Who I Think You Are Software engineer, Sysadmin, etc who is... - - PowerPoint PPT Presentation

▶
who i think you are
SMART_READER_LITE
LIVE PREVIEW

Who I Think You Are Software engineer, Sysadmin, etc who is... - - PowerPoint PPT Presentation

Jul 09, 2023 123 likes •1.29k views

Who I Think You Are Software engineer, Sysadmin, etc who is... wanting to learn about namespaces and cgroups intereseted in containers and how they work loves turtles (optional) Saturday, September 21, 13 Modern Linux Server with

slide-1
SLIDE 1

Who I Think You Are

Software engineer, Sysadmin, etc who is...

  • wanting to learn about namespaces and

cgroups

  • intereseted in containers and how they

work

  • loves turtles (optional)

Saturday, September 21, 13

slide-2
SLIDE 2

Modern Linux Server with Containers

brandon.philips@coreos.com

Saturday, September 21, 13

slide-3
SLIDE 3

Overview

Saturday, September 21, 13

slide-4
SLIDE 4

Overview

  • System Designs

Saturday, September 21, 13

slide-5
SLIDE 5

Overview

  • System Designs
  • Namespaces

Saturday, September 21, 13

slide-6
SLIDE 6

Overview

  • System Designs
  • Namespaces
  • Cgroups

Saturday, September 21, 13

slide-7
SLIDE 7

Overview

  • System Designs
  • Namespaces
  • Cgroups
  • Tooling

Saturday, September 21, 13

slide-8
SLIDE 8

The Spectrum

Saturday, September 21, 13

slide-9
SLIDE 9

Saturday, September 21, 13

slide-10
SLIDE 10

Hypervisor

Saturday, September 21, 13

slide-11
SLIDE 11

Container Hypervisor

Saturday, September 21, 13

slide-12
SLIDE 12

Container Application Container Hypervisor

Saturday, September 21, 13

slide-13
SLIDE 13

WARNING

Saturday, September 21, 13

slide-14
SLIDE 14

Saturday, September 21, 13

slide-15
SLIDE 15

Saturday, September 21, 13

slide-16
SLIDE 16

Saturday, September 21, 13

slide-17
SLIDE 17

Saturday, September 21, 13

slide-18
SLIDE 18

Saturday, September 21, 13

slide-19
SLIDE 19

Saturday, September 21, 13

slide-20
SLIDE 20

System Designs

Saturday, September 21, 13

slide-21
SLIDE 21

Saturday, September 21, 13

slide-22
SLIDE 22

Hypervisor

Saturday, September 21, 13

slide-23
SLIDE 23

Hypervisor

  • Host provides full hardware environment

Saturday, September 21, 13

slide-24
SLIDE 24

Hypervisor

  • Host provides full hardware environment
  • Block device, ethernet device, etc

Saturday, September 21, 13

slide-25
SLIDE 25

Hypervisor

  • Host provides full hardware environment
  • Block device, ethernet device, etc
  • Guests run a full kernel

Saturday, September 21, 13

slide-26
SLIDE 26

Saturday, September 21, 13

slide-27
SLIDE 27

Container

Saturday, September 21, 13

slide-28
SLIDE 28

Container

  • Host provides Kernel

Saturday, September 21, 13

slide-29
SLIDE 29

Container

  • Host provides Kernel
  • Filesystem, network interface, etc are

already there

Saturday, September 21, 13

slide-30
SLIDE 30

Container

  • Host provides Kernel
  • Filesystem, network interface, etc are

already there

  • Guest starts from /sbin/init

Saturday, September 21, 13

slide-31
SLIDE 31

Saturday, September 21, 13

slide-32
SLIDE 32

Application Container

Saturday, September 21, 13

slide-33
SLIDE 33

Application Container

  • Host provides Kernel

Saturday, September 21, 13

slide-34
SLIDE 34

Application Container

  • Host provides Kernel
  • User data, socket fd, etc are already there

Saturday, September 21, 13

slide-35
SLIDE 35

Application Container

  • Host provides Kernel
  • User data, socket fd, etc are already there
  • Starts from application not init

Saturday, September 21, 13

slide-36
SLIDE 36

Namespaces

Saturday, September 21, 13

slide-37
SLIDE 37

Imagine: cool medieval castle photo *perhaps fog rolling in*

Saturday, September 21, 13

slide-38
SLIDE 38

Filesystem

Saturday, September 21, 13

slide-39
SLIDE 39

Filesystem

  • Read-only

Saturday, September 21, 13

slide-40
SLIDE 40

Filesystem

  • Read-only
  • Shared

Saturday, September 21, 13

slide-41
SLIDE 41

Filesystem

  • Read-only
  • Shared
  • Slave

Saturday, September 21, 13

slide-42
SLIDE 42

Filesystem

  • Read-only
  • Shared
  • Slave
  • Private

Saturday, September 21, 13

slide-43
SLIDE 43

Read-only

Saturday, September 21, 13

slide-44
SLIDE 44

Private bind mount before: after: source/a-file bind/a-file mount -t tmpfs -o size=1M tmpfs source/mnt before: after: source/mnt/tmpfs-file mount -t tmpfs -o size=1M tmpfs bind/mnt2 before: after: bind/mnt2/mnt2-file

Saturday, September 21, 13

slide-45
SLIDE 45

Shared bind mount before: after: source/a-file bind/a-file mount -t tmpfs -o size=1M tmpfs source/mnt before: after: source/mnt/tmpfs-file bind/mnt/tmpfs-file mount -t tmpfs -o size=1M tmpfs bind/mnt2 before: after: source/mnt2/mnt2-file bind/mnt2/mnt2-file

Saturday, September 21, 13

slide-46
SLIDE 46

Slave bind mount before: after: source/a-file bind/a-file mount -t tmpfs -o size=1M tmpfs source/mnt before: after: source/mnt/tmpfs-file bind/mnt/tmpfs-file mount -t tmpfs -o size=1M tmpfs bind/mnt2 before: after: bind/mnt2/mnt2-file

Saturday, September 21, 13

slide-47
SLIDE 47

Patterns

  • Mounting RO /usr inside a container
  • Private /tmp per service
  • Sharing data across containers via binds

Saturday, September 21, 13

slide-48
SLIDE 48

Networking

Saturday, September 21, 13

slide-49
SLIDE 49

Networking

  • Root namespace

Saturday, September 21, 13

slide-50
SLIDE 50

Networking

  • Root namespace
  • Bridging

Saturday, September 21, 13

slide-51
SLIDE 51

Networking

  • Root namespace
  • Bridging
  • Private namespace with socket activation

Saturday, September 21, 13

slide-52
SLIDE 52

Root Namespace

  • Full access to the machine interfaces

Saturday, September 21, 13

slide-53
SLIDE 53

Root Namespace

Saturday, September 21, 13

slide-54
SLIDE 54

Root Namespace

  • Advantages

Saturday, September 21, 13

slide-55
SLIDE 55

Root Namespace

  • Advantages
  • Fast

Saturday, September 21, 13

slide-56
SLIDE 56

Root Namespace

  • Advantages
  • Fast
  • Easy to get setup

Saturday, September 21, 13

slide-57
SLIDE 57

Root Namespace

  • Advantages
  • Fast
  • Easy to get setup
  • Network looks normal

to the container

Saturday, September 21, 13

slide-58
SLIDE 58

Root Namespace

  • Advantages
  • Fast
  • Easy to get setup
  • Network looks normal

to the container

Saturday, September 21, 13

slide-59
SLIDE 59

Root Namespace

  • Advantages
  • Fast
  • Easy to get setup
  • Network looks normal

to the container

  • Disadvatages

Saturday, September 21, 13

slide-60
SLIDE 60

Root Namespace

  • Advantages
  • Fast
  • Easy to get setup
  • Network looks normal

to the container

  • Disadvatages
  • No separation of

concerns

Saturday, September 21, 13

slide-61
SLIDE 61

Root Namespace

  • Advantages
  • Fast
  • Easy to get setup
  • Network looks normal

to the container

  • Disadvatages
  • No separation of

concerns

  • Container has full

control

Saturday, September 21, 13

slide-62
SLIDE 62

Network Bridges

Saturday, September 21, 13

slide-63
SLIDE 63

Network Bridges

  • Create a bridge, like a virtual switch

Saturday, September 21, 13

slide-64
SLIDE 64

Network Bridges

  • Create a bridge, like a virtual switch
  • Create container namespace and add

interface

Saturday, September 21, 13

slide-65
SLIDE 65

Network Bridges

  • Create a bridge, like a virtual switch
  • Create container namespace and add

interface

  • Attach container interface to bridge

Saturday, September 21, 13

slide-66
SLIDE 66

Network Bridges

Saturday, September 21, 13

slide-67
SLIDE 67

Network Bridges

  • Advantages

Saturday, September 21, 13

slide-68
SLIDE 68

Network Bridges

  • Advantages
  • More complex to get

setup

Saturday, September 21, 13

slide-69
SLIDE 69

Network Bridges

  • Advantages
  • More complex to get

setup

  • Network looks normal

to the container

Saturday, September 21, 13

slide-70
SLIDE 70

Network Bridges

  • Advantages
  • More complex to get

setup

  • Network looks normal

to the container

Saturday, September 21, 13

slide-71
SLIDE 71

Network Bridges

  • Advantages
  • More complex to get

setup

  • Network looks normal

to the container

Saturday, September 21, 13

slide-72
SLIDE 72

Network Bridges

  • Advantages
  • More complex to get

setup

  • Network looks normal

to the container

  • Disadvantages

Saturday, September 21, 13

slide-73
SLIDE 73

Network Bridges

  • Advantages
  • More complex to get

setup

  • Network looks normal

to the container

  • Disadvantages
  • Less speed

Saturday, September 21, 13

slide-74
SLIDE 74

Network Bridges

  • Advantages
  • More complex to get

setup

  • Network looks normal

to the container

  • Disadvantages
  • Less speed
  • NAT to the internet

Saturday, September 21, 13

slide-75
SLIDE 75

Network Bridges

  • Advantages
  • More complex to get

setup

  • Network looks normal

to the container

  • Disadvantages
  • Less speed
  • NAT to the internet
  • iptables to expose public

socket

Saturday, September 21, 13

slide-76
SLIDE 76

Socket Activation

Saturday, September 21, 13

slide-77
SLIDE 77

Socket Activation

  • No interface

Saturday, September 21, 13

slide-78
SLIDE 78

Socket Activation

  • No interface
  • Sockets are passed via stdin (inetd)

Saturday, September 21, 13

slide-79
SLIDE 79

Socket Activation

  • No interface
  • Sockets are passed via stdin (inetd)
  • systemd style listen fd API

Saturday, September 21, 13

slide-80
SLIDE 80

inetd style

Saturday, September 21, 13

slide-81
SLIDE 81

inetd style

  • Advantages

Saturday, September 21, 13

slide-82
SLIDE 82

inetd style

  • Advantages
  • Fast and isolated

Saturday, September 21, 13

slide-83
SLIDE 83

inetd style

  • Advantages
  • Fast and isolated
  • Simple and well

understood

Saturday, September 21, 13

slide-84
SLIDE 84

inetd style

  • Advantages
  • Fast and isolated
  • Simple and well

understood

  • Support from existing

daemons like ssh

Saturday, September 21, 13

slide-85
SLIDE 85

inetd style

  • Advantages
  • Fast and isolated
  • Simple and well

understood

  • Support from existing

daemons like ssh

  • No process running until

needed

Saturday, September 21, 13

slide-86
SLIDE 86

inetd style

  • Advantages
  • Fast and isolated
  • Simple and well

understood

  • Support from existing

daemons like ssh

  • No process running until

needed

  • Disadvantages

Saturday, September 21, 13

slide-87
SLIDE 87

inetd style

  • Advantages
  • Fast and isolated
  • Simple and well

understood

  • Support from existing

daemons like ssh

  • No process running until

needed

  • Disadvantages
  • One process per client

(scaling problems!)

Saturday, September 21, 13

slide-88
SLIDE 88

listen fd style

Saturday, September 21, 13

slide-89
SLIDE 89

listen fd style

  • Advantages

Saturday, September 21, 13

slide-90
SLIDE 90

listen fd style

  • Advantages
  • Fast and isolated

Saturday, September 21, 13

slide-91
SLIDE 91

listen fd style

  • Advantages
  • Fast and isolated
  • Only one process

needed per service

Saturday, September 21, 13

slide-92
SLIDE 92

listen fd style

  • Advantages
  • Fast and isolated
  • Only one process

needed per service

  • No process running until

needed

Saturday, September 21, 13

slide-93
SLIDE 93

listen fd style

  • Advantages
  • Fast and isolated
  • Only one process

needed per service

  • No process running until

needed

Saturday, September 21, 13

slide-94
SLIDE 94

listen fd style

  • Advantages
  • Fast and isolated
  • Only one process

needed per service

  • No process running until

needed

  • Disadvantages

Saturday, September 21, 13

slide-95
SLIDE 95

listen fd style

  • Advantages
  • Fast and isolated
  • Only one process

needed per service

  • No process running until

needed

  • Disadvantages
  • Patches required to

daemons

Saturday, September 21, 13

slide-96
SLIDE 96

Process Namespace

  • PID 1 is something else outside the

namespace

Saturday, September 21, 13

slide-97
SLIDE 97

All the Rest

Saturday, September 21, 13

slide-98
SLIDE 98

Cgroups

Saturday, September 21, 13

slide-99
SLIDE 99

Imagine: an accountant’s overflowing desk perhaps hands on head in dispair

Saturday, September 21, 13

slide-100
SLIDE 100

Block I/O

  • Limit: Weight from 10 to1000
  • Limit: Bandwidth limits R/W
  • Metrics: iops serviced, waiting and

queued

Saturday, September 21, 13

slide-101
SLIDE 101

CPU

  • Limit: Shares system 1024 is half of 2048
  • Metrics: cpuacct.stats user and system

Saturday, September 21, 13

slide-102
SLIDE 102
  • Limit: Total RSS memory limit
  • Metrics: swap, total rss, # page ins/outs

Memory

Saturday, September 21, 13

slide-103
SLIDE 103

Tooling

Saturday, September 21, 13

slide-104
SLIDE 104

docker

Saturday, September 21, 13

slide-105
SLIDE 105

nspawn

Saturday, September 21, 13

slide-106
SLIDE 106

nsenter

Saturday, September 21, 13

slide-107
SLIDE 107

/sys/fs/cgroup

Saturday, September 21, 13

slide-108
SLIDE 108

systemd units

Saturday, September 21, 13

slide-109
SLIDE 109

systemd-cgtop

Saturday, September 21, 13

slide-110
SLIDE 110

Recap

Saturday, September 21, 13

slide-111
SLIDE 111

Recap

  • Containers are built on namespaces and

cgroups

Saturday, September 21, 13

slide-112
SLIDE 112

Recap

  • Containers are built on namespaces and

cgroups

  • Namespaces provide isolation similar to

hypervisors

Saturday, September 21, 13

slide-113
SLIDE 113

Recap

  • Containers are built on namespaces and

cgroups

  • Namespaces provide isolation similar to

hypervisors

  • Cgroups provide resource limiting and

accounting

Saturday, September 21, 13

slide-114
SLIDE 114

Recap

  • Containers are built on namespaces and

cgroups

  • Namespaces provide isolation similar to

hypervisors

  • Cgroups provide resource limiting and

accounting

  • These tools can be mixed to create hybrids

Saturday, September 21, 13

slide-115
SLIDE 115

Future

Saturday, September 21, 13

slide-116
SLIDE 116

Thanks!

@BrandonPhilips @CoreOSLinux

Saturday, September 21, 13