L1051/L1052 - LINUX CONTAINER
INTERNALS
How they really work
Scott McCarty, 5/21/2018
ARCHITECTURE
ARCHITECTURE
The Internet is WRONG :-)
Important corrections
● Containers do not run ON docker.
Containers are processes - they run
on the Linux kernel. Containers are
Linux.
● The docker daemon is one of the
many user space tools/libraries that
talks to the kernel to set up
containers
3 Scott McCarty, Twitter: @fatherlinux
Production-Ready Containers
What are the building blocks you need to think about?
4 Scott McCarty Twitter: @fatherlinux Blog: bit.ly/fatherlinux
TYPICAL ARCHITECTURE
Bringing it All Together
In distributed systems, the user must interact through APIs
5 Scott McCarty, Twitter: @fatherlinux
CONTAINERS ARE LINUX
The Libraries, and Data Structures
Userspace libraries interact with the kernel
to isolate processes
● Libraries
○ LXC, LXD, LibContainer,
systemd nspawn, LibVirt
● Kernel Data Structures
○ Name Spaces
○ Cgroups
○ SELinux
6 Scott McCarty, Twitter: @fatherlinux
THE USER SPACE TOOL CHAIN
On a Single Host
The user space tool chain adds the
following:
● A local daemon
● Simple CLI/REST interface
● Support for container images (OCI)
and connection to registries
7 Scott McCarty, Twitter: @fatherlinux
THE ORCHESTRATION TOOLCHAIN
On Multiple Hosts
The orchestration toolchain adds the
following:
● More daemons (it’s a party) :-)
● Scheduling across multiple hosts
● Application Orchestration
● Distributed builds (OpenShift)
● Registry (OpenShift)
8 Scott McCarty, Twitter: @fatherlinux
THE COMMUNITY LANDSCAPE
Open Source, Leadership & Standards
The landscape is made up of committees,
standards bodies, and open source
projects:
● Docker/Moby
● Kubernetes/OpenShift
● OCI Specifications
● Cloud Native Technical Leadership
9 Scott McCarty, Twitter: @fatherlinux
OVERVIEW OF THE DIFFERENT STANDARDS
Vendor, Community, and Standards Body driven
Many different standards
10 Scott McCarty Twitter: @fatherlinux Blog: bit.ly/fatherlinux
WORKING TOGETHER
Standards in different places achieve different goals
Different standards are focused on
different parts of the stack.
● Container Images & Registries
● Container Runtimes
● Container Networking
11 Scott McCarty Twitter: @fatherlinux Blog: bit.ly/fatherlinux
CONTAINER IMAGES
Fancy Files
People forget about Glibc...
Scott McCarty Twitter: @fatherlinux Blog: bit.ly/fatherlinux
Container Images
Virtual machines and container environments
Scott McCarty Twitter: @fatherlinux Blog: bit.ly/fatherlinux
Fancy Files
Actually, they are layers...
Scott McCarty Twitter: @fatherlinux Blog: bit.ly/fatherlinux
Fancy File Servers
Actually, they are repositories
Scott McCarty Twitter: @fatherlinux Blog: bit.ly/fatherlinux
Fancy Files
How do we currently collaborate in the user space?
Scott McCarty Twitter: @fatherlinux Blog: bit.ly/fatherlinux
Fancy Files
The future of collaboration in the user space....
Scott McCarty Twitter: @fatherlinux Blog: bit.ly/fatherlinux
Fancy Files
The future of collaboration in the user space....
Scott McCarty Twitter: @fatherlinux Blog: bit.ly/fatherlinux
CONTAINER HOST
Fancy Processes
People forget about Glibc...
Scott McCarty Twitter: @fatherlinux Blog: bit.ly/fatherlinux
Linux Containers
Fancy Processes
Regular Linux Process
Containerized Process
Scott McCarty Twitter: @fatherlinux Blog: bit.ly/fatherlinux
Containerized Processes
Starting the process with namespaces, cgroups, and security controls
Scott McCarty Twitter: @fatherlinux Blog: bit.ly/fatherlinux
Containerized Processes
Starting the process in a namespace
Scott McCarty Twitter: @fatherlinux Blog: bit.ly/fatherlinux
Containerized Processes
The containerized process still use the underlying kernel abstractions...
Scott McCarty Twitter: @fatherlinux Blog: bit.ly/fatherlinux
Mounts
Copy on write vs. bind mounts
Scott McCarty Twitter: @fatherlinux Blog: bit.ly/fatherlinux
CONTAINER ORCHESTRATION
Application Containers
This is what most people think of with Docker
RED HAT AND CONTAINERS - CONFIDENTIAL - NDA REQUIRED
Container Orchestration
Multiple nodes changes everything
RED HAT AND CONTAINERS - CONFIDENTIAL - NDA REQUIRED
Container Orchestration
You can hack a solution together yourself, but it’s ugly...
RED HAT AND CONTAINERS - CONFIDENTIAL - NDA REQUIRED
Kubernetes/OpenShift
This Standardizes Everything
RED HAT AND CONTAINERS - CONFIDENTIAL - NDA REQUIRED
The Daemons
Bringing it All Together
User -> OpenShift -> Docker -> Kernel
32 Scott McCarty, Twitter: @fatherlinux
THE LOGIC
Bringing it All Together
33 Scott McCarty, Twitter: @fatherlinux
THANK YOU
plus.google.com/+RedHat facebook.com/redhatinc
linkedin.com/company/red-hat twitter.com/RedHatNews
youtube.com/user/RedHatVideos
AGENDA
L103118 - Linux container internals
10:15AM—10:25AM 11:35AM—12:05PM
INTRODUCTION CONTAINER ORCHESTRATION
10:25AM—10:40AM 12:05PM—12:15PM
ARCHITECTURE CONCLUSION
10:40AM—11:05AM
CONTAINER IMAGES
11:05AM—11:35PM
CONTAINER HOSTS
35 Scott McCarty, Twitter: @fatherlinux
Materials
The lab is made up of multiple documents and a GitHub repository
● Presentation (Google Presentation): http://bit.ly/2pYAI9W
● Lab Guide (this document): http://bit.ly/2mIElPG
● Exercises (GitHub): http://bit.ly/2n5NtPl
36 Scott McCarty, Twitter: @fatherlinux
CONTACT INFORMATION
We All Love Questions
● Billy Holmes: @gonoph111
[email protected] ● John Osborne: @openshiftfed
[email protected] ● Scott McCarty: @fatherlinux
[email protected]37 Scott McCarty, Twitter: @fatherlinux
