= data-x=’-3000’ data-y=’-2000’ data-scale=’4’ id=’title’ ## Container Solutions ## <div style="font-size:small;">From chroot to rkt, Sandstorm.io and even Mesos</div> ### Jan Wagner waja@cyconet.org

= data-x=’0’ data-y=’-2000’ data-scale=’4’ id=’first’ ## First things first

= data-x=’0’ id=’chroot’ ## Simple separation

• chroot
  • Mostly used for privilege separation and operations
  • Restrict the view on the FS

= data-x=’1200’ id=’real_separation’ ## Beginning of real separation

• (BSD) jails
  • sandboxed, own IP ect.
• (Solaris) zones
• IBM AIX Workload Partitions

= data-x=’2400’ id=’linux_separation1’ ## Early separations for Linux

• Linux-Vserver
  • Founded 2001, I started using it 2006
  • Beside other disadvantages, host kernel needs to be patched

= data-x=’0’ data-y=’1000’ id=’containers1’ ## Linux Containers

• Depends on cgroups and namespace isolation
• Fully integrated into vanilla Linux kernel
• For example used by
  • LXC
  • Docker
  • rkt 1.0
  • runc
  • Warden by Cloudfoundry
  • Unshare
  • Nspawn

= data-x=’1200’ data-y=’1000’ id=’containers2’ ## LXC

• Based on Linux Containers
• Founded August 2008 on work by IBM
• Since LXC 1.0 adequate isolation can be provided
• Lightweight virtualized (Linux) OS environments

= data-x=’2400’ data-y=’1000’ id=’containers3’ ## Docker

• Based on Linux Containers
• Uses Union (layered) file systems
• Result: Container format - libcontainer, LXC (, maybe Jails and Zones)
• Goal: package and deliver an application

= data-x=’3600’ data-y=’1000’ id=’containers4’ ## sandstorm.io

• Essentially based on Linux Containers
• Result: Sandstorm package (.spk-app)
• Goal: package and deliver an application

= data-x=’10000’ data-y=’-1000’ id=’dockervslxc’ ## Docker vs LXC

LXC

• Has init and multiple processes
• Single or multiple applications
• Normal OS environment and drop in replacement for VMs
• Storage is a simple bind mount, not layered by default

Docker

• No init and not muliple processes (can be worked around with supervisord/runit)
• Meant for single application
• Deployment, networking, storage and orchestration via Docker toolstack
• Uses FS layers and disables storage persistence, but has volumes

= data-x=’11200’ data-y=’-1000’ id=’dockervslxc2’ ## Docker vs LXC

= data-x=’12400’ data-y=’-1000’ id=’dockervslxc3’ ## Docker vs LXC

Docker has compared to LXC

• New behaviour in terms of network, storage and management
• Developer friendly model with the Dockerfile and commits
• No knowhow of OS needed
• Share and distribute applications via Registry

= data-x=’0’ data-y=’2000’ id=’docker1’ ## VM vs. Docker vs. LXC

= data-x=’1200’ data-y=’2000’ id=’docker2’ ## What might be the advantages of Docker

• Using same environment for development and production
• Isolate applications (eg. perl5 and perl6) on the same system
• Rapid deployment in large scale (in combination with Docker Registry)

= data-x=’2400’ data-y=’2000’ id=’docker3’ ## Docker architecture

= data-x=’3600’ data-y=’2000’ id=’docker4’ ## Starting Docker

= data-x=’4800’ data-y=’2000’ id=’docker5’ ## Dockerfiles

= data-x=’6000’ data-y=’2000’ id=’docker6’ ## Docker - user data?

$ telnet localhost 80
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
GET / HTTP/1.1
HOST: localhost
[...]
<title\>Welcome to nginx on Debian!</title\>
[...]

= data-x=’7200’ data-y=’2000’ id=’docker7’ ## Docker - persistent data

$ mkdir -p /tmp/nginx/ && \
  echo "Hello world" > /tmp/nginx/index.html && \
  docker run -d -p 80:80 -v /tmp/nginx/:/var/www/html \
  debian/nginx nginx
$ telnet localhost 80
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
GET / HTTP/1.1
HOST: localhost

HTTP/1.1 200 OK
[...]
Hello world

= data-x=’8400’ data-y=’2000’ id=’docker8’ ## Docker - Layered Filesystems

• Images are series of stacked, read-only (FS) layers
• Every (FS) change result into adding a new layer
• Top layer is a thin writable layer (makes the difference between container and image)

= data-x=’9600’ data-y=’2000’ id=’docker9’ ## Docker - storage driver

• Pluggable driver architecture

= data-x=’10800’ data-y=’2000’ id=’docker10’ ## Docker - Updating your OS (packages)

• You can’t use your distribution toolstack to update your software in Docker containers (or images)
• If you use less or unmaintained images, you may worry
• You need rebuild(ed) images from the bottom
  • Need to care yourself
  • Use well maintained (and thus updated) images, but depend on others

= data-x=’12000’ data-y=’2000’ id=’docker11’ ## Docker - Automate image creation

• You need to have you images creation scripts (Dockerfiles) published
• You need to build environments (infrastuture) to create you images from Dockerfiles
  • Might be catched up by CI (autobuild on commit and/or regularly)
  • Testing your images
• You need to push the images into a Registry and deploy them (automatically)

= data-x=”13200” data-y=’2000’ id=’docker12’ ## Docker - Image considerations

• In larger environments, on scale image size is getting an issue
  • Chaining commands
  • Remove intermediate and temporary file (e.g. caches)
  • Use slim base images and install only necessary packages
• Least likely changes at top to benefit from cache
• imagelayers.io

= data-x=’14400’ data-y=’2000’ id=’docker13’ ## Docker - Things are going to be very different in production

• Completely different infrastructure and deployment methods needed
• May raise TCO depending on the homogeny of your environments
• The more reasonable usage of container can you made, the more TCO is reducing

= data-x=’15600’ data-y=’2000’ id=’docker14’ ## Docker - Things you wanna know

• You need to housekeep your container and images
  • Keeping a clean docker environment
  • Docker Cleanup Commands
  • Shellscript to delete orphaned docker volumes
• Running in User Namespaces
  • (Docker-)Containers doesn’t need to be run as root

= data-x=’16800’ data-y=’2000’ id=’docker15’ ## Docker Ecosystem

• Docker Toolbox
  • Docker Compose - define and run multi-container Docker applications
  • Docker Machine - provisioning hosts and installs Docker Engine
  • Docker Kitematic - Docker GUI for Mac OS X and Windows
  • Docker Engine - creates and runs Docker containers
  • Docker Tutum - SaaS for deploying and managing Docker applications
  • Docker Hub - SaaS registry service
    • Docker Registry - stores and distribute Docker images
  • Docker Swarm - transparently scale from one to multiple Docker hosts

= data-x=’18000’ data-y=’2000’ id=’docker16’ ## Docker Ecosystem

• Kubernetes - deployment, scaling, and operations of application containers across clusters
• Mesosphere - „Data Center Operating System“
• OpenStack - Docker Driver
• Shipyard - manage Docker resources including containers, images, private registries and more
• Panamax - containerized app creator with an open-source app marketplace
• Drone - CI platform built on Docker

= data-x=’19200’ data-y=’2000’ id=’docker17’ ## Docker - Windows

• Windows 2016 container support - docker
• Running Docker Containers On Windows Server 2016 (Quick Start Guide)

= data-x=’20400’ data-y=’2000’ id=’docker18’ ## Docker - Video Tutorials

• Introduction into Docker
• Docker Fundamentals

= data-x=’0’ data-y=’-2000’ id=’beyonddocker1’ ## Going Beyond

= data-x=’1200’ data-y=’-2000’ id=’beyonddocker2’ ## Rise of the Datacenter OS - Apache Mesos

• “provides efficient resource isolation and sharing across distributed applications, or frameworks”

= data-x=’2400’ data-y=’-2000’ id=’beyonddocker3’ ## Rise of the Datacenter OS - Apache Mesos

• End of static (resource) partitioning
• Mesosphere DCOS – A Mesos-based Operating System
  • Package management
  • Command line
  • Graphic interface

= data-x=’3600’ data-y=’-2000’ id=’beyonddocker4’ ## Docker meets Mesos

• Solution for Docker is based on Marathon and Chronos
  • Marathon - long-running services
  • Chronos - batch scheduling (distributed cron jobs)
• Docker Containerizer
• Running Docker Containers on Marathon
• Deploying A Web App Using Docker

= data-x=’-3000’ data-y=’-3000’ data-scale=’4’ id=’againwhatlearned’ ## Conclusion

= data-x=’1000’ data-y=’4000’ id=’credits’

Credits

• Grains: Fine-grained Object Containers
• LXC vs Docker
• Virtualization diagram
• VM vs. Docker vs. LXC
• Docker architecture
• [Docker - Layered Filesystems Diagram] (https://www.docker.com/sites/default/files/products/what_is_layered_filesystems_sm.png)
• [Docker - Storage Driver - Pros and Cons] (https://docs.docker.com/engine/userguide/storagedriver/images/driver-pros-cons.png)

= data-x=’1000’ data-y=’4000’ id=’credits’

Credits

• Singe Linux Machine vs. Mesos Cluster
• Windows - docker version
• Windows - docker images
• Understanding the key differences between LXC and Docker
• Operating System Containers vs. Application Containers
• Container auf großer Fahrt: Das Docker-Ökosystem
• Apache Mesos and the Rise of the Datacenter OS

= data-x=’-3000’ data-y=’1000’ data-scale=’4’ id=’slides’

Slides

• http://waja.github.io/container_solutions/container_solutions/
• License: CC-SA-3.0-DE
• Mail: Jan Wagner waja@cyconet.org