container crash course
8 likes2,707 views
The document provides an overview of containers and their history. It discusses how containers emerged from features already present in Linux like namespaces and cgroups. Containers isolate resources and provide workload portability using these kernel features without the overhead of virtual machines. The wide adoption of Docker helped popularize containers by making it easy to package and share applications across systems. Managing containers at scale requires additional orchestration tools to coordinate the deployment and management of containerized workloads.
container crash course
- 1. Container Crash Course Interop Las Vegas 2015
- 3. Processes and Filesystems Interop Las Vegas 2015
- 4. Zen and the Art of System Management Interop Las Vegas 2015
- 5. Building Cloud Native Architectures Interop Las Vegas 2015
- 6. Agenda • Introduction • Containers as a metaphor • Containers from first principles • Linux Containers • Managing Containers • Really Managing Containers • What’s next?
- 9. What is a container?
- 10. History
- 11. The Box Someone thought this was interesting enough to write 400 pages.
- 12. The system, developed after World War II, dramatically reduced transport costs, supported the post-war boom in international trade, and was a major element in globalization.
- 13. Timeline • Origins in 18th Century English Coal Mining • By 1830, Railroads Carried Boxes Designed For Other Modes • Early 1900s, Closed Boxes Designed for Both Road and Rail • 1933 Bureau International des Containers et du Transport Intermodal • 1951 Purpose Built Ships • 1955, Modern Intermodal Container Developed • 1968: ISO_668 Defined the Terminology, Dimensions and Ratings • Innovation Since 1970 Optimized Logistics
- 14. McLean had initially favored the construction of "trailerships"—taking trailers from large trucks and stowing them in a ship's cargo hold.
- 15. Containers • “Intermodal” • Have Standardized Dimensions • Transported Without Being Opened • Handling Completely Mechanized • All Containers Numbered and Tracked
- 16. Impact • Did Away With Most Manual Sorting • Significantly Reduced Warehousing • Reduced Port Congestion • Shortened Shipping Time • Reduced Loss From Damage and Theft • Displaced Thousands of Dock Workers
- 17. As of 2009, approximately 90% of non- bulk cargo worldwide is moved by containers stacked on transport ships
- 18. few initially foresaw the extent of the influence of containerization on the shipping industry.
- 19. Impact wasn’t from the details of ‘containers’ but from the infrastructure and logistic optimization
- 20. where were we?
- 21. What makes a process? • executable code • machine registers • heap • stack • file descriptors • environment variables
- 22. a process is context
- 23. information maintained about and for an executing program
- 24. the abstraction of a physical processor
- 25. Some Context • Process ID (pid) • Parent process ID (ppid) • Real User ID • Effective User ID • Current Directory • File Descriptor Table • ENV
- 26. PID 0 sched actually part of the kernel
- 27. PID 1 init
- 28. UID PID PPID CPU PRI NI VSZ RSS WCHAN STAT TT TIME COMMAND 0 1 0 0 48 0 2540232 14288 - Ss ?? 49:39.12 /sbin/launchd
- 29. every process has a parent who is supposed to take care of it
- 30. Why am I telling you this?
- 31. a ‘container’ is just a process pretending it’s all alone
- 32. Containers are Not VMs “trailerships”
- 33. Well, what is a VM?
- 34. Hypervisors & Virtual Machines • software emulation of hardware • must boot another kernel • another layer between process and silicon
- 35. moving forward
- 36. On to containers
- 37. a glimpse of the future
- 38. How did we get here?
- 39. ‘container’ history • 1979 Unix v7 chroot system call • 2000 FreeBSD Jails • 2001 Linux Vserver • 2004 Solaris Zones • 2005 OpenVZ • 2006 Process Containers • 2007 cgroups merged into mainline
- 40. ‘container’ history • 2008 LXC • 2011 Cloud Foundry Warden • 2013 LMCTFY • 2013 Docker • 2014 Rocket • ??
- 41. Not New
- 42. features of the kernel
- 43. namespaces and groups • namespaces limit visibility • cgroups limit access
- 44. The purpose of each namespace is to wrap a particular global system resource in an abstraction that makes it appear to the processes within the namespace that they have their own isolated instance of the global resource.
- 45. Namespaces • mount - filesystem hierarcy • UTS - hostnames • IPC - interprocess communication • PID - process ID (different namespaces can have same PID) • network - each namespace has own devices, IP, routing tables • user - isolate the user and group id number spaces
- 46. grouping/partitioning of processes, with newly forked processes ending up in the same group (cgroup) as their parent process
- 47. cgroups • cpu • memory • cpuacct • cpuset • devices • freezer • net_cls • ns
- 48. But what is actually running?
- 49. chroot is an operation that changes the apparent root directory for the current running process and their children. A program that is run in such a modified environment cannot access files and commands outside that environmental directory tree. This modified environment is called a chroot jail.
- 50. files systems abstraction representing data, ownership and permissions
- 51. When people talk about ‘containers’ right now they are often conflating the runtime isolation and the packaging of filesystems
- 52. Blame Docker
- 54. Docker made it easy to make and share filesystem images
- 55. Docker made containers accessible to the average developer
- 56. the best thing about docker is the social sharing and workflows
- 57. the worst thing about docker is the social sharing and workflows :)
- 58. Now you have 1000s of containers deployed
- 59. Oh Wait… how?
- 60. Intermodal we just need the trains and cranes
- 62. • role based access to resources • run specified bits on demand • coordinate cross service configurations • route public requests to running bits • read and write persistent data • add and remove resources • record internal and external events • isolate resources and failures • measure performance/health • detect and determine failure (plan & provoke failure) • recover failures • work tomorrow Problems to solve…
- 63. better get to work
- 64. Resources • namespaces - http://lwn.net/ Articles/531114/ • cgroups - https:// www.kernel.org/doc/ Documentation/cgroups/ cgroups.txt • http://lattice.cf/ • http://cloudfoundry.org/ • https://linuxcontainers.org/ • https://www.docker.com/ • https://coreos.com/blog/rocket/ • http://kubernetes.io/ • http://mesos.apache.org/