컨테이너 기술 소개 - Warden, Garden, Docker

1© Copyright 2014 Pivotal. All rights reserved.
Containers and PaaS: Made for Each Other
Ÿ  Why containers matter for the enterprise
Ÿ  Container basics, limitations
Ÿ  Containers are building block of PaaS
Ÿ  Warden containers on Pivotal CF
Ÿ  Docker on Pivotal CF
Ÿ  Garden containers on Pivotal CF
Ÿ  Differences at a glance

Containers Pre-date the Docker Hype
Google
started Linux
container
effort “Control
Groups”
Added to the
Linux Kernel
in 2007
Cloud
Foundry uses
Linux
container
technology -
“Warden
containers”
early 2012
Docker is like
github for
container
images
Docker joins
Cloud
Foundry
Foundation
Google,
MSFT, IBM
working on
orchestration
of multiple
Docker
containers
2006 2014
Cloud Foundry has been using container
technology pre-Docker
2012

▪  A simple analogy
•  You may not put up all the walls
•  The mechanism to put up all the walls is control groups and
namespaces
•  Comes from the Linux kernel
•  It is the same mechanism across all container technology
(Warden, Garden, Docker)
Anatomy of a Container

Containers Isolate and Abstract Resources
Ÿ  App Instances (AI’s)
run in a container
Ÿ  Containers allow
multiple AI’s to run
on a single VM
Ÿ  Maximizes
utilization without
OS overhead

Containers Are Essential for Speed
Ÿ  Portability
–  Packages any Linux application or service that can run across
clouds
–  CF Push an application artifact (.WAR, Docker image, etc.)
Ÿ  Speed
–  Start up time in seconds vs. VM minutes
–  Seconds to deploy, scale, network config, health
Ÿ  Consistency
–  Captures exact configuration of an application
–  Layers are kept separate and can be rebuilt

6© Copyright 2014 Pivotal. All rights reserved. 6© Copyright 2014 Pivotal. All rights reserved.
Warden

• PivotalCF’s container technology
• Service for managing a collection of containers
• Protocol for clients to send/receive messages
from the server
• Each DEA host runs the Warden service
What is Warden?

•  Droplet Execution Agent (Review)
•  Manage app instances
•  Track app state
•  Broadcast app state messages
•  Should have > 1 DEAs for redundancy
•  Warden
•  Pivotal CF’s container technology
•  App Instances (AI) live inside Warden containers
•  AIs run in isolation
•  AIs get fair share of resources
•  AIs get protection from noisy neighbors
Warden is part of Application Execution

•  Manages environments that AIs run in
•  Isolated
•  Ephemeral
•  Resource controlled (limit CPU, mem and disk usage;
network access)
•  Simple API for mgmt
•  Core components
•  Warden: server daemon
•  Warden-client: client (Ruby)
•  Warden-Protocol: used by server & client
•  Em-warden-client: EventMachine (Ruby)
Warden

Warden – Architecture

•  Control groups
•  Provide Isolation
•  Resource control
•  Containers
•  Network
•  NAT
•  Iptables (filter network traffic)
•  Filesystem
•  Read-only root filesystem (OS & warden specific mods)
•  Read-Write filesystem (override container specific settings
when necessary)
•  Large sparse file
•  Fixed size
Warden – How does it do it?

•  Isolation and Resource control are common goals
•  Use the same kernel primitives
•  LXC is tied to Linux
•  Warden backends can be implemented on any OS
•  OS must have a way of isolating environments
•  Warden no longer uses LXC (relied on a very small
subset of LXC functionality)
•  We wrote a tool in under 1K LOC C code
•  Preconfigured hooks for container start process
•  Allows resource configuration without concurrency issues
•  Makes the start process more transparent
Warden – LXC Differences

•  Create container
•  Handle/ID: Hex representation of container IP regardless of
network config
•  Configure container (HASH configuration options)
•  Bind_mounts
•  Grace_time
•  Disk_size_mb
•  Use container
•  Run scripts
•  Copy files in/out
•  Modify firewall rules or resource limits
•  Destroy container
•  User Request
•  Automatically after being idle
Warden – API

•  Demo Video
•  Identify the running containers
•  Logging into a Warden container
•  Network , FileSystem, processes
Demo -- Warden Containers in Action

Docker

•  A simple analogy
•  You may not put up all the walls
•  The mechanism to put up all the walls is control groups and
namespaces
•  Comes from the Linux kernel
•  It is the same mechanism across all container technology
(Warden, Garden, Docker)
Anatomy of a Container (revisited)

• Docker File (Creation of a container with specifics
like process x,y,z port a, etc.)
• Docker Image (running app instance in a
container)
• Diego is going to leverage the packaging benefits
of Docker
• Chose not to leverage libcontainer project but
only re-use some Go packages like netlink
Packaging has been improved

Docker Containers + Pivotal CF
Ÿ  Deploy, manage and scale apps that run
multiple Docker containers, on IaaS of choice.
Ÿ  Health Management
–  VMs automatically recreated in case of failure
–  Containers automatically restarted in case of failure
–  Container dependencies maintained on restart
Ÿ  Video highlighting these capabilities

Garden

• Rewrite of the Ruby and Bash portions of Warden in Go
•  Better maintainablitity
• Provides the container technology for Diego
• Separates out the server from the Backend
•  Backend maps protocol requests to OS primitives
• Protocol is platform agnostic (makes it possible for a
Windows backend to be developed)
• Supports REST API
Garden

Garden Architecture

•  Namespace
•  Provide isolation (ex. Network, FS mount points,etc)
•  Does not use User Namespace as yet
•  Resource Control
•  cpuset, cpu, cpuacct,devices and memory in a cgroup for each
container
•  Resources constraints are imposed on process in containers
•  Networking
•  Creates a pair of Ethernet devices and assigns one to the container’s
network namespace
•  Routing and firewall for a container
•  Packet filtering/shaping
•  Root FileSystem (Extends Warden’s behavior)
•  Allows containers to use configured root FS or root FS can be built from
Docker Image
•  R/W layer is added so container can update root FS
Garden – How does it do it?

•  Capacity – returns the memory and disk capacity of the host machine
•  Create – creates a container and returns its handle (a string which identifies the container)
•  Info – returns information about a specified container such as its IP address and a list of
processes running in the container
•  Run – spawns a process in the container and streams its output back to the client
•  Attach – starts streaming the output of a specified process in a specified container back to
the client
•  List – lists all container handles
•  LimitBandwidth, LimitCpu, LimitDisk, LimitMemory – adjusts the limits of a specified
container for network bandwidth, CPU shares, disk usage, and memory usage, respectively
•  NetIn – maps a port on the host machine to a port in the specified container
•  NetOut – whitelists outbound network traffic from the specified container to a specified
network and/or port
•  StreamIn – copies data into a specified file in the specified container’s file system
•  StreamOut – copies data out of a specified file in the specified container’s file system
•  Ping – checks that the garden server is running
•  Stop – terminates all processes in a specified container but leaves the container around (in
stopped state)
•  Destroy – destroys the specified container
Garden - API

The demo covers:
• Deploying Docker
• Scaling from 1 to 300 instances in less than a minute
• Balanced placement with distributed auction
• Log aggregation
• Health checks
• Zero bad requests when 20% of the infrastructure
disappears
• Respawning the missing instances
Garden + Diego in Action

Containers Alone Aren’t Enough… enter PaaS
Ÿ  Orchestration & Management of Application
Instances
–  Apps span multiple VMs
–  Apps use multiple containers
–  Dependencies with each other fail
Ÿ  Enterprise management
–  Value is unlocked when standard common
services are built into each managed container

Container technology alone is not enough for enterprises
Differences -- At a Glance
Feature Warden Docker Garden
PivotalCF
(PaaS)
Dev Agility
(Buildpacks)
Operator Agility
4 HA Levels
Eco-System
(Service Broker)

•  Container technology alone is not enough for
enterprises
•  You can take pieces and stitch them together (DIY)
•  Will need time, $$ & FTE resources
•  It takes time to get it right
•  Pivotal is not only paving the path but will be
contributing back to the Open Source Community
Conclusion
•  Garden + Diego will allow you to:
•  Run Docker Images in Warden containers
•  Simplified Management
•  Streamlined Orchestration
•  Right out of the Box in PivotalCF 1.4!

▪  Garden Overview Blog
▪  Garden + Diego in Action
▪  Docker_Spotlight
▪  Experimantal Docker Support in Ops Manager
Helpful Resources

Thank You
Jemish Patel
Community Engineer
jpatel@pivotal.io
@jemish_p
October 2014

컨테이너 기술 소개 - Warden, Garden, Docker

Recommended

More Related Content

What's hot (20)

Viewers also liked (20)

Similar to 컨테이너 기술 소개 - Warden, Garden, Docker (20)

More from seungdon Choi (10)

Recently uploaded (20)

컨테이너 기술 소개 - Warden, Garden, Docker