Haconiwa の中身と設計思想 /the-haconiwa-internals

NSVCZͰ࡞Δ-JOVYίϯςφͷະདྷ )BDPOJXBͷத਎ͱઃܭࢥ૝ ۙ౻Ӊஐ࿕(.01FQBCP *OD ϗεςΟϯάٕज़ΧϯϑΝϨϯεˏେࡕ

ΤϯδχΞ ۙ౻Ӊஐ࿕!VE[VSB ٕज़ج൫νʔϜϓϦϯγύϧ IUUQVE[VSBIBUFOBCMPHKQ

!VE[VSB w෱Ԭ೥໨ࢯɻ౦ࡾՏग़਎ɺେֶˠब৬ͱ೥΄Ͳ౦ژͰա͢͝ wࣾ಺4&ˠ&$αʔϏε։ൃӡ༻ˠιʔγϟϧήʔϜˠϖύϘ wΞϓϦέʔγϣϯʢ3P3ओ৯ʣˠ%FW0QT  ˠγεςϜϓϩάϥϛϯάʁ wʰύʔϑΣΫτ3VCZPO3BJMTʱͳͲΛॻ͍ͨʢ͕ɺͦΖͦΖ

)BDPOJXBͱ͸

)BDPOJXBͱ͸ w-JOVYίϯςφΤϯδϯͷҰͭ w࠷ۙ੎͍͕͋Δʮ%PDLFSʯ΋ɺίϯςφΤϯδϯ wଞʹɺ-9$ɺSLUɺ0QFO7;ɺTZTUFNEOTQBXOɺͳͲ wૉૣ͘ɺখ͘͞ɺಠཱͨ͠ʮ04ͷΑ͏ͳʯ؀ڥΛͭ͘ΕΔ w7JSUVBM#PY,7.ͷΑ͏ͳԾ૝Խͱҧ͍ɺ$16౳ͷΤϛϡϨʔτ΍  04ΧʔωϧࣗମΛؚ·ͳ͍ʢͷͰɺҰൠʹܰྔɺߴ଎ʣ

ಛ௃

ओͳಛ௃ w-JOVYίϯςφΛߏ੒͢Δ༷ʑͳཁૉɾػೳʹ͍ͭͯɺ  ཉ͍͠΋ͷࣗ༝ʹ૊Έ߹ΘͤΔ͜ͱ͕Ͱ͖ΔίϯςφΤϯδϯ wͲΜͳ͜ͱ͕Ͱ͖Δ͔͸ޙड़ wͦͷ૊Έ߹ΘͤͷͨΊͷ಺෦%4-Λɺ3VCZ NSVCZ Ͱهड़Մೳ

)BDPOJXB͸NSVCZϓϩμΫτ w͓͔͛͞·Ͱ3VCZ,BJHJͰ΋͓࿩Λ͓ͯ͠Γ·͢ wIUUQSVCZLBJHJPSHQSFTFOUBUJPOTVE[VSBIUNM

ৄࡉ͸౦ژͷεϥΠυ΋ੋඇɻ wIUUQTTQFBLFSEFDLDPNVE[VSBIBDPOJXBPOUIFQBWFNFOU

؆୯ͳEFNP ൿ఻ͷखॱIUUQTHJTUHJUIVCDPNVE[VSBCFECEECDEDFCBBG

ࠓ೔͸ )BDPOJXBͷத਎ͷ࿩

)BDPOJXBΛࢧ͑Δ -JOVYίϯςφٕज़

ϗετ04͔Β؀ڥΛʮִ཭ʯ͢Δ wDISPPUSPPUϑΝΠϧγεςϜͷมߋ w-JOVYOBNFTQBDF04ͷ༷ʑͳϦιʔεར༻ͷʮ໊લۭؒʯΛมߋ  ϗετ໊ɺ*1$ͷϦιʔεɺϚ΢ϯτϙΠϯτɺ1*%ɺ

ϗετ04ͷϦιʔεར༻Λʮ੍ݶʯ͢Δ wSMJNJUΧʔωϧʹΑΔϓϩηε΁ͷ༷ʑͳϦιʔεར༻ͷ੍ݶ wDHSPVQϓϩηεάϧʔϓ୯ҐͰͷ$16ɺϝϞϦɺ*0ͳͲͷ੍ݶ wLFSOFMDBQBCJMJUZSPPUͷݖݶͷ෼ׂͱ੍ޚ

ಛʹηΩϡϦςΟʹؔΘΔػೳ wLFSOFMDBQBCJMJUZ wTFDDPNQγεςϜίʔϧຖͷݺͼग़͠ͷϑΟϧλϦϯά w"QQ"SNPS 4&-JOVY."$ ڧ੍ΞΫηε੍ޚ ͷಋೖ

-JOVYίϯςφ͸ جຊతʹɺ ͜ΕΒΛ૊Έ߹Θ͍ͤͯΔ

)BDPOJXB❤NSVCZ

ॳظͷ)BDPOJXB w$3VCZͰɺHFNͱͯ͠։ൃ͍ͯͨ͠ w$3VCZ͸ϚϧνεϨουͰىಈ͢Δͱ͍͏໰୊ wز͔ͭͷOBNFTQBDFؔ࿈ͷγεςϜίʔϧ͕௚઀ݺ΂ͳ͍ w$3VCZͷஈ֊Ͱ͸ɺͦΕΒͷॲཧΛ֎෦ίϚϯυ΍  γΣϧεΫϦϓτͰϥοϓͯ͠ରԠ͍ͯͨ͠ wϓϩηεϨΠΞ΢τ͕͔ͳΓෳࡶʹͳΔ

NSVCZͰॻ͖௚͢

ͳͥɺNSVCZ͔ͩͬͨ wΧʔωϧʹ͍ۙͱ͜ΖͷϓϩάϥϛϯάΛɺ$ݴޠͰ௚઀ࣗ෼ͷ΋ͷ  ʹͰ͖Δ wίϯςφܥϥΠϒϥϦɺγεςϜίʔϧΛ௚઀ݺͿ͜ͱ͕Մೳ w͔͠΋ɺͦΕΒίΞΛNSVCZͷ"1*Ͱϥοϓͯ͠͠·͑͹ɺ  γεςϜ΁ͷૢ࡞Λ3VCZͰॊೈʹهड़Ͱ͖Δ

ֶशίετ͸Ͳ͏͔ w޾͍ͱ͍͏͔ɺ೔ຊޠͰNSVCZΛ৮ͬͯΈͨͱ͍͏υΩϡϝϯτ͸  ൺֱత๛෋ʹଘࡏ͢Δ w$ͷ"1*ࣗମ΋ૉ௚Ͱɺ͍͔ͭ͘ϙΠϯτΛ֮͑Ε͹όϦόϦॻ͚Δ wNBUTVNPUPSZ͞Μͱ͍͏ਓ͕ྡͷ੮ʹଘࡏ͢Δ

)BDPOJXBͷ։ൃํ਑ w$ݴޠʴNSVCZͰίϯςφͷγεςϜίʔϧΛϥοϓ͢ΔNHFNΛ  ར༻͢Δ࡞ΔɻNHFNͰ͸খ͞ͳ͜ͱΛ͢Δ wGPSLFYFDXBJULJMM wNPVOUDISPPU wMJCDHSPVQ NSVCZDHSPVQ wMJCDBQ NSVCZDBQBCJMJUZ
wVOTIBSFTFUOT DMPOF wͦΕΒΛɺ)BDPOJXBDPSFͰ͸3VCZͷίʔυͷΈͰ૊Έ߹ΘͤΔ

5JQTNSVCZ΋3VCZΒ͘͠ॻ͘ wྫ͑͹μοΫλΠϐϯάʴετϥςδύλʔϯͰઃܭΛ͖ͬ͢Γͱ͔

5JQTNSVCZDMJ ͷར༻ wੜ੒͞ΕͨςϯϓϨʔτʹԊ͑͹ɺ΄ͱΜͲ3VCZͷίʔυ͚ͩͰ  ϫϯόΠφϦͷπʔϧ͕࡞੒Մೳ wΦϓγϣϯύʔα͸ͳ͍ˠNSVCZBSHUBCMFΛࣗ࡞ wUPPMTIBDPOJXBIBDPOJXBDʹNBJO BSHD BSHW ͕͋Δ wτοϓϨϕϧͷ,FSOFM@@NBJO@@ΛݺͿ͚ͩɺγϯϓϧ
IUUQTHJUIVCDPNIPOFNSVCZDMJ

)BDPOJXBͷల๬

ঝલ)BDPOJXBͷத਎ͷத਎ w-JOVYίϯςφΛ࡞ΔͨΊʹ͸ɺ༷ʑͳγεςϜίʔϧ͕ଘࡏ͢Δ wͦΕΒͷγεςϜίʔϧ͸ɺҰͭҰͭ͸ɺͱͯ΋খ͞ͳ࢓ࣄΛ͢Δ wͦͷখ͞ͳ࢓ࣄΛɺରԠ͢ΔNSVCZͷHFNͰҰ௨Γϥοϓ͢Δ  ͜ͱ͕׬͍ྃͯ͠Δɻ

͜ΕΒͷNHFNʹ͍ͭͯ wNHFNࣗମ͸ɺ୯ମͰ΋ར༻ग़དྷΔ wҰͭҰͭ͸ඇৗʹখ͞ͳ$ͷίʔυͰɺখ͞ͳ࢓ࣄΛ͍ͯ͠Δ wDG-JOVYͷίϚϯυ w͜ΕΒNHFNΛ૊Έ߹Θͤͯɺ3VCZʹΑΔ%4-Ͱϥοϓ͢Δͱɺ  )BDPOJXBͷίϯςφ࣮૷ʹͳΔ NSVCZTFDDPNQͷ୯ମར༻ʹ͍ͭͯ IUUQVE[VSBIBUFOBCMPHKQFOUSZ

ࢀߟ-JOVYίϚϯυγεςϜίʔϧ ίϚϯυ γεςϜίʔϧ NSVCZ chroot(1) chroot(2) Dir.chroot mount(8) mount(2) Mount.new.mount
unshare(1) unshare(2) Namespace.unshare nsenter(1) setns(2) Namespace.setns capsh(1) cap_*(3) Capability.* (cgroupfs ͷૢ࡞) cgroup_*(3) Cgroup::*.new ...

DG4FSWFSTQFDTQFDJOGSB w4FSWFSTQFD͸ɺ34QFDϕʔεͷΠϯϑϥςετπʔϧͰ͋Δɻ wҰํͰɺʮαʔόʹର͢Δ৘ใऔಘ΍ૢ࡞ʯΛந৅Խͨ͠ϨΠϠʔͰ͋Δ TQFDJOGSB͕ଘࡏ͠ɺ4FSWFSTQFD͸ͦͷ্Ͱಈ࡞͢Δ wͭ·ΓɺʮTQFDJOGSBͱݴ͏ந৅ԽϨΠϠͷ্Ͱಈ͘Ұ࣮૷͕4FSWFSTQFDʯ Ͱ͋Δͱݴ͑Δ wଞʹ΋JUBNBF ͷΑ͏ͳ࣮૷ʢߏ੒؅ཧπʔϧʣ͕ग़ΔͳͲɺ  ΑΓ൚༻తʹ׆༻͞Ε͍ͯΔ
ʮTFSWFSTQFDએݴతهड़Ͱαʔόͷঢ়ଶΛςετՄೳͳ൚༻ੑͷߴ͍ςετϑϨʔϜϫʔΫʯٶԼদຊɺ IUUQTHJUIVCDPNNJ[[ZTFSWFSTQFDUIFTJTQVMMJTTVFDPNNFOUIUUQTFSWFSTQFDPSH IUUQJUBNBFLJUDIFO

4FSWFSTQFDTQFDJOGSB ͷΑ͏ͳந৅ԽϨΠϠΛ )BDPOJXBʹ΋ఆٛՄೳͳ͸ͣ

ఆٛͰ͖Δͱ Կ͕خ͍͔͠ʁ

ॊೈͳίϯςφ࠶ߟ w)BDPOJXBͰ࣮ݱͰ͖Δॊೈ͞ͷྫ ɿ wϓϩάϥϜʹΑΔϦιʔεͷׂΓ౰ͯͷ੍ޚʢFHDHSPVQʣ wఀࢭϑοΫɺγάφϧड৴࣌ͷϑοΫͷఆٛ wΠϝʔδ࡞੒खॱͷNSVCZʹΑΔࣗ༝౓ͷߴ͍هड़ wෆཁͳίϯςφػೳΛແޮԽͰ͖Δ͜ͱͰͷߴूੵԽ ʮ)BDPOJXBͷ͜Ε·Ͱͱ͜Ε͔Βʯۙ౻ɺ

ෳࡶԽɾଟ༷Խ͢Δ ӡ༻ཁ݅Λ %4-ʹΑΔ੍ޚͰରॲ͢Δ

ίϯςφ͸εϨουతʹ "1*Λ௨ͯࣗ͠ࡏʹ ίϯτϩʔϧͰ͖Δ

'BTU$POUBJOFS%"04 w%"04 %JNFOTJPOGSFF"VUPOPNPVT0QFSBUJOH4ZTUFN   ͷఏҊ͕͋Δ wίϯςφΛҰͭͷੜଘظؒͷ۠੾ΒΕͨεϨουͱଊ͑௚͢  %"04ͷ༻ޠͰ͍͏ͱ.PSUBMͰ͋Δͱଊ͑Δ wͦͷ৔߹ɺ΋͠)BDPOJXB JOUFSOBM"1*
Ͱ࣮ݱ͍ͯ͠Δ  ந৅ԽϨΠϠ͕ଘࡏ͢ΔͳΒɺ  ͦΕ͸γεςϜίʔϧʹ૬౰͢Δͱݴ͑ΔͰ͋Ζ͏ ʮ'BTU$POUBJOFSΞʔΩςΫνϟ֓࿦ʯদຊɺ

ίϯςφ૚ )BDPOJXB૚ ϗετ૚

%"04)BDPOJXBJOUFSOBM"1* Λϕʔεͱͨ͠ ৽͍͠ελοΫͷఏҊ

%"04ʹ͍ͭͯ͸ɺ !NBUTVNPUPSZͷൃදͰʂ

·ͱΊͱࠓޙ

)BDPOJXBͰͰ͖Δ͜ͱ w͜͜·Ͱʹݟ͖ͯͨΑ͏ͳ-JOVYͷίϯςφ࡞੒ͷͨΊͷػೳΛɺ  ॊೈʹ૊Έ߹Θͤɺಈతʹ੍ޚͰ͖ΔΑ͏ʹͳͬͨɻ wྫ͑͹ϗετͷϦιʔεΛϓϩάϥϚϒϧʹࡉ੍͔͘ޚ͢Δ wྫ͑͹Πϝʔδ΍SPPUGTͷߏ੒Λॊೈʹมߋ͢Δ wίϯςφΛߴ଎ʹىಈͨ͠Γɺಈతʹ࡟আͨ͠Γ͢Δ

)BDPOJX-JOVYTZTDBMMNSVCZHFN wίϯςφΤϯδϯͱͯ͠ͷ)BDPOJXB͸ɺͨ͘͞ΜͷNSVCZHFNΛ ૊Έ߹Θͤͨந৅ԽϨΠϠͷ্Ͱಈ࡞͍ͯ͠ΔͱΈͳͤΔ wͦΕͧΕͷNSVCZHFN͸ɺ-JOVYͷγεςϜίʔϧΛݺͼग़͢ wΤϯδϯͱ-JOVY,FSOFMͱͷؒͷΠϯλϑΣʔεతͳJOUFSOBM"1*Λ  ૝ఆՄೳͰɺͦΕ͸4FSWFSTQFDTQFDJOGSBͷରԠʹࣅ͍ͯΔ

)BDPOJXBͱ'BTU$POUBJOFS%"04 w'BTU$POUBJOFSߏ૝ʹΑΓɺ%"04ɺ.PSUBM͕ఏҊ͞Εͨ wͦΕΒͱ)BDPOJXB)BDPOJXBJOUFSOBMͷؔ܎͸ɺ  ͪΐ͏Ͳ04εϨουγεςϜίʔϧͷΑ͏ͳؔ܎ʹͳΔ w͜ΕΒٕज़ʹΑΔ৽͍͠ελοΫΛզʑ͸ఏҊ͍ͨ͠

ࠓޙ)BDPOJXBͰ࣮ݱ͍ͨ͜͠ͱ w'BTU$POUBJOFS ߏ૝ʹରԠ͢Δػೳͷ֦ॆ w$3*6ͱͷ࿈ܞڧԽ wϑοΫॲཧͷ֦ॆɺ%4-ͷػೳ௥Ճ wωοτϫʔΫΛ௨ͨ͠%4-ͷ࣮ߦ wΑΓଟ͘ͷίϯςφػೳ΁ͷରԠ w)BDPOJXBͷதؒ૚ʢγεςϜίʔϧ૬౰ʣͷൈ͖ग़͠ͱந৅Խ IUUQICNBUTVNPUPSKQFOUSZ
IUUQTDSJVPSH.BJO@1BHF

͜ΕΒͷٕज़Λ༻͍ͨɺ ࠓ·Ͱʹͳ͍Α͏ͳ ϗεςΟϯάͷαʔϏεΛ ΍Γ͍ͨɻ

஥ؒ ืू

৽͍ٕ͠ज़Ͱɺ৽͍͠αʔϏεΛɻ  ϖύϘͳΒͰ͖Δ ࠷৽ͷ࠾༻৘ใΛνΣοΫˠ !QC@SFDSVJU

ར༻ը૾ʹ͍ͭͯ wεϥΠυͷഎܠը૾IUUQTIPXDBTFDJUZGVLVPLBMHKQ w ʮར༻্ͷ஫ҙʯʹԊͬͯར༻͍ͯ͠·͢ɻը૾ͷஶ࡞ݖ͸෱Ԭࢢʹؼଐ͠·͢ɻ

Haconiwa の中身と設計思想 /the-haconiwa-internals

Haconiwa の中身と設計思想 /the-haconiwa-internals

More Decks by KONDO Uchio

Other Decks in Technology

Featured

Transcript