Cloning Running Servers with Docker and CRIU by Ross Boucher
1 like4,946 views
The document discusses the evaluation and checkpointing of Docker containers using an evaluation controller and application server. It includes code snippets and messages for evaluating expressions, restoring containers, and handling various management tasks. Additionally, the document touches on security concerns and constraints in Docker container management.
![x = 1
1
++x
2
x == 2
true
[1]
[2]
[3]
x = 1
1
++x
2
x == 2
true
[4]
[2]
[3]](https://image.slidesharecdn.com/rossbouchercloningrunningservers-160624171020/85/Cloning-Running-Servers-with-Docker-and-CRIU-by-Ross-Boucher-4-320.jpg)
![message: "evaluate"
nodeVersion: "4.x.x"
sources: [{
type: "source",
text: "var x = 2 + 2",
checksum: "a8efd"
}]
url: "/users/boucher/repositories/12345/branches/master"
2 + 2 Application
Server](https://image.slidesharecdn.com/rossbouchercloningrunningservers-160624171020/85/Cloning-Running-Servers-with-Docker-and-CRIU-by-Ross-Boucher-9-320.jpg)
![message: "get-evaluator"
nodeVersion: "4.x.x"
checksums: [ "a8efd" ]
url: "/users/boucher/repositories/12345/branches/master"
2 + 2
Evaluation
Controller
Application
Server](https://image.slidesharecdn.com/rossbouchercloningrunningservers-160624171020/85/Cloning-Running-Servers-with-Docker-and-CRIU-by-Ross-Boucher-10-320.jpg)
![function get_evaluator(configuration) {
if (cached_containers[configuration]) {
return cached_containers[configuration]
}
if (checkpoint_exists(configuration)) {
return restored_container(configuration);
}
return pooled_container(configuration)
}
2 + 2
Evaluation
Controller](https://image.slidesharecdn.com/rossbouchercloningrunningservers-160624171020/85/Cloning-Running-Servers-with-Docker-and-CRIU-by-Ross-Boucher-11-320.jpg)
![message: "predict-evaluator"
checksums: [ "a8efd" ]
url: "/users/boucher/repositories/12345/branches/master"
2 + 2
Evaluation
Controller
Application
Server](https://image.slidesharecdn.com/rossbouchercloningrunningservers-160624171020/85/Cloning-Running-Servers-with-Docker-and-CRIU-by-Ross-Boucher-19-320.jpg)
![function predict_evaluator(configuration) {
var cpPath = “/checkpoints/<document_id>/<checksum>/”;
var metadata = await fs.readFile(metadata, cpPath + “/metadata.txt”);
var container = await docker.restore({
ImagesDirectory: cpPath
...
});
cached_containers[configuration] = container;
}
2 + 2Evaluation
Controller](https://image.slidesharecdn.com/rossbouchercloningrunningservers-160624171020/85/Cloning-Running-Servers-with-Docker-and-CRIU-by-Ross-Boucher-20-320.jpg)
![message: "evaluate"
nodeVersion: "4.x.x"
sources: [
{ type: "source", text: "var x = 2 + 2", checksum: "a8fed"},
{ type: "source", text: "x++", checksum: "b9ccc" }
]
url: "/users/boucher/repositories/12345/branches/master"
Application
Server
2 + 2
4
x++](https://image.slidesharecdn.com/rossbouchercloningrunningservers-160624171020/85/Cloning-Running-Servers-with-Docker-and-CRIU-by-Ross-Boucher-22-320.jpg)
![function get_evaluator(configuration) {
if (cached_containers[configuration]) {
return cached_containers[configuration]
}
if (checkpoint_exists(configuration)) {
return restored_container(configuration);
}
return pooled_container(configuration)
}
2 + 2
Evaluation
Controller](https://image.slidesharecdn.com/rossbouchercloningrunningservers-160624171020/85/Cloning-Running-Servers-with-Docker-and-CRIU-by-Ross-Boucher-23-320.jpg)
Cloning Running Servers with Docker and CRIU by Ross Boucher
- 3. $ node >> 2 + 2 4 >> Browser Server 2 + 2 4
- 4. x = 1 1 ++x 2 x == 2 true [1] [2] [3] x = 1 1 ++x 2 x == 2 true [4] [2] [3]
- 6. (Checkpoint Restore In Userspace) CRIU
- 7. CRIU +
- 8. Application Server Evaluation Controller Public Internet Internal Network Isolated Network Container PoolUser’s Browser Primary Docker Eval Docker 2 + 2 4
- 9. message: "evaluate" nodeVersion: "4.x.x" sources: [{ type: "source", text: "var x = 2 + 2", checksum: "a8efd" }] url: "/users/boucher/repositories/12345/branches/master" 2 + 2 Application Server
- 10. message: "get-evaluator" nodeVersion: "4.x.x" checksums: [ "a8efd" ] url: "/users/boucher/repositories/12345/branches/master" 2 + 2 Evaluation Controller Application Server
- 11. function get_evaluator(configuration) { if (cached_containers[configuration]) { return cached_containers[configuration] } if (checkpoint_exists(configuration)) { return restored_container(configuration); } return pooled_container(configuration) } 2 + 2 Evaluation Controller
- 12. message: "found-evaluator" IP: "172.0.1.201" port: "7777" Evaluation Controller Application Server
- 13. message: "establish-connection" message: "get-source" index: 0 message: "source-at-index" index: 0 source: "var x = 2+2;" message: "output" value: 4 Application Server
- 14. message: "output" index: 0 value: 4 2 + 2 Application Server4
- 15. message: "checkpoint-evaluator" checksum: "a8efd" url: "/users/boucher/repositories/12345/branches/master" 2 + 2 Evaluation Controller Application Server
- 16. await container.checkpoint({ LeaveRunning: true, ImagesDirectory: “/checkpoints/<document_id>/<checksum>/” }) if (await container.changes().length > 0) { metadata.image = await container.commit({ pause: false }) } await fs.writeFile(metadata, “/checkpoints/<document_id>/<checksum>/metadata.txt”) 2 + 2Evaluation Controller
- 17. # current cli $ docker checkpoint --leave-running --image-dir=/checkpoint/path <container_id> $ docker commit --pause=false <container_id> # new cli $ docker checkpoint --exit=false <container_id> <checkpoint_id> 2 + 2Evaluation Controller
- 18. message: "get-source" ... message: "source-at-index" ... message: "finished" (process exited) Application Server
- 19. message: "predict-evaluator" checksums: [ "a8efd" ] url: "/users/boucher/repositories/12345/branches/master" 2 + 2 Evaluation Controller Application Server
- 20. function predict_evaluator(configuration) { var cpPath = “/checkpoints/<document_id>/<checksum>/”; var metadata = await fs.readFile(metadata, cpPath + “/metadata.txt”); var container = await docker.restore({ ImagesDirectory: cpPath ... }); cached_containers[configuration] = container; } 2 + 2Evaluation Controller
- 21. $ docker create tonic/worker <container_id> # current cli $ docker restore --force —image-dir=/checkpoint/path <container_id> # new cli $ docker start --checkpoint <checkpoint_id> <container_id> 2 + 2Evaluation Controller
- 22. message: "evaluate" nodeVersion: "4.x.x" sources: [ { type: "source", text: "var x = 2 + 2", checksum: "a8fed"}, { type: "source", text: "x++", checksum: "b9ccc" } ] url: "/users/boucher/repositories/12345/branches/master" Application Server 2 + 2 4 x++
- 23. function get_evaluator(configuration) { if (cached_containers[configuration]) { return cached_containers[configuration] } if (checkpoint_exists(configuration)) { return restored_container(configuration); } return pooled_container(configuration) } 2 + 2 Evaluation Controller
- 24. • Drop any capabilities you don’t need • Set CPU, memory, and network constraints • User Namespaces • Network Isolation • Seccomp Security Concerns
- 25. • AUFS errors • CRIU failures • Race conditions • Zombie processes • Docker daemon restarts • Filesystem management Security Concerns
- 29. (and other potential use cases) Container Migration
- 30. ! Pre-compiled Release (based on Docker 1.10) ! Checkpoint/Restore Pull Request ! Saied Kazemi’s Linux Plumber’s Talk ! CRIU Homepage ! DockerCon Doom Demo ! Tonic Blog on checkpoint/restore ! DockWorker on Github ! Using P.Haul with Docker ! DockerScript is a cool tool we use to manage our images Further Reading