$30 off During Our Annual Pro Sale. View Details »

ペパボ新卒研修座学、コンテナのお話 /the-skelton-of-whales

ペパボ新卒研修座学、コンテナのお話 /the-skelton-of-whales

KONDO Uchio

August 18, 2016
Tweet

More Decks by KONDO Uchio

Other Decks in Technology

Transcript

  1. ௥Ճ՝୊ wҎԼͷίϚϯυΛ࣮ߦͯ͠Έ͍ͯͩ͘͞ • sudo unshare --uts -- /bin/bash -c \


    'hostname udzura.example.jp; echo new process: $$; exec /bin/sleep 9999' & wͦͷޙɺʮOFXQSPDFTTʯͱ͍ͬͨද͕ࣔग़·͢ͷͰɺ wͦͷදࣔΛ΋ͱʹOTFOUFSΛ࢖ͬͯΈ͍ͯͩ͘͞ɻ •sudo nsenter --uts=/proc/23639/ns/uts /bin/bash wͦ͜Ͱ্ཱ͕ͪΔCJOCBTI͸Ͳ͏͍͏؀ڥͰ͔͢
  2. -JOVY 6/ 9 ͷجຊ͸ϑΝΠϧγεςϜ w'JMFTZTUFN)JFSBSDIZ4UBOEBSE wVTS WBS UNQ IPNF ʜʜ

    wز͔ͭͷσΟϨΫτϦʹ͸ಛผͳҙຯ͕͋Γɺٯʹݴ͏ͱ
 ن໿ʹ൓͢ΔΑ͏ͳϑΝΠϧ΍σΟϨΫτϦΛ࡞੒͢Δͱେมͳ͜ͱʹ΋ wຊ෺ͷϑΝΠϧʢʁʣͷ΄͔ɺ
 ͋ΒΏΔ৘ใ͕ϑΝΠϧʢQSPDσΟϨΫτϦɺEFWσΟϨΫτϦʜʣ
  3. ճ౴ྫ mkdir /var/lib/user_root mount --bind /tmp/myjessie /tmp/myjessie mount --bind -o

    remount,ro /tmp/myjessie mount --bind /var/lib/user_root /tmp/myjessie/root root@udzura:~# chroot /tmp/myjessie root@udzura:/# touch /test.txt touch: cannot touch '/test.txt': Read-only file system root@udzura:/# touch /root/test.txt root@udzura:/# ls -l /root/ total 0 -rw-r--r-- 1 root root 0 Aug 8 06:14 test.txt
  4. ίΞΛ࢖͏ϓϩάϥϜͷࡶͳճ౴ྫ cat <<RUBY | ruby - & def fib(n); n<2?1:fib(n-2)+fib(n-1);

    end 8.times.map do fork do loop do fib(rand(128)) end end end.each {|p| Process.waitpid p } RUBY ## ఀࢭ: killall ruby
  5. ճ౴ྫ mkdir /sys/fs/cgroup/cpuset/ruby001 echo 0 > /sys/fs/cgroup/cpuset/ruby001/cpuset.mems echo 0-1 >

    /sys/fs/cgroup/cpuset/ruby001/cpuset.cpus echo $$ > /sys/fs/cgroup/cpuset/ruby001/tasks cat <<RUBY | ruby - & def fib(n); n<2?1:fib(n-2)+fib(n-1); end 8.times.map do fork do loop do fib(rand(128)) end end end.each {|p| Process.waitpid p } RUBY top # then hit `1'
  6. ҎԼͷػೳ΋࢖͏ͷͰݴٴ·Ͱ wTFUVJETFUHJE w࣮Ϣʔβ*%ɺ༗ޮϢʔβ*%ɺอଘϢʔβ*%ʜ w3FTPVSDF-JNJU SMJNJU  wϑΝΠϧσΟεΫϦϓλ਺ͷ੍ݶͳͲ wʮVMJNJUͰ࢖͏΍ͭʯ vagrant@localhost:~$ ulimit

    -n 10 vagrant@localhost:~$ ruby -e "(1..30).to_a.map { p open('/dev/urandom') }" #<File:/dev/urandom> #<File:/dev/urandom> #<File:/dev/urandom> -e:1:in `initialize': Too many open files @ rb_sysopen - /dev/urandom (Errno::EMFILE) from -e:1:in `open' from -e:1:in `block in <main>' from -e:1:in `map' from -e:1:in `<main>'
  7. TBNQMFDPEF #!/usr/bin/hacorb Namespace.unshare(Namespace::CLONE_NEWPID) Namespace.unshare(Namespace::CLONE_NEWNS) p = Process.fork do Dir.chdir “/tmp/myjessie"

    # લ൒Ͱ࡞ͬͨDebianͷrootfs Dir.chroot "/tmp/myjessie" Mount.new.mount "proc", "/proc", type: "proc" exec "/bin/bash" end Process.waitpid p