Docker: Testing the Waters LA-UR 15-25901 1 LA-UR 15-25901 - - PowerPoint PPT Presentation

▶
docker testing the waters
SMART_READER_LITE
LIVE PREVIEW

Docker: Testing the Waters LA-UR 15-25901 1 LA-UR 15-25901 - - PowerPoint PPT Presentation

Jun 01, 2023 694 likes •1k views

Eric Holm Skyler Manzanares Yuxin (Kelly) Wang http://gerardable.com/wp-content/uploads/2014/12/docker-whale-home-logo.png Docker: Testing the Waters LA-UR 15-25901 1 LA-UR 15-25901 Docker: Theres No Containing this Whale! Free,

slide-1
SLIDE 1

LA-UR 15-25901

Docker: Testing the Waters

Eric Holm Skyler Manzanares Yuxin (Kelly) Wang

1

http://gerardable.com/wp-content/uploads/2014/12/docker-whale-home-logo.png

LA-UR 15-25901

slide-2
SLIDE 2

LA-UR 15-25901

Docker: There’s No Containing this Whale!

  • Free, open-source
  • Wraps applications into packages
  • Docker Images
  • Resource isolation
  • Independent of LXC
  • Very popular (buzzword compliant)
  • Open Container Project (OCP)
  • RHEL Atomic Project

2

slide-3
SLIDE 3

LA-UR 15-25901

Docker: There’s No Containing this Whale!

  • Free, open-source
  • Wraps applications into packages
  • Docker Images
  • Resource isolation
  • Independent of LXC
  • Very popular (buzzword compliant)
  • Open Container Project (OCP)
  • RHEL Atomic Project

3

slide-4
SLIDE 4

LA-UR 15-25901

Research Objectives

  • Explore basic features/functionality
  • Build process
  • Images
  • Local registry
  • Mixed OS/mixed versions
  • Security + Maintenance
  • Updating inside containers
  • Inventory
  • Workload testing
  • Comparison to VMs

4

slide-5
SLIDE 5

LA-UR 15-25901

Test Environment

  • 11 HP ProLiant DL380p Gen8 servers
  • 2 Intel Xeon E5-2620 processors
  • 24 GB DDR3 ram
  • CentOS 6.6
  • Docker 1.6.0
  • Extreme networks 10G ethernet switch
  • Mellanox QDR InfiniBand switch

5

slide-6
SLIDE 6

LA-UR 15-25901

Docker Setup

  • Docker 1.6.0
  • CentOS 6.6 uses kernel 2.6
  • Docker 1.7.0 requires kernel 3.10
  • Docker 1.7.1

6

slide-7
SLIDE 7

LA-UR 15-25901

Docker Images + Registries

  • Image build process
  • Docker Hub
  • Local registry
  • Source code modification

7

slide-8
SLIDE 8

LA-UR 15-25901

Mixed OS Mixed Versions

8

slide-9
SLIDE 9

LA-UR 15-25901

Auto Updates

  • No init.d
  • No cron
  • Bash profile

NO

http://thomason.io/wp-content/uploads/2015/01/docker_monstro.png

9

slide-10
SLIDE 10

LA-UR 15-25901

  • System management suite
  • Push updates to clients
  • Hardware and software inventory
  • Configuration management

Spacewalk

10

http://spacewalk.redhat.com/img/spacewalk-logo.png

slide-11
SLIDE 11

LA-UR 15-25901

  • Solution to updating?
  • Software inventory
  • Configuration management

Spacewalk

11

slide-12
SLIDE 12

LA-UR 15-25901

Docker Security

  • File permissions / Missing devices
  • Dev
  • Proc
  • Sys
  • Directory mounting
  • Kernel module loading/removing
  • No access to sockets

12

slide-13
SLIDE 13

LA-UR 15-25901

Security Testing

  • Nessus scan
  • Effect host system
  • Stonix

13

slide-14
SLIDE 14

LA-UR 15-25901

HPL Test

  • 10 series test
  • 12 containers, 2 VMs
  • 4 nodes
  • 316 data points

14

slide-15
SLIDE 15

LA-UR 15-25901

HPL Test Results

15

slide-16
SLIDE 16

LA-UR 15-25901

HPL Test Results

16

slide-17
SLIDE 17

LA-UR 15-25901

HPL Test Results

17

slide-18
SLIDE 18

LA-UR 15-25901

HPL Test Results

18

slide-19
SLIDE 19

LA-UR 15-25901

HPL Test Results

19

slide-20
SLIDE 20

LA-UR 15-25901

IOR (File IO) Tests

  • 10 set series
  • 2 cores per test
  • 2 containers/VMs
  • 70 data points
  • ext4

20

slide-21
SLIDE 21

LA-UR 15-25901

IOR Results

21

slide-22
SLIDE 22

LA-UR 15-25901

Stream (Memory Access) Test

  • 50 set series
  • 2 cores per test
  • 12 containers
  • 2 nodes
  • 158 data points

22

slide-23
SLIDE 23

LA-UR 15-25901

Stream (Memory Access) Results

23

slide-24
SLIDE 24

LA-UR 15-25901

Containers vs VMs

Docker VMs Pros

▪ Free ▪ Open Source ▪ Lightweight ▪ Easily Portable ▪ Lots of Potential ▪ Established Technology ▪ Increased Isolation

Cons

▪ Kernel exposure ▪ Software Cost ▪ Overhead

24

slide-25
SLIDE 25

LA-UR 15-25901

Conclusion

  • Performance
  • Huge potential
  • Keep an eye on it!

25

slide-26
SLIDE 26

LA-UR 15-25901

Future Work

  • More VM testing (up to 12)
  • More reliable benchmarks
  • Security testing

26

slide-27
SLIDE 27

LA-UR 15-25901

Acknowledgments

  • Mentors
  • David Kennel
  • Sherry Bachicha
  • Steven Montano
  • Instructors
  • Matthew Broomfield
  • Jarrett Crews
  • CSCNSI Administration
  • Andree Jacobson
  • Carolyn Connor
  • Gary Grider
  • Josephine Olivas

27

slide-28
SLIDE 28

LA-UR 15-25901

Questions

  • Docker overview
  • Exploring Docker features
  • Security & maintenance
  • Benchmarking
  • CPU
  • File IO
  • Memory Access
  • Docker containers & VMs

28

https://docs.docker.com/images/docker-friends.png