State of Union - Containerz
2 likes733 views
This document provides an overview of containerization and container orchestration technologies. It discusses schedulers like Kubernetes, Docker Swarm and Mesos and how they provide services for scheduling, resource management and service discovery. It also covers container networking with options like Flannel, Calico and WeaveNet. Container security topics like host security, Docker daemon security and container image security are outlined. Micro operating systems designed for containers like CoreOS, RancherOS and Ubuntu Snappy are presented. PaaS solutions like Convox and Docker Data Center are mentioned. The document is intended to provide information on containerization in no particular order.
![In no particular order…
[ ] Schedulers and Orchestration
[ ] Networking
[ ] Security
[ ] Operating Systems
[ ] PaaS
[ ] Storage
[ ] Monitoring
[ ] Container Integration and Container Deployment
[ ] Miscellaneous](https://image.slidesharecdn.com/stateofunion-containerz-160907224305/85/State-of-Union-Containerz-10-320.jpg)
![In no particular order…
[ ] Schedulers and Orchestration
[ ] General Blurb
[ ] ECS
[ ] Kubernetes
[ ] Mesos
[ ] Docker Swarm
[ ] Orchestration Wars](https://image.slidesharecdn.com/stateofunion-containerz-160907224305/85/State-of-Union-Containerz-11-320.jpg)
![In no particular order…
[X] Schedulers and Orchestration
[ ] Networking
[ ] Security
[ ] Operating Systems
[ ] PaaS
[ ] Storage
[ ] Monitoring
[ ] Container Integration and Container Deployment
[ ] Miscellaneous](https://image.slidesharecdn.com/stateofunion-containerz-160907224305/85/State-of-Union-Containerz-18-320.jpg)
![In no particular order…
[X] Schedulers and Orchestration
[X] Networking
[ ] Security
[ ] Operating Systems
[ ] PaaS
[ ] Storage
[ ] Monitoring
[ ] Container Integration and Container Deployment
[ ] Miscellaneous](https://image.slidesharecdn.com/stateofunion-containerz-160907224305/85/State-of-Union-Containerz-23-320.jpg)
![In no particular order…
[X] Schedulers and Orchestration
[X] Networking
[X] Security
[ ] Operating Systems
[ ] PaaS
[ ] Storage
[ ] Monitoring
[ ] Container Integration and Container Deployment
[ ] Miscellaneous](https://image.slidesharecdn.com/stateofunion-containerz-160907224305/85/State-of-Union-Containerz-31-320.jpg)
![In no particular order…
[X] Schedulers and Orchestration
[X] Networking
[X] Security
[X] Operating Systems
[ ] PaaS
[ ] Storage
[ ] Monitoring
[ ] Container Integration and Container Deployment
[ ] Miscellaneous](https://image.slidesharecdn.com/stateofunion-containerz-160907224305/85/State-of-Union-Containerz-33-320.jpg)
![In no particular order…
[X] Schedulers and Orchestration
[X] Networking
[X] Security
[X] Operating Systems
[X] PaaS
[ ] Storage
[ ] Monitoring
[ ] Container Integration and Container Deployment
[ ] Miscellaneous](https://image.slidesharecdn.com/stateofunion-containerz-160907224305/85/State-of-Union-Containerz-38-320.jpg)
![In no particular order…
[X] Schedulers and Orchestration
[X] Networking
[X] Security
[X] Operating Systems
[X] PaaS
[-] Storage
[-] Monitoring
[-] Container Integration and Container Deployment
[-] Miscellaneous](https://image.slidesharecdn.com/stateofunion-containerz-160907224305/85/State-of-Union-Containerz-40-320.jpg)
State of Union - Containerz
- 1. State of Union - Containerz --------------------- Shiva (narshiva@) -------------------- ^__^ (oo)_______ (__) )/ ||----w | || ||
- 2. TO BEGIN AT THE BEGINNING… Let’s start, shall we?
- 3. Containerized Microservices Dom 0 Instance Instance Instance OS OS OS Container Runtime Container Runtime Container Runtime App App Service Service App App Service Service App App Service Service
- 4. Container Orchestration Dom 0 Instance Instance Instance OS OS OS Container Runtime Container Runtime Container Runtime App Service App App Service Service Container Orchestration
- 5. Container Orchestration Dom 0 Instance/OS Instance/OS Instance/OS App Service App App Service Service Service Management Scheduling Resource Management Orchestration Service Management §Labels §Groups/Namespaces §Dependencies §Load Balancing §Health Check §Service Discovery
- 6. Container Orchestration Dom 0 Instance/OS Instance/OS Instance/OS App Service App App Service Service Service Management Scheduling Resource Management Orchestration Scheduling §Placement §Replication/Scaling §Resurrection §Rescheduling §Rolling deploys §Upgrades §Downgrades §Colocation
- 7. Container Orchestration Dom 0 Instance/OS Instance/OS Instance/OS App Service App App Service Service Service Management Scheduling Resource Management Orchestration Resource Management §Memory §CPU §GPU §Volumes §Ports §IPs
- 8. Non Functional Capabilities Scalability Performance, Responsiveness, Efficiency Availability Fault Tolerance, Reliability, DR Flexibility Extensibility, Portability, Interoperability Usability Familiarity, Debuggability, Maintainability Portability Container Runtime, Host OS, Cloud Provider, On-prem Security Isolation, Encryption, Secrets Management, Auditability
- 9. Container Operations Development Lifecycle Source repo, CI-CD, Artefact repo Container Orchestration Scheduling, Resource Management, Service Management BAU Operations Monitoring and Metrics, Maintenance, Debugging Did you hear that?
- 10. In no particular order… [ ] Schedulers and Orchestration [ ] Networking [ ] Security [ ] Operating Systems [ ] PaaS [ ] Storage [ ] Monitoring [ ] Container Integration and Container Deployment [ ] Miscellaneous
- 11. In no particular order… [ ] Schedulers and Orchestration [ ] General Blurb [ ] ECS [ ] Kubernetes [ ] Mesos [ ] Docker Swarm [ ] Orchestration Wars
- 12. Schedulers – General Blurb Cluster Machines Cluster State Information Monolothic Two-Level Shared State No Concurrency Pessimistic Concurrency (offers) Optimistic Concurrency (transactions) Scheduling Logic
- 13. Docker Task Container Instance Amazon ECS Container ECS Agent ELB Internet ELB User / Scheduler API Cluster Management Engine Task Container Docker Task Container Instance Container ECS Agent Task Container Docker Task Container Instance Container ECS Agent Task Container AZ 1 AZ 2 Key/Value Store Agent Communication Service ECS
- 14. Mesos Master Marathon ZooKeeper Mesos + Marathon Mesos Slaves Long Running Tasks Jobs Coordination & Configuration
- 15. Kubernetes Replication Controller API Server Kubernetes Master Kubelet KubeProxy Docker Container Container Pod Pod Kubelet KubeProxy Docker Container Container Pod Pod Kubernetes Cluster etcd
- 16. Docker Swarm
- 17. I hope we win
- 18. In no particular order… [X] Schedulers and Orchestration [ ] Networking [ ] Security [ ] Operating Systems [ ] PaaS [ ] Storage [ ] Monitoring [ ] Container Integration and Container Deployment [ ] Miscellaneous
- 19. Container Networking Dom 0 Instance Instance Instance OS OS OS Container Runtime Container Runtime Container Runtime Container Container Container Container Container Container
- 20. Overlay all of the thingz • Flannel • Calico • WeaveNet • Swarm Mode
- 21. WeaveNet
- 22. Mode Swarm Mode Manager Swarm Mode Node TLS CA Load Balancing Service Discovery Distributed Store Docker Engine Libnetwork Volumes Plugins Container Runtime
- 23. In no particular order… [X] Schedulers and Orchestration [X] Networking [ ] Security [ ] Operating Systems [ ] PaaS [ ] Storage [ ] Monitoring [ ] Container Integration and Container Deployment [ ] Miscellaneous
- 24. Sekkirity is everybodys biznezz
- 25. Host Security • Lock it down! • Namespaces and cgroups are your friends • Select few belong to docker UNIX group • SELinux is also your friend • Docker daemon runs as root!
- 26. Whale-say "Only trusted users should be allowed to control your Docker daemon"
- 27. Docker daemon security • Do not run in privileged mode • Lock down inter container comms –icc=false • Secure APIs with TLS certificates
- 28. Whale-say “If you run Docker on a server, it is recommended to run exclusively Docker in the server, and move all other services within containers controlled by Docker”
- 29. Container Image Security • Use a small selection of trusted images • Scan your images • CoreOS’s Clair scans Quay.io, • Docker Security Scanning works with Docker Trusted Registry • Red Hat has built a new scanner in Project Atomic for its Atomic Registry. • Other scanners are such as Aqua Peekr, Anchore, and Twistlock Trust work independently of specific registries
- 30. Lot more prescriptive advice here… https://benchmarks.cisecurity.org/tools2/docker/CIS _Docker_1.6_Benchmark_v1.0.0.pdf
- 31. In no particular order… [X] Schedulers and Orchestration [X] Networking [X] Security [ ] Operating Systems [ ] PaaS [ ] Storage [ ] Monitoring [ ] Container Integration and Container Deployment [ ] Miscellaneous
- 32. Micro OS • CoreOS • RancherOS • Ubuntu Snappy • RedHat Atom • VmWare Photon • ECS Optimized Amazon Linux RedHat Atomic VmWare Photon Ubuntu Snappy CoreOS RancherOS 395 MB 317 MB 215 MB 20 MB 150 MB
- 33. In no particular order… [X] Schedulers and Orchestration [X] Networking [X] Security [X] Operating Systems [ ] PaaS [ ] Storage [ ] Monitoring [ ] Container Integration and Container Deployment [ ] Miscellaneous
- 35. Convox $ convox apps create go-app $ convox deploy $ convox apps info go-app $ convox build --app go-app –d "Hello Build” $ convox releases promote RLYSUALSGCT $ convox ps $ convox scale main --count=2
- 36. Docker Data Center Universal Control Plane (UCP) Security Content Trust Docker Trusted Registry Orchestration Swarm Container Runtime Engine Operating System
- 37. Others
- 38. In no particular order… [X] Schedulers and Orchestration [X] Networking [X] Security [X] Operating Systems [X] PaaS [ ] Storage [ ] Monitoring [ ] Container Integration and Container Deployment [ ] Miscellaneous
- 39. Are we there yet?
- 40. In no particular order… [X] Schedulers and Orchestration [X] Networking [X] Security [X] Operating Systems [X] PaaS [-] Storage [-] Monitoring [-] Container Integration and Container Deployment [-] Miscellaneous
- 41. Demoz • Marathon scheduler on ECS (Credit : Ryosuke-san) • Convox • Docker Swarm • Weave Net and Weave Scope • ECS (ALB, Task AutoScaling, Task IAM Role)
- 42. --------------------- T H A N K Y O U -------------------- ^__^ (oo)_______ (__) )/ ||----w | || ||