Pro Yearly is on sale from $80 to $50! »

Haconiwa の中身と設計思想 /the-haconiwa-internals

2cf373725ded741824c50fd571eda6e1?s=47 KONDO Uchio
December 14, 2016

Haconiwa の中身と設計思想 /the-haconiwa-internals

GMOペパボ ホスティング技術カンファレンス@大阪
https://pepabo.connpass.com/event/45986/

* スライドの28枚目の内容は、発表時の誤りを訂正した版となります。

2cf373725ded741824c50fd571eda6e1?s=128

KONDO Uchio

December 14, 2016
Tweet

Transcript

  1. NSVCZͰ࡞Δ-JOVYίϯςφͷະདྷ )BDPOJXBͷத਎ͱઃܭࢥ૝ ۙ౻Ӊஐ࿕(.01FQBCP *OD ϗεςΟϯάٕज़ΧϯϑΝϨϯεˏେࡕ

  2. ΤϯδχΞ ۙ౻Ӊஐ࿕!VE[VSB ٕज़ج൫νʔϜϓϦϯγύϧ IUUQVE[VSBIBUFOBCMPHKQ

  3. !VE[VSB w෱Ԭ೥໨ࢯɻ౦ࡾՏग़਎ɺେֶˠब৬ͱ೥΄Ͳ౦ژͰա͢͝ wࣾ಺4&ˠ&$αʔϏε։ൃӡ༻ˠιʔγϟϧήʔϜˠϖύϘ wΞϓϦέʔγϣϯʢ3P3ओ৯ʣˠ%FW0QT
 ˠγεςϜϓϩάϥϛϯάʁ wʰύʔϑΣΫτ3VCZPO3BJMTʱͳͲΛॻ͍ͨʢ͕ɺͦΖͦΖ

  4. )BDPOJXBͱ͸

  5. )BDPOJXBͱ͸ w-JOVYίϯςφΤϯδϯͷҰͭ w࠷ۙ੎͍͕͋Δʮ%PDLFSʯ΋ɺίϯςφΤϯδϯ wଞʹɺ-9$ɺSLUɺ0QFO7;ɺTZTUFNEOTQBXOɺͳͲ wૉૣ͘ɺখ͘͞ɺಠཱͨ͠ʮ04ͷΑ͏ͳʯ؀ڥΛͭ͘ΕΔ w7JSUVBM#PY,7.ͷΑ͏ͳԾ૝Խͱҧ͍ɺ$16౳ͷΤϛϡϨʔτ΍
 04ΧʔωϧࣗମΛؚ·ͳ͍ʢͷͰɺҰൠʹܰྔɺߴ଎ʣ

  6. ಛ௃

  7. ओͳಛ௃ w-JOVYίϯςφΛߏ੒͢Δ༷ʑͳཁૉɾػೳʹ͍ͭͯɺ
 ཉ͍͠΋ͷࣗ༝ʹ૊Έ߹ΘͤΔ͜ͱ͕Ͱ͖ΔίϯςφΤϯδϯ wͲΜͳ͜ͱ͕Ͱ͖Δ͔͸ޙड़ wͦͷ૊Έ߹ΘͤͷͨΊͷ಺෦%4-Λɺ3VCZ NSVCZ Ͱهड़Մೳ

  8. )BDPOJXB͸NSVCZϓϩμΫτ w͓͔͛͞·Ͱ3VCZ,BJHJͰ΋͓࿩Λ͓ͯ͠Γ·͢ wIUUQSVCZLBJHJPSHQSFTFOUBUJPOTVE[VSBIUNM

  9. ৄࡉ͸౦ژͷεϥΠυ΋ੋඇɻ wIUUQTTQFBLFSEFDLDPNVE[VSBIBDPOJXBPOUIFQBWFNFOU

  10. ؆୯ͳEFNP ൿ఻ͷखॱIUUQTHJTUHJUIVCDPNVE[VSBCFECEECDEDFCBBG

  11. ࠓ೔͸ )BDPOJXBͷத਎ͷ࿩

  12. )BDPOJXBΛࢧ͑Δ -JOVYίϯςφٕज़

  13. ϗετ04͔Β؀ڥΛʮִ཭ʯ͢Δ wDISPPUSPPUϑΝΠϧγεςϜͷมߋ w-JOVYOBNFTQBDF04ͷ༷ʑͳϦιʔεར༻ͷʮ໊લۭؒʯΛมߋ
 ϗετ໊ɺ*1$ͷϦιʔεɺϚ΢ϯτϙΠϯτɺ1*%ɺ

  14. ϗετ04ͷϦιʔεར༻Λʮ੍ݶʯ͢Δ wSMJNJUΧʔωϧʹΑΔϓϩηε΁ͷ༷ʑͳϦιʔεར༻ͷ੍ݶ wDHSPVQϓϩηεάϧʔϓ୯ҐͰͷ$16ɺϝϞϦɺ*0ͳͲͷ੍ݶ wLFSOFMDBQBCJMJUZSPPUͷݖݶͷ෼ׂͱ੍ޚ

  15. ಛʹηΩϡϦςΟʹؔΘΔػೳ wLFSOFMDBQBCJMJUZ wTFDDPNQγεςϜίʔϧຖͷݺͼग़͠ͷϑΟϧλϦϯά w"QQ"SNPS 4&-JOVY."$ ڧ੍ΞΫηε੍ޚ ͷಋೖ

  16. -JOVYίϯςφ͸ جຊతʹɺ ͜ΕΒΛ૊Έ߹Θ͍ͤͯΔ

  17. )BDPOJXB❤NSVCZ

  18. ॳظͷ)BDPOJXB w$3VCZͰɺHFNͱͯ͠։ൃ͍ͯͨ͠ w$3VCZ͸ϚϧνεϨουͰىಈ͢Δͱ͍͏໰୊ wز͔ͭͷOBNFTQBDFؔ࿈ͷγεςϜίʔϧ͕௚઀ݺ΂ͳ͍ w$3VCZͷஈ֊Ͱ͸ɺͦΕΒͷॲཧΛ֎෦ίϚϯυ΍
 γΣϧεΫϦϓτͰϥοϓͯ͠ରԠ͍ͯͨ͠ wϓϩηεϨΠΞ΢τ͕͔ͳΓෳࡶʹͳΔ

  19. NSVCZͰॻ͖௚͢

  20. ͳͥɺNSVCZ͔ͩͬͨ wΧʔωϧʹ͍ۙͱ͜ΖͷϓϩάϥϛϯάΛɺ$ݴޠͰ௚઀ࣗ෼ͷ΋ͷ
 ʹͰ͖Δ wίϯςφܥϥΠϒϥϦɺγεςϜίʔϧΛ௚઀ݺͿ͜ͱ͕Մೳ w͔͠΋ɺͦΕΒίΞΛNSVCZͷ"1*Ͱϥοϓͯ͠͠·͑͹ɺ
 γεςϜ΁ͷૢ࡞Λ3VCZͰॊೈʹهड़Ͱ͖Δ

  21. ֶशίετ͸Ͳ͏͔ w޾͍ͱ͍͏͔ɺ೔ຊޠͰNSVCZΛ৮ͬͯΈͨͱ͍͏υΩϡϝϯτ͸
 ൺֱత๛෋ʹଘࡏ͢Δ w$ͷ"1*ࣗମ΋ૉ௚Ͱɺ͍͔ͭ͘ϙΠϯτΛ֮͑Ε͹όϦόϦॻ͚Δ wNBUTVNPUPSZ͞Μͱ͍͏ਓ͕ྡͷ੮ʹଘࡏ͢Δ

  22. )BDPOJXBͷ։ൃํ਑ w$ݴޠʴNSVCZͰίϯςφͷγεςϜίʔϧΛϥοϓ͢ΔNHFNΛ
 ར༻͢Δ࡞ΔɻNHFNͰ͸খ͞ͳ͜ͱΛ͢Δ wGPSLFYFDXBJULJMM wNPVOUDISPPU wMJCDHSPVQ NSVCZDHSPVQ  wMJCDBQ NSVCZDBQBCJMJUZ

     wVOTIBSFTFUOT DMPOF  wͦΕΒΛɺ)BDPOJXBDPSFͰ͸3VCZͷίʔυͷΈͰ૊Έ߹ΘͤΔ
  23. 5JQTNSVCZ΋3VCZΒ͘͠ॻ͘ wྫ͑͹μοΫλΠϐϯάʴετϥςδύλʔϯͰઃܭΛ͖ͬ͢Γͱ͔

  24. 5JQTNSVCZDMJ ͷར༻ wੜ੒͞ΕͨςϯϓϨʔτʹԊ͑͹ɺ΄ͱΜͲ3VCZͷίʔυ͚ͩͰ
 ϫϯόΠφϦͷπʔϧ͕࡞੒Մೳ wΦϓγϣϯύʔα͸ͳ͍ˠNSVCZBSHUBCMFΛࣗ࡞ wUPPMTIBDPOJXBIBDPOJXBDʹNBJO BSHD BSHW ͕͋Δ wτοϓϨϕϧͷ,FSOFM@@NBJO@@ΛݺͿ͚ͩɺγϯϓϧ

    IUUQTHJUIVCDPNIPOFNSVCZDMJ
  25. )BDPOJXBͷల๬

  26. ঝલ)BDPOJXBͷத਎ͷத਎ w-JOVYίϯςφΛ࡞ΔͨΊʹ͸ɺ༷ʑͳγεςϜίʔϧ͕ଘࡏ͢Δ wͦΕΒͷγεςϜίʔϧ͸ɺҰͭҰͭ͸ɺͱͯ΋খ͞ͳ࢓ࣄΛ͢Δ wͦͷখ͞ͳ࢓ࣄΛɺରԠ͢ΔNSVCZͷHFNͰҰ௨Γϥοϓ͢Δ
 ͜ͱ͕׬͍ྃͯ͠Δɻ

  27. ͜ΕΒͷNHFNʹ͍ͭͯ wNHFNࣗମ͸ɺ୯ମͰ΋ར༻ग़དྷΔ  wҰͭҰͭ͸ඇৗʹখ͞ͳ$ͷίʔυͰɺখ͞ͳ࢓ࣄΛ͍ͯ͠Δ wDG-JOVYͷίϚϯυ w͜ΕΒNHFNΛ૊Έ߹Θͤͯɺ3VCZʹΑΔ%4-Ͱϥοϓ͢Δͱɺ
 )BDPOJXBͷίϯςφ࣮૷ʹͳΔ NSVCZTFDDPNQͷ୯ମར༻ʹ͍ͭͯ IUUQVE[VSBIBUFOBCMPHKQFOUSZ

  28. ࢀߟ-JOVYίϚϯυγεςϜίʔϧ ίϚϯυ γεςϜίʔϧ NSVCZ chroot(1) chroot(2) Dir.chroot mount(8) mount(2) Mount.new.mount

    unshare(1) unshare(2) Namespace.unshare nsenter(1) setns(2) Namespace.setns capsh(1) cap_*(3) Capability.* (cgroupfs ͷૢ࡞) cgroup_*(3) Cgroup::*.new ...
  29. DG4FSWFSTQFDTQFDJOGSB w4FSWFSTQFD͸ɺ34QFDϕʔεͷΠϯϑϥςετπʔϧͰ͋Δɻ wҰํͰɺʮαʔόʹର͢Δ৘ใऔಘ΍ૢ࡞ʯΛந৅Խͨ͠ϨΠϠʔͰ͋Δ TQFDJOGSB͕ଘࡏ͠ɺ4FSWFSTQFD͸ͦͷ্Ͱಈ࡞͢Δ wͭ·ΓɺʮTQFDJOGSBͱݴ͏ந৅ԽϨΠϠͷ্Ͱಈ͘Ұ࣮૷͕4FSWFSTQFDʯ Ͱ͋Δͱݴ͑Δ  wଞʹ΋JUBNBF ͷΑ͏ͳ࣮૷ʢߏ੒؅ཧπʔϧʣ͕ग़ΔͳͲɺ
 ΑΓ൚༻తʹ׆༻͞Ε͍ͯΔ

    ʮTFSWFSTQFDએݴతهड़Ͱαʔόͷঢ়ଶΛςετՄೳͳ൚༻ੑͷߴ͍ςετϑϨʔϜϫʔΫʯٶԼদຊɺ IUUQTHJUIVCDPNNJ[[ZTFSWFSTQFDUIFTJTQVMMJTTVFDPNNFOUIUUQTFSWFSTQFDPSH IUUQJUBNBFLJUDIFO
  30. 4FSWFSTQFDTQFDJOGSB ͷΑ͏ͳந৅ԽϨΠϠΛ )BDPOJXBʹ΋ఆٛՄೳͳ͸ͣ

  31. ఆٛͰ͖Δͱ Կ͕خ͍͔͠ʁ

  32. ॊೈͳίϯςφ࠶ߟ w)BDPOJXBͰ࣮ݱͰ͖Δॊೈ͞ͷྫ ɿ wϓϩάϥϜʹΑΔϦιʔεͷׂΓ౰ͯͷ੍ޚʢFHDHSPVQʣ wఀࢭϑοΫɺγάφϧड৴࣌ͷϑοΫͷఆٛ wΠϝʔδ࡞੒खॱͷNSVCZʹΑΔࣗ༝౓ͷߴ͍هड़ wෆཁͳίϯςφػೳΛແޮԽͰ͖Δ͜ͱͰͷߴूੵԽ ʮ)BDPOJXBͷ͜Ε·Ͱͱ͜Ε͔Βʯۙ౻ɺ

  33. ෳࡶԽɾଟ༷Խ͢Δ ӡ༻ཁ݅Λ %4-ʹΑΔ੍ޚͰରॲ͢Δ

  34. ίϯςφ͸εϨουతʹ "1*Λ௨ͯࣗ͠ࡏʹ ίϯτϩʔϧͰ͖Δ

  35. 'BTU$POUBJOFS%"04 w%"04 %JNFOTJPOGSFF"VUPOPNPVT0QFSBUJOH4ZTUFN 
 ͷఏҊ͕͋Δ  wίϯςφΛҰͭͷੜଘظؒͷ۠੾ΒΕͨεϨουͱଊ͑௚͢
 %"04ͷ༻ޠͰ͍͏ͱ.PSUBMͰ͋Δͱଊ͑Δ wͦͷ৔߹ɺ΋͠)BDPOJXB JOUFSOBM"1*

    Ͱ࣮ݱ͍ͯ͠Δ
 ந৅ԽϨΠϠ͕ଘࡏ͢ΔͳΒɺ
 ͦΕ͸γεςϜίʔϧʹ૬౰͢Δͱݴ͑ΔͰ͋Ζ͏ ʮ'BTU$POUBJOFSΞʔΩςΫνϟ֓࿦ʯদຊɺ
  36. ίϯςφ૚ )BDPOJXB૚ ϗετ૚

  37. %"04)BDPOJXBJOUFSOBM"1* Λϕʔεͱͨ͠ ৽͍͠ελοΫͷఏҊ

  38. %"04ʹ͍ͭͯ͸ɺ !NBUTVNPUPSZͷൃදͰʂ

  39. ·ͱΊͱࠓޙ

  40. )BDPOJXBͰͰ͖Δ͜ͱ w͜͜·Ͱʹݟ͖ͯͨΑ͏ͳ-JOVYͷίϯςφ࡞੒ͷͨΊͷػೳΛɺ
 ॊೈʹ૊Έ߹Θͤɺಈతʹ੍ޚͰ͖ΔΑ͏ʹͳͬͨɻ wྫ͑͹ϗετͷϦιʔεΛϓϩάϥϚϒϧʹࡉ੍͔͘ޚ͢Δ wྫ͑͹Πϝʔδ΍SPPUGTͷߏ੒Λॊೈʹมߋ͢Δ wίϯςφΛߴ଎ʹىಈͨ͠Γɺಈతʹ࡟আͨ͠Γ͢Δ

  41. )BDPOJX-JOVYTZTDBMMNSVCZHFN wίϯςφΤϯδϯͱͯ͠ͷ)BDPOJXB͸ɺͨ͘͞ΜͷNSVCZHFNΛ ૊Έ߹Θͤͨந৅ԽϨΠϠͷ্Ͱಈ࡞͍ͯ͠ΔͱΈͳͤΔ wͦΕͧΕͷNSVCZHFN͸ɺ-JOVYͷγεςϜίʔϧΛݺͼग़͢ wΤϯδϯͱ-JOVY,FSOFMͱͷؒͷΠϯλϑΣʔεతͳJOUFSOBM"1*Λ
 ૝ఆՄೳͰɺͦΕ͸4FSWFSTQFDTQFDJOGSBͷରԠʹࣅ͍ͯΔ

  42. )BDPOJXBͱ'BTU$POUBJOFS%"04 w'BTU$POUBJOFSߏ૝ʹΑΓɺ%"04ɺ.PSUBM͕ఏҊ͞Εͨ wͦΕΒͱ)BDPOJXB)BDPOJXBJOUFSOBMͷؔ܎͸ɺ
 ͪΐ͏Ͳ04εϨουγεςϜίʔϧͷΑ͏ͳؔ܎ʹͳΔ w͜ΕΒٕज़ʹΑΔ৽͍͠ελοΫΛզʑ͸ఏҊ͍ͨ͠

  43. ࠓޙ)BDPOJXBͰ࣮ݱ͍ͨ͜͠ͱ w'BTU$POUBJOFS ߏ૝ʹରԠ͢Δػೳͷ֦ॆ w$3*6ͱͷ࿈ܞڧԽ  wϑοΫॲཧͷ֦ॆɺ%4-ͷػೳ௥Ճ wωοτϫʔΫΛ௨ͨ͠%4-ͷ࣮ߦ wΑΓଟ͘ͷίϯςφػೳ΁ͷରԠ w)BDPOJXBͷதؒ૚ʢγεςϜίʔϧ૬౰ʣͷൈ͖ग़͠ͱந৅Խ IUUQICNBUTVNPUPSKQFOUSZ

    IUUQTDSJVPSH.BJO@1BHF
  44. ͜ΕΒͷٕज़Λ༻͍ͨɺ ࠓ·Ͱʹͳ͍Α͏ͳ ϗεςΟϯάͷαʔϏεΛ ΍Γ͍ͨɻ

  45. ஥ؒ ืू

  46. ৽͍ٕ͠ज़Ͱɺ৽͍͠αʔϏεΛɻ
 ϖύϘͳΒͰ͖Δ ࠷৽ͷ࠾༻৘ใΛνΣοΫˠ !QC@SFDSVJU

  47. ར༻ը૾ʹ͍ͭͯ wεϥΠυͷഎܠը૾IUUQTIPXDBTFDJUZGVLVPLBMHKQ w ʮར༻্ͷ஫ҙʯʹԊͬͯར༻͍ͯ͠·͢ɻը૾ͷஶ࡞ݖ͸෱Ԭࢢʹؼଐ͠·͢ɻ