Presentation by Andre Morgua, Director of Program Management, Odin

1. Nesting Containers: Real Life Observations
Andre Moruga
Director of Program Management
Odin

2. Virtualization and infrastructure platform for service providers
Secure VMs, containers, and virtualized storage
Introduced Linux container virtualization in 2001, over 1+ million production instances
Owner and/or major contributor to numerous open source efforts, including…
2

3. Why Go Nested?
Docker in Docker
Useful in Docker development
Works since Docker 0.6
Requires “privileged” mode for
the “parent” container
There is a Docker image that
does it - dind
Docker in System Containers
System containers are popular
platform for Virtual Private Servers
(VPS)
Implementations: LXC, LXD,
OpenVZ, Virtuozzo
Usage scenarios are same Virtual
Machines
Docker is expected to work

4. Benefits of Nested Containers (versus VMs)
Efficiency
No hardware virtualization overhead
Elasticity
No downtime resize anything
No hard partitioning
Tenant isolation
Solid security (15 years in hosting)
Resources caps on groups of containers
Extra isolation layer

5. What Does it Take to Run Nested Containers in Linux?
Nested Namespaces
Nested cgroups
Nested storage drivers
5

6. What’s Wrong with Storage?
Docker relies upon layered storage
Storage support is implemented via storage “graph” drivers
Available options
6
Relies on block device mount
and not allowed in containers
due to security restrictions
Slow, space consuming,
and inefficient
AUFS, Device Mapper, BTRFS, Overlay VFS

7. Better Storage for Nested Containers
“Extpoint” extensibility for storage
drivers was developed to Docker
mainstream, likely candidate for
Docker version 1.10
It allows moving storage driver
functionality outside of Docker
7
Docker
StorageExtpoint
Storage
Driver
Docker
Storage
System Container
Host

8. What’s Next?
Storage Extpoint is a framework to build a solution, but not a solution yet
Problems to solve
Storage driver “Server” piece implementation
Images need to be protected so container owner could not modify them directly
Storage space management: cannot modify but can remove when no longer needed
8

9. More Bumps Down the Road
Cgroups and Namespaces: Virtualized does not mean identical to root
Docker monitoring and management software may not work properly (e.g.
cAdvisor)
Further compatibility is likely to break as Docker evolves
9

10. Summary
It works
It is arguably good enough for “light” use
Storage extpoint and improved storage driver will make it good enough for
straightforward usage scenarios
For advanced configurations, better to wait until wider adoption
10

11. Visit Odin at Booth #24
Andre Moruga, Odin
amoruga@odin.com