Docker Overview
- 1. Docker Overview Rohit Jnagal, Docker Meetup, Bangalore
- 2. jnagal@ Containerizing everything @ Google Containers at scale. Resource Isolation. lmctfy libcontainer
- 3. Docker : What & Why Machine or Application containers Build Once, Configure Once. Deploy Everything* Everywhere* Reliably & Consistently Efficiently Cheaply
- 6. Docker Grounds up: Resource Isolation Cgroups : Isolation and accounting ● cpu ● memory ● block i/o ● devices ● network ● numa ● freezer image credit: mairin
- 7. Docker Grounds up: Namespaces ● Process trees. ● Mounts. ● Network. ● User accounts. ● Hostnames. ● Inter-process communication. pid_t pid = clone(..., flags, ...) CLONE_NEWUTS hostname, domainname CLONE_NEWIPC IPC objects CLONE_NEWPID Process IDs CLONE_NEWNET Network configuration CLONE_NEWNS File system mounts CLONE_NEWUSER User and Group IDs setns(int fd, int nstype) CLONE_NEWIPC CLONE_NEWNET CLONE_NEWUTS Also: unshare(flags)
- 8. Docker Grounds up: Add Security ● Linux Capabilities ○ Drops most capabilities. ○ Enable what a task needs. ● GRSEC and PAX ● SELinux ● AppArmor image credit: Leo Reynolds
- 9. Docker Grounds up: Filesystem File-system Isolation: Building a rootfs dir and chroot into it. With mount namespace, use pivot-root. Features: Layering, CoW, Caching, Diffing Solutions: UnionFS, Snapshotting FS, CoW block devices
- 10. Docker Grounds up: Filesystem From: Jérôme Petazzoni
- 11. Docker Grounds up: Processes & Networking We have resources, isolation, and file system management. Docker daemon handles starting/stopping processes with: Attach logic Logs TTY management Docker run options Events and container state Network Management NAT, Bridge, Veth Expose Links
- 12. Docker Grounds up: Images Create and share images Push, pull, commit images. Registry (public, private) and index. Dockerfiles Orchestration: Linking Containers Multi-host linking Dynamic discovery image: jbarratt
- 13. Docker Codewalk github.com/dotcloud/docker/ api : docker client and server api daemon : Managing containers and images engine: commands/jobs processing graph: store for versioned filesystem images and their relationship. registry: handling registry and repository. links: Linking containers. integration-cli: Integration tests. docs: documentation. pkg: collection of standalone utility packages that are not docker specific. sdd -> Great place to start contributing. Time for actual walkthrough...
- 14. Docker Codewalk : docker/daemon Exec Driver Graph DriverNetwork Driver Docker Daemon LXC Native AUFS BTRFS DevMapper
- 15. Docker Codewalk : pkg github.com/dotcloud/docker/pkg libcontainer: cgroup and namespaces. Uses lot of other utility packages. nsinit binary. apparmor, selinux, label : applying security profiles. mount, signals : system utilities. iptables, networkfs, netlink : network utilities. term: terminal handling systemd Let’s look through some of these.