Upgrade to Pro — share decks privately, control downloads, hide ads and more …

クラウドネイティブの基盤要素、コンテナの今と未来

 クラウドネイティブの基盤要素、コンテナの今と未来

うたもく

August 03, 2023
Tweet

More Decks by うたもく

Other Decks in Technology

Transcript

  1. クラウドネイティブの基盤要素

    コンテナの今と未来 

    CloudNative Days Fukuoka 2023
    Toru Komatsu(@utam0k)

    View Slide

  2. 2
    Preferred Networks, Inc.
    社内向けオンプレML基盤の開発‧運⽤
    趣味でのOSS活動
    メンテナ
    opencontainers/runtime-spec
    containers/youki
    レビュワー
    containerd/runwasi
    @utam0k
    KOMATSU Toru

    View Slide

  3. 3
    Preferred Networks, Inc.
    社内向けオンプレML基盤の開発‧運⽤
    趣味でのOSS活動
    メンテナ
    opencontainers/runtime-spec
    containers/youki
    レビュワー
    containerd/runwasi
    @utam0k
    KOMATSU Toru
    We are Hiring!!

    View Slide

  4. コンテナの今
    4
    00

    View Slide

  5. Kubelet
 Linux など

    Container Runtime
    High-Level Low-Level
    OCI
    Runtime
    Spec
    Container
    Runtime
    I nterface
    Kubeletの実⾏の流れ
    5

    View Slide

  6. Kubelet
 Linux など

    Container Runtime
    Low-Level
    Container
    Runtime
    I nterface
    6

    View Slide

  7. Kubelet
 Linux など

    Container Runtime
    Low-Level
    Container
    Runtime
    I nterface
    gRPC
    7

    View Slide

  8. Kubelet
 Linux など

    Container Runtime
    High-Level Low-Level
    OCI
    Runtime
    Spec
    Container
    Runtime
    I nterface
    8

    View Slide

  9. Kubelet
 Linux など

    Container Runtime
    High-Level Low-Level
    OCI
    Runtime
    Spec
    Container
    Runtime
    I nterface
    イメージとかコンテナ管理
    9

    View Slide

  10. Kubelet
 Linux など

    Container Runtime
    High-Level Low-Level
    OCI
    Runtime
    Spec
    Container
    Runtime
    I nterface
    コンテナの作成
    ワンショットバイナリ
    10

    View Slide

  11. コンテナの今

    11
    00

    View Slide

  12. Kubelet
 Linux など

    Container Runtime
    High-Level Low-Level
    OCI
    Runtime
    Spec
    Container
    Runtime
    I nterface
    ここでは OCI Runtime Spec
    を満たすものをコンテナと呼ぶ
    12

    View Slide

  13. Kubelet
 Linux など

    Container Runtime
    High-Level Low-Level
    OCI
    Runtime
    Spec
    Container
    Runtime
    I nterface
    JSON設定ファイルと
    サブコマンド 例) ./runc create $id
    でコンテナとは何か定めている
    13

    View Slide

  14. Kubelet
 Linux など

    Container Runtime
    High-Level Low-Level
    OCI
    Runtime
    Spec
    Container
    Runtime
    I nterface
    14

    View Slide

  15. Kubelet
 Linux など

    Container Runtime
    High-Level Low-Level
    OCI
    Runtime
    Spec
    Container
    Runtime
    I nterface
    Kubeletの実行の流れ

    15

    View Slide

  16. Kubelet
 Linux など

    Container Runtime
    High-Level Low-Level
    OCI
    Runtime
    Spec
    Container
    Runtime
    I nterface
    Kubeletの実行の流れ

    16

    View Slide

  17. Container
    Runtime
    I nterface
    Low-Level
    OCI
    Runtime Spec
    ➔ マイクロサービス的
    ➔ プラグイン機構
    17

    View Slide

  18. A

    P

    I

    Image
    Services
    Snapshot
    Services
    Containers
    Service
    Tasks
    Service



    Container
    Runtime
    I nterface
    Core Backend
    ContentStore
    plugin / local
    Snapshotter
    plugin / overlay / …
    Runtime
    v2 shim client
    containerd
    shim
    OCI
    Runtime
    Spec
    ttrpc
    18

    View Slide

  19. マイクロサービス的なアーキテクチャ
    A

    P

    I

    Image
    Services
    Snapshot
    Services
    Containers
    Service
    Tasks
    Service



    Container
    Runtime
    I nterface
    Core
    ContentStore
    plugin / local
    Snapshotter
    plugin / overlay / …
    Runtime
    v2 shim client
    containerd
    shim
    OCI
    Runtime
    Spec
    ttrpc
    Backend
    19

    View Slide

  20. A

    P

    I

    Image
    Services
    Snapshot
    Services
    Containers
    Service
    Tasks
    Service



    Container
    Runtime
    I nterface
    Core Backend
    ContentStore
    plugin / local
    Snapshotter
    plugin / overlay / …
    Runtime
    v2 shim client
    containerd
    shim
    OCI
    Runtime
    Spec
    ttrpc
    ワンショットバイナリ
    20

    View Slide

  21. 21
    Kubelet → Container Runtime → Container
    ➔ High / Low-Level Container Runtime
    Specification
    ➔ Container Runtime Interface
    ➔ OCI Runtime Specification
    containerd
    ➔ マイクロサービス
    ➔ プラグイン機構
    Recap

    View Slide

  22. コンテナの未来
    22
    01

    View Slide

  23. ⚠ 個⼈の⾒解 ⚠
    23

    View Slide

  24. WebAssembly
    24
    02

    View Slide

  25. WebAssembly

    25

    View Slide

  26. WebAssembly

    26
    Portability Small Size Security

    View Slide

  27. Kubelet
 Linux など

    Container Runtime
    High-Level Low-Level
    OCI
    Runtime
    Spec
    Container
    Runtime
    I nterface
    27

    View Slide

  28. Kubelet
 Linux など

    Container Runtime
    High-Level Low-Level
    OCI
    Runtime
    Spec
    Container
    Runtime
    I nterface
    28

    View Slide

  29. Kubelet
 Linux など

    Container Runtime
    High-Level Low-Level
    OCI
    Runtime
    Spec
    Container
    Runtime
    I nterface
    このあたりでWebAssemblyの対応が必要
    よんだ?
    29

    View Slide

  30. 30
    containerd/runwasi
    containerd-shimによる拡張
    現実世界で既に実験段階
    Docker Desktop
    Azure Kubernetes Service
    runwasi

    View Slide

  31. A

    P

    I

    Image
    Services
    Snapshot
    Services
    Containers
    Service
    Tasks
    Service



    Container
    Runtime
    I nterface
    Core Backend
    ContentStore
    plugin / local
    Snapshotter
    plugin / overlay / …
    Runtime
    v2 shim client
    containerd
    shim
    OCI
    Runtime
    Spec
    ttrpc
    この部分の拡張
    31

    View Slide

  32. Kubelet
 Linux など

    Container Runtime
    High-Level Low-Level
    Container
    Runtime
    I nterface
    WebAssembly 実行の流れ

    32

    View Slide

  33. 33
    ktock/container2wasm
    既存のコンテナ資源の活⽤
    container2wasm


    View Slide

  34. Lazy Pulling
    34
    03

    View Slide

  35. 35
    $ nerdctl --snapshotter=stargz run python:3.7-esgz python3 -c 'exit()'
    index-sha256:6a42...4948: done |++++++++++++++++++++++++++++++|
    manifest-sha256:1c57...20c5: done |++++++++++++++++++++++++++++++|
    config-sha256:f590...1df5: done |++++++++++++++++++++++++++++++|
    elapsed: 11.0 s total: 4.8 Ki (1.5 KiB/s)
    $ nerdctl run python:3.7-org python3 -c 'exit()'
    index-sha256:6008....1237: done |++++++++++++++++++++++++++++++|
    manifest-sha256:48ea...30ce7: done |++++++++++++++++++++++++++++++|
    config-sha256:94c9....9290: done |++++++++++++++++++++++++++++++|
    layer-sha256:f860....fbf6: done |++++++++++++++++++++++++++++++|
    layer-sha256:d779....3cc5: done |++++++++++++++++++++++++++++++|

    layer-sha256:adbd....f52c: done |++++++++++++++++++++++++++++++|
    layer-sha256:c495....736a: done |++++++++++++++++++++++++++++++|
    elapsed: 41.3s total: 321.3 (16.7 MiB/s)
    Lazy Pulling


    View Slide

  36. 36
    $ nerdctl --snapshotter=stargz run python:3.7-esgz python3 -c 'exit()'
    index-sha256:6a42...4948: done |++++++++++++++++++++++++++++++|
    manifest-sha256:1c57...20c5: done |++++++++++++++++++++++++++++++|
    config-sha256:f590...1df5: done |++++++++++++++++++++++++++++++|
    elapsed: 11.0 s total: 4.8 Ki (1.5 KiB/s)
    $ nerdctl run python:3.7-org python3 -c 'exit()'
    index-sha256:6008....1237: done |++++++++++++++++++++++++++++++|
    manifest-sha256:48ea...30ce7: done |++++++++++++++++++++++++++++++|
    config-sha256:94c9....9290: done |++++++++++++++++++++++++++++++|
    layer-sha256:f860....fbf6: done |++++++++++++++++++++++++++++++|
    layer-sha256:d779....3cc5: done |++++++++++++++++++++++++++++++|

    layer-sha256:adbd....f52c: done |++++++++++++++++++++++++++++++|
    layer-sha256:c495....736a: done |++++++++++++++++++++++++++++++|
    elapsed: 41.3s total: 321.3 Mi (16.7 MiB/s)
    layersがない
    起動までがはやい!

    View Slide

  37. 37
    cache
    stargz-snapshotter
    Container
    Registry
    FUSE Driver
    Overlayfs
    User
    Kernel
    open(“file”)

    View Slide

  38. A

    P

    I

    Image
    Services
    Snapshot
    Services
    Containers
    Service
    Tasks
    Service



    Container
    Runtime
    I nterface
    Core Backend
    ContentStore
    plugin / local
    Snapshotter
    plugin / overlay / …
    Runtime
    v2 shim client
    containerd
    shim
    OCI
    Runtime
    Spec
    ttrpc
    この部分の拡張
    38

    View Slide

  39. A

    P

    I

    Image
    Services
    Snapshot
    Services
    Containers
    Service
    Tasks
    Service



    Container
    Runtime
    I nterface
    Core Backend
    ContentStore
    plugin / local
    Snapshotter
    plugin / overlay / …
    Runtime
    v2 shim client
    containerd
    shim
    OCI
    Runtime
    Spec
    ttrpc
    stargz
    snapshotter
    grpc
    39

    View Slide

  40. 40
    cache
    stargz-snapshotter
    Container
    Registry
    FUSE Driver
    Overlayfs
    open(“file”)
    ①

    ②

    ④

    ③

    ⑤

    ⑥

    ⑦

    User
    Kernel

    View Slide

  41. 41
    cache
    stargz-snapshotter
    Container
    Registry
    FUSE Driver
    Overlayfs
    open(“file”)
    ①

    ②

    ④

    ③

    ⑤

    ⑥

    ⑦

    User
    Kernel

    View Slide

  42. 42
    cache
    stargz-snapshotter
    Container
    FUSE Driver
    Overlayfs
    open(“file”)
    ①

    ②

    ④

    ③

    ⑤

    ⑥

    ⑦

    User
    Kernel
    Registry

    View Slide

  43. 43
    cache
    stargz-snapshotter
    Container
    Registry
    FUSE Driver
    Overlayfs
    open(“file”)
    ①

    ②

    ④

    ③

    ⑤

    ⑥

    ⑦

    User
    Kernel

    View Slide

  44. 44
    cache
    stargz-snapshotter
    Container
    FUSE Driver
    Overlayfs
    open(“file”)
    ①

    ②

    ③

    ⑤

    ⑥

    ⑦

    User
    Kernel
    ④

    Registry

    View Slide

  45. 45
    $ nerdctl --snapshotter=stargz run python:3.7-esgz python3 -c 'exit()'
    index-sha256:6a42...4948: done |++++++++++++++++++++++++++++++|
    manifest-sha256:1c57...20c5: done |++++++++++++++++++++++++++++++|
    config-sha256:f590...1df5: done |++++++++++++++++++++++++++++++|
    elapsed: 11.0 s total: 4.8 Ki (1.5 KiB/s)
    $ nerdctl run python:3.7-org python3 -c 'exit()'
    index-sha256:6008....1237: done |++++++++++++++++++++++++++++++|
    manifest-sha256:48ea...30ce7: done |++++++++++++++++++++++++++++++|
    config-sha256:94c9....9290: done |++++++++++++++++++++++++++++++|
    layer-sha256:f860....fbf6: done |++++++++++++++++++++++++++++++|
    layer-sha256:d779....3cc5: done |++++++++++++++++++++++++++++++|

    layer-sha256:adbd....f52c: done |++++++++++++++++++++++++++++++|
    layer-sha256:c495....736a: done |++++++++++++++++++++++++++++++|
    elapsed: 41.3s total: 321.3 (16.7 MiB/s)
    Lazy Pulling


    View Slide

  46. OCI Runtime Spec v1.1.0
    46
    04

    View Slide

  47. Kubelet
 Linux など

    Container Runtime
    High-Level Low-Level
    OCI
    Runtime
    Spec
    Container
    Runtime
    I nterface
    これ!
    47

    View Slide

  48. 先⽉に3年ぶりのリリース!
    v1.0.2 からは21個の新しい機能
    cgroup v2 / idmapped mount / seccomp notify …
    OCI Runtime Specification v1.1.0

    48

    View Slide

  49. sched_setattr(2) をコンテナに適⽤される
    コンテナに対してnice値とか設定可能に
    コンテナってプロセスなんだ...というのを強く意識させられる
    実装 runc#3895 , youki#1706 , crun✅
    Scheduler entity #1188

    49

    View Slide

  50. ioprio_set (2) をコンテナに適⽤される
    バッチ処理とかI/Oが重たいけど重要度は⾼くない処理で書き
    込みで他のコンテナへの迷惑を少なくする
    実装 runc#3783 , youki ✅, crun ✅
    I/O Priority #1191

    50

    View Slide

  51. 51
    WebAssembly
    ➔ 新しい形
    ➔ containerd-shim-wasm[edge|time]-v1
    Lazy Pulling
    ➔ コンテナ起動の⾼速化
    ➔ Snapshotter Plugin
    OCI Runtime Specification v1.1.0
    ➔ sched_setattr(2) : nice値を変更可能に
    ➔ ioprio_set(2)r(2) : I/Oの優先度を変更可能に
    Recap

    View Slide

  52. 謝辞
    52
    05

    View Slide

  53. stargz snapshotterの実装について
    丁寧に解説して頂きました
    ありがとうございました

    53
    TOKUNAGA Kohei -san
    @ktock / @TokunagaKohei

    View Slide

  54. Thanks you!
    54

    View Slide