Next Generation Tools for container technology Dan Walsh @rhatdan - - PowerPoint PPT Presentation

▶
next generation tools for container technology
SMART_READER_LITE
LIVE PREVIEW

Next Generation Tools for container technology Dan Walsh @rhatdan - - PowerPoint PPT Presentation

Oct 23, 2023 485 likes •1.36k views

Next Generation Tools for container technology Dan Walsh @rhatdan Please Stand Please read out loud all text in RED I Promise To say Container Registries Rather than Docker registries I Promise To say Container Images Rather than

slide-1
SLIDE 1

Next Generation Tools for container technology

Dan Walsh @rhatdan

slide-2
SLIDE 2

Please Stand

slide-3
SLIDE 3

Please read

  • ut loud all

text in RED

slide-4
SLIDE 4

I Promise

slide-5
SLIDE 5

To say Container Registries Rather than Docker registries

slide-6
SLIDE 6

I Promise

slide-7
SLIDE 7

To say Container Images Rather than Docker images

slide-8
SLIDE 8

I Promise

slide-9
SLIDE 9

To say Containers Rather than Docker Containers

slide-10
SLIDE 10

Sit Down

slide-11
SLIDE 11
slide-12
SLIDE 12
slide-13
SLIDE 13

What do you need to run a container

  • Standard Definition of what makes up a container image.

○ OCI Image Bundle Definition

slide-14
SLIDE 14

Introducing Skopeo

https://github.com/containers/skopeo

#nobigfatdaemons

slide-15
SLIDE 15

Skopeo

  • $ skopeo inspect docker://docker.io/fedora
  • $ skopeo copy docker://busybox:1-glibc atomic:myns/unsigned:streaming

$ skopeo copy docker://busybox:latest dir:existingemptydirectory $ skopeo copy docker://busybox:latest oci:busybox_ocilayout:latest

  • $ skopeo delete docker://localhost:5000/imagename:latest

#nobigfatdaemons

slide-16
SLIDE 16

What do you need to run a container`

  • Standard Definition of what makes up a container image.

○ OCI Image Bundle Definition

  • Mechanism to pull images from a container registry to the host

○ github.com/containers/image

slide-17
SLIDE 17

What do you need to run a container

  • Standard Definition of what makes up a container image.

○ OCI Image Bundle Definition

  • Mechanism to pull images from a container registry to the host

○ github.com/containers/image

  • Ability to explode images onto COW file systems on disk

○ github.com/containers/storage

slide-18
SLIDE 18

What do you need to run a container

  • Standard Definition of what makes up a container image.

○ OCI Image Bundle Definition

  • Mechanism to pull images from a container registry to the host

○ github.com/containers/image

  • Ability to explode images onto COW file systems on disk

○ github.com/containers/storage

  • Standard mechanism for running a container

○ OCI Runtime Spec (1.0) ○ runc default implementation of OCI Runtime Spec (Same tool Docker uses to run containers)

slide-19
SLIDE 19

#nobigfatdaemons

slide-20
SLIDE 20

#nobigfatdaemons

slide-21
SLIDE 21

What does OpenShift/Kubernetes need run a container?

CRI - Container Runtime Interface

#nobigfatdaemons

slide-22
SLIDE 22

CRI - Container Runtime Interface Kubernetes tells CRI to run Container Image:

#nobigfatdaemons

What does OpenShift/Kubernetes need run a container?

slide-23
SLIDE 23

CRI - Container Runtime Interface Kubernetes tells CRI to run Container Image:

  • CRI needs to pull image from Container Registry

#nobigfatdaemons

What does OpenShift/Kubernetes need run a container?

slide-24
SLIDE 24

CRI - Container Runtime Interface Kubernetes tells CRI to run Container Image:

  • CRI needs to pull image from Container Registry
  • CRI Needs to store image on COW File system

#nobigfatdaemons

What does OpenShift/Kubernetes need run a container?

slide-25
SLIDE 25

CRI - Container Runtime Interface Kubernetes tells CRI to run Container Image:

  • CRI needs to pull image from Container Registry
  • CRI Needs to store image on COW File system
  • CRI Needs to execute OCI Runtime

#nobigfatdaemons

What does OpenShift/Kubernetes need run a container?

slide-26
SLIDE 26

Introducing CRI-O

#nobigfatdaemons

slide-27
SLIDE 27

Introducing CRI-O

CRI-O - OCI-based implementation of Kubernetes Container Runtime Interface

  • Scope tied to kubernetes CRI
  • Only supported user is kubernetes
  • Uses standard components as building blocks

“Nothing more, Nothing Less” #nobigfatdaemons

slide-28
SLIDE 28

#nobigfatdaemons

slide-29
SLIDE 29

#nobigfatdaemons

slide-30
SLIDE 30

#nobigfatdaemons

slide-31
SLIDE 31

S W A R M

#nobigfatdaemons

slide-32
SLIDE 32

S W A R M

#nobigfatdaemons

slide-33
SLIDE 33

M O B Y

#nobigfatdaemons

slide-34
SLIDE 34

M O B Y

#nobigfatdaemons

slide-35
SLIDE 35

M O B Y

#nobigfatdaemons

slide-36
SLIDE 36

#nobigfatdaemons

slide-37
SLIDE 37

Overview of additional components

  • ci-runtime-tools library is used to generate OCI configs for containers

#nobigfatdaemons

slide-38
SLIDE 38

Overview of additional components

  • ci-runtime-tools library is used to generate OCI configs for containers
  • CNI is used for setting up networking

○ Tested with Flannel, Weave and openshift-sdn

#nobigfatdaemons

slide-39
SLIDE 39

Overview of additional components

  • ci-runtime-tools library is used to generate OCI configs for containers
  • CNI is used for setting up networking

○ Tested with Flannel, Weave and openshift-sdn

  • conmon is a utility for:

○ Monitoring ○ Logging ○ Handling tty ○ Serving attach clients ○ Detecting and reporting OOM

#nobigfatdaemons

slide-40
SLIDE 40

Pod architecture (runc)

Infra Container

Pod

(ipc, net, pid namespaces, cgroups) Container A (runc) Container B (runc) conmon conmon conmon #nobigfatdaemons

slide-41
SLIDE 41

Pod architecture (Kata Containers)

Virtual Machine

(ipc, net, pid namespaces, cgroups) Container A (kata-runtime) Container B (kata-runtime) conmon conmon #nobigfatdaemons kata-shim kata-shim

Pod (net namespace, cgroups)

slide-42
SLIDE 42

Architecture

#nobigfatdaemons

slide-43
SLIDE 43

Status

  • All e2e, cri-tools, integration, 9 test suites, (>500) tests passing.

○ No PRs merged without passing all the tests #nobigfatdaemons

slide-44
SLIDE 44

Status

  • All e2e, cri-tools, integration, 9 test suites, (>500) tests passing.

○ No PRs merged without passing all the tests.

  • 1.0.7 (kube 1.7.x) supported. (December 2017)

#nobigfatdaemons

slide-45
SLIDE 45

Status

  • All e2e, cri-tools, integration, 9 test suites, (>500) tests passing.

○ No PRs merged without passing all the tests.

  • 1.0.7 (kube 1.7.x) supported. (December 2017)
  • 1.9.12 (kube 1.9.x) released.

○ CRI-O fully supported in OpenShift 3.9 along with docker.

#nobigfatdaemons

slide-46
SLIDE 46

Status

  • All e2e, cri-tools, integration, 9 test suites, (>500) tests passing.

○ No PRs merged without passing all the tests.

  • 1.0.7 (kube 1.7.x) supported. (December 2017)
  • 1.9.12 (kube 1.9.x) released.

○ CRI-O fully supported in OpenShift 3.9 along with docker.

  • 1.10.6 (kube 1.10.x) released.

#nobigfatdaemons

slide-47
SLIDE 47

Status

  • All e2e, cri-tools, integration, 9 test suites, (>500) tests passing.

○ No PRs merged without passing all the tests.

  • 1.0.7 (kube 1.7.x) supported. (December 2017)
  • 1.9.12 (kube 1.9.x) released.

○ CRI-O fully supported in OpenShift 3.9 along with docker.

  • 1.10.6 (kube 1.10.x) released.
  • 1.11.2 (Kube 1.11.x) released

#nobigfatdaemons

slide-48
SLIDE 48

Status

  • All e2e, cri-tools, integration, 9 test suites, (>500) tests passing.

○ No PRs merged without passing all the tests.

  • 1.0.7 (kube 1.7.x) supported. (December 2017)
  • 1.9.12 (kube 1.9.x) released.

○ CRI-O fully supported in OpenShift 3.9 along with docker.

  • 1.10.6 (kube 1.10.x) released.
  • 1.11.2 (Kube 1.11.x) released
  • 1.12.1 (Kube 1.12.x) released
  • Goal for Openshift 4.0 is to fully support CRI-O by default.

#nobigfatdaemons

slide-49
SLIDE 49

Status

CRI-O is now powering nodes on OpenShift Online.

#nobigfatdaemons

slide-50
SLIDE 50

" CRI-O just works for them, so they haven’t had much to say"

#nobigfatdaemons

slide-51
SLIDE 51

Making running containers in production

boring

#nobigfatdaemons

slide-52
SLIDE 52

What else does OpenShift need?

  • Ability to build container images
  • Ability to push container images to container registries

#nobigfatdaemons

slide-53
SLIDE 53

#nobigfatdaemons

slide-54
SLIDE 54

Introducing Buildah

https://github.com/containers/buildah

#nobigfatdaemons

slide-55
SLIDE 55

#nobigfatdaemons

https://github.com/containers/buildah

slide-56
SLIDE 56

#nobigfatdaemons

slide-57
SLIDE 57

Coreutils for building containers. Simple interface

#nobigfatdaemons

slide-58
SLIDE 58

Coreutils for building containers. Simple interface # ctr=$(buildah from fedora)

#nobigfatdaemons

slide-59
SLIDE 59

Coreutils for building containers. Simple interface # ctr=$(buildah from fedora) # mnt=$(buildah mount $ctr)

#nobigfatdaemons

slide-60
SLIDE 60

#nobigfatdaemons

slide-61
SLIDE 61

Coreutils for building containers. Simple interface # ctr=$(buildah from fedora) # mnt=$(buildah mount $ctr) # cp -R src $mnt

#nobigfatdaemons

slide-62
SLIDE 62

Coreutils for building containers. Simple interface # ctr=$(buildah from fedora) # mnt=$(buildah mount $ctr) # cp -R src $mnt # dnf install --installroot=$mnt httpd

#nobigfatdaemons

slide-63
SLIDE 63

Coreutils for building containers. Simple interface # ctr=$(buildah from fedora) # mnt=$(buildah mount $ctr) # cp -R src $mnt # dnf install --installroot=$mnt httpd # make install DESTDIR=$mnt

#nobigfatdaemons

slide-64
SLIDE 64

Coreutils for building containers. Simple interface # ctr=$(buildah from fedora) # mnt=$(buildah mount $ctr) # cp -R src $mnt # dnf install --installroot=$mnt httpd # make install DESTDIR=$mnt # buildah config --entrypoint=/usr/sbin/test.sh --env foo=bar $ctr

#nobigfatdaemons

slide-65
SLIDE 65

Coreutils for building containers. Simple interface # ctr=$(buildah from fedora) # mnt=$(buildah mount $ctr) # cp -R src $mnt # dnf install --installroot=$mnt httpd # make install DESTDIR=$mnt # buildah config --entrypoint=/usr/sbin/test.sh --env foo=bar $ctr # buildah commit $ctr myhttpd

#nobigfatdaemons

slide-66
SLIDE 66

Coreutils for building containers. Simple interface # ctr=$(buildah from fedora) # mnt=$(buildah mount $ctr) # cp -R src $mnt # dnf install --installroot=$mnt httpd # make install DESTDIR=$mnt # buildah config --entrypoint=/usr/sbin/test.sh --env foo=bar $ctr # buildah commit $ctr myhttpd # buildah push myhttpd docker://rhatdan/myhttpd

#nobigfatdaemons

slide-67
SLIDE 67

Dan Wait!

#nobigfatdaemons

slide-68
SLIDE 68

Dan Wait! What about Dockerfile?????

#nobigfatdaemons

slide-69
SLIDE 69

Buildah also supports Dockerfile buildah build-using-dockerfile -f Dockerfile .

#nobigfatdaemons

slide-70
SLIDE 70

Buildah also supports Dockerfile buildah build-using-dockerfile -f Dockerfile . Or for those lazy ones: buildah bud -f Dockerfile .

#nobigfatdaemons

slide-71
SLIDE 71

Does Buildah have a scripting language? Perhaps Buildahfile?

#nobigfatdaemons

slide-72
SLIDE 72

BASH

#nobigfatdaemons

slide-73
SLIDE 73

BASH

We want others to build higher level tools on Buildah.

#nobigfatdaemons

slide-74
SLIDE 74

BASH

We want others to build higher level tools on Buildah. Working to make OpenShift use Buildah for S2I containers rather then use Docker.

#nobigfatdaemons

slide-75
SLIDE 75

BASH

We want others to build higher level tools on Buildah. Working to make OpenShift use Buildah for S2I containers rather then use Docker. Want to work with Ansible-containers to use buildah for containers as well.

#nobigfatdaemons

slide-76
SLIDE 76

What else does OpenShift need?

  • Ability to diagnose problems on the host
  • If you don’t use Docker to run the containers, how does an admin discover what is going on in his Container

runtime, without the docker CLI? #nobigfatdaemons

slide-77
SLIDE 77

Introducing podman part of the libpod effort

#nobigfatdaemons

slide-78
SLIDE 78

Introducing podman part of the libpod effort

podman is tool for managing POD/Containers based on the Docker CLI

https://github.com/containers/libpod

#nobigfatdaemons

slide-79
SLIDE 79

Introducing podman

podman is tool for managing POD/Containers based on the Docker CLI # podman ps -a #nobigfatdaemons

https://github.com/containers/libpod

slide-80
SLIDE 80

Introducing podman

podman is tool for managing POD/Containers based on the Docker CLI # podman ps -a # podman run -ti fedora sleep 2000 #nobigfatdaemons

https://github.com/containers/libpod

slide-81
SLIDE 81

Introducing podman

podman is tool for managing POD/Containers based on the Docker CLI # podman ps -a # podman run -ti fedora sleep 2000 # podman exec -ti fedora sh #nobigfatdaemons

https://github.com/containers/libpod

slide-82
SLIDE 82

Introducing podman

podman is tool for managing POD/Containers based on the Docker CLI # podman ps -a # podman run -ti fedora sleep 2000 # podman exec -ti fedora sh # podman images ... #nobigfatdaemons

https://github.com/containers/libpod

slide-83
SLIDE 83
slide-84
SLIDE 84

https://github.com/mairin/coloringbook-container-commandos/blob/master/Web.pdf

slide-85
SLIDE 85

Building Containers the hard and easy way Saturday August 18, 2018 3:50pm - 4:25pm Container Security: So many options, use them all Saturday August 18, 2018 2:10pm - 2:45pm

slide-86
SLIDE 86

Questions

Blog: https://medium.com/cri-o Github:

  • https://github.com/kubernetes-sigs/cri-o
  • https://github.com/containers/buildah
  • https://github.com/containers/skopeo
  • https://github.com/containers/libpod (podman)
  • https://github.com/containers/storage
  • https://github.com/containers/image

Site: https://cri-o.io IRC: freenode: #cri-o Site: https://podman.io IRC: freenode: #podman Site: https://buildah.io IRC: freenode: #buildah