BTU$POUBJOFS

    w044΋࿦จʹ)BDPOJXB

    View Slide

  41. View Slide

  42. ىಈߴ଎Խ
    $3*6

    View Slide

  43. ΑΓշదͳίϯςφΛɻ
    w$3*6 $IFDLQPJOUBOE3FTUPSF*O6TFSTQBDF
    Λ༻͍ͯɺ

    ىಈ్தͷϓϩηεͷνΣοΫϙΠϯτΛ࡞੒ɺىಈΛߴ଎Խ͢Δ

    ݚڀΛਐΊ͍ͯ·͢ɻ
    w$IFDLQPJOU3FTUPSF$3*6͸֤ॴͰݚڀ͕ਐΜͰ͍·͕͢ɺ

    TFDDPNQͱQUSBDFΛ૊Έ߹Θͤɺ೚ҙͷϓϩηεΛىಈߴ଎Խ͢Δ

    ख๏Λ΍͍ͬͯͬͯ·͢ʂ
    IUUQTICNBUTVNPUPSKQFOUSZ

    View Slide

  44. ·ͱΊ

    View Slide

  45. ։ൃऀ༷͕։ൃʹ
    ूத͢ΔͨΊʹ
    શྗΛਚ͍ͯ͘͠·͢ʂ
    ͸

    View Slide

  46. 1MFBTF
    "TLUIF4QFBLFS

    View Slide

  47. ϓϥοτϑΥʔϜΛʮ࡞ͬͯʯΈ·ͤΜ͔
    ࠷৽ͷ࠾༻৘ใΛνΣοΫˠ !QC@SFDSVJU
    IUUQIBUFOBOFXTDPNBSUJDMFT

    View Slide