Evoluation of Linux Container Virtualization
12 likes4,190 views
Hypervisors, Linux Containers, Linux Kernel features used by Containers, LXC Engine, Docker, CoreOS and Kubernetes
Ad
More Related Content
What's hot (20)
Viewers also liked (20)
Ad
Similar to Evoluation of Linux Container Virtualization (20)
Ad
More from Imesh Gunaratne (20)
Recently uploaded (20)
Evoluation of Linux Container Virtualization
- 1. Evolution of Linux Container Virtualization Imesh Gunaratne Technical Lead, WSO2 Committer & PMC Member, Apache Stratos
- 2. Agenda โ Virtualization โ Linux Containers โ LXC โ Docker โ CoreOS โ Kubernetes
- 4. Virtualization In computing, refers to the act of creating a virtual (rather than actual) version of something, including but not limited to a virtual computer hardware platform, operating system (OS), storage device, or computer network resources. http://en.wikipedia.org/wiki/Virtualization
- 5. Hypervisor A hypervisor or virtual machine monitor (VMM) is a piece of computer software, firmware or hardware that creates and runs virtual machines. http://en.wikipedia.org/wiki/Hypervisor
- 7. Linux Containers Linux Container Brief for IEEE WG P2302, Boden Russell
- 8. Linux Containers An operating systemโlevel virtualization method for running multiple isolated Linux systems (containers) on a single control host. http://en.wikipedia.org/wiki/LXC
- 9. Linux Kernel Features used by Linux Containers โ Namespaces โ cgroups โ AppArmor โ SELinux โ seccomp โ chroot
- 10. Namespaces Wraps global system resources in an abstraction that makes it appear to the processes that they have their own isolated instance of the global resource. Included in Linux Kernel 2.4.19 http://lwn.net/Articles/531114/
- 11. Namespaces Currently, Linux implements six different types of namespaces: 1. mnt (mount points, filesystems) 2. pid (processes) 3. net (network stack) 4. ipc (inter-process communication) 5. uts (hostname) 6. user (user ids) http://www.cs.ucsb.edu/~rich/class/cs290-cloud/papers/lxc-namespace.pdf
- 12. cgroups (Control Groups) A Linux kernel feature to limit, account, and isolate resource usage (CPU, memory, disk I/O, etc.) of process groups. Started by engineers in Google in 2007 and merged into the Linux Kernel 2.6.24 http://en.wikipedia.org/wiki/Cgroups
- 13. cgroups (Control Groups) โ Access: which devices can be used per cgroup โ Resource limiting: memory, CPU, device accessibility, block I/O, etc โ Prioritization: who gets more of the CPU, memory, etc โ Accounting: resource usage per cgroup โ Control: freezing & checkpointing http://en.wikipedia.org/wiki/Cgroups
- 14. AppArmor AppArmor is a Linux security module implemented using the Linux Security Modules (LSM) kernel interface. It allows the system administrator to associate with each program a security profile that restricts the capabilities of that program. http://en.wikipedia.org/wiki/AppArmor
- 15. SELinux (Security Enhanced Linux) SELinux is a Linux kernel security module that provides a mechanism for supporting access control on security policies for programs. Originally developed by the United States National Security Agency (NSA). Included in Linux kernel 2.6.0-test3, released on 8 August 2003 http://en.wikipedia.org/wiki/Security-Enhanced_Linux
- 16. SELinux - How it works โ Compiled into the Linux kernel โ Package security policies in the distribution โ Policies in most distributions are applied only to system processes, not user processes โ Checks database of rules on syscalls โ Policies allows/denies what a daemon can access and how โ Prevents daemons compromise affecting other files/users/etc (namespaces) SELinux for Everyday Users, PaulWay
- 17. seccomp (Secure Computing Mode) โ seccomp is a secure-computing facility that provides an application sandboxing mechanism in the Linux kernel. โ Provides isolation for computing โ It allows a process to make a one-way transition into a "secure" state where it cannot make any system calls except exit(), sigreturn(), read() and write(). http://en.wikipedia.org/wiki/Seccomp
- 18. seccomp (Secure Computing Mode) It was merged into the Linux kernel mainline in version 2.6.12, released on March 8, 2005. http://en.wikipedia.org/wiki/Seccomp
- 20. chroot A chroot on Unix operating systems is an operation that changes the root directory for the current running process and its children. A program that is run in such a modified environment cannot name (and therefore normally not access) files outside the designated directory tree. http://en.wikipedia.org/wiki/Chroot
- 21. chroot The modified environment is called a "chroot jail" Introduced in version 7 Unix in 1979, and added to BSD by Bill Joy on 18 March 1982 http://en.wikipedia.org/wiki/Chroot
- 22. LXC A Hypervisor for Linux Containers
- 23. LXC Engine: A Hypervisor for Containers Linux Container Brief for IEEE WG P2302, Boden Russell
- 24. LXC (LinuX Containers) LXC is an operating systemโlevel virtualization method for running multiple isolated Linux systems (containers) on a single control host. โ From the inside it looks like a VM โ From the outside it looks like a normal process โ Provides lightweight virtualization
- 25. Kernel Features used by LXC โ Kernel namespaces (ipc, uts, mount, pid, network and user) โ Control groups (cgroups) โ Apparmor and SELinux profiles โ Seccomp policies โ Chroots (using pivot_root) โ Kernel capabilities
- 27. Docker Docker is an open platform for developers and sysadmins to build, ship, and run distributed applications. โ Initially developed by dotCloud โ Original version written in Python, now written in Go โ A very young project (started March, 2013), but with a huge community
- 28. Problem: Shipping Software Introduction to Docker, Jรฉrรดme Petazzoni
- 29. Solution: Linux Container Introduction to Docker, Jรฉrรดme Petazzoni
- 30. Solved Introduction to Docker, Jรฉrรดme Petazzoni
- 31. Virtual Machines Vs Docker
- 32. Docker Architecture Enterprise Docker, Adrien BLIND, Aurelien GABET, Arnaud MAZIN
- 33. Docker - Hello World # Get one base Docker image >docker pull ubuntu # List Docker images available >docker images # Run hello world >docker run ubuntu:14.04 echo "hello world" Docker Paris Meetup, Victor Vieux, dotCloud Inc
- 34. Detached mode # Run hello world in detached mode (-d) >docker run -d ubuntu sh -c "while true; do echo hello world; sleep 1; done" # Get containerโs ID >docker ps # Attach to the container >docker attach <container-id> # Stop/start/restart the container >docker stop <container-id> Docker Paris Meetup, Victor Vieux, dotCloud Inc
- 36. CoreOS CoreOS is a new Linux distribution that has been re-architected to provide features needed to run modern infrastructure stacks.
- 38. CoreOS Architecture Fleet ties together systemd and etcd into a distributed init system
- 40. Kubernetes Kubernetes is an open source implementation of container cluster management.
- 41. Kubernetes High Level Architecture
- 42. Kubernetes High Level Architecture
- 44. Kubernetes Terminology โ Pod - A group of Containers โ Labels - Labels for identifying pods โ Kubelet - Container Agent โ Proxy Service - A load balancer for Pods โ etcd - A metadata service โ cAdvisor - Container Advisor provides resource usage/performance statistics โ Replication Controller - Manages replication of pods โ Scheduler - Schedules pods in worker nodes โ API server - Kubernetes API server
- 45. References โ http://en.wikipedia.org/wiki/Virtualization โ http://en.wikipedia.org/wiki/Hypervisor โ http://en.wikipedia.org/wiki/LXC โ http://www.cs.ucsb.edu/~rich/class/cs290- cloud/papers/lxc-namespace.pdf โ http://en.wikipedia.org/wiki/Cgroups โ http://en.wikipedia.org/wiki/AppArmor โ http://en.wikipedia.org/wiki/Security- Enhanced_Linux โ http://www.lorien.ch/server/chroot.html
- 46. References โ SELinux for Everyday Users, PaulWay โ http://en.wikipedia.org/wiki/Seccomp โ http://en.wikipedia.org/wiki/Chroot โ Linux Container Brief for IEEE WG P2302, Boden Russell โ http://kubernetes.io/ โ https://coreos.com