Downloaded 270 times
Uploaded byDocker, Inc.
Windows Server and Docker - The Internals Behind Bringing Docker and Containers to Windows by Taylor Brown and John Starks
The document details the integration of Docker with Windows, particularly focusing on Windows Server 2016 and the latest Windows 10. It outlines the architecture behind Windows Server containers, including namespaces, resource controls, and Hyper-V containers for enhanced isolation. Key features include the adaptation of Docker technology to work with Windows' native capabilities and the introduction of both Windows Server Core and Nano Server for container images.
In this document
Powered by AI
Overview of Docker integration with Windows presented by John Starks & Taylor Brown.
Presentation agenda covering the basics, architecture, and integration of Docker with Windows.
Revisiting essential concepts of Docker for better understanding in context.
Details on Docker for Windows, integration features, availability, and limitations on Linux containers.
Demo segment showcasing Docker functionality on Windows.
Explanation of system-level capabilities such as namespaces and resource controls adapted for Windows.
In-depth look at Linux architecture utilizing containerd, namespaces, and various functionalities.
Description of Windows architecture similarities and differences in container handling compared to Linux.
Announcement of the Compute service managing running containers and available language bindings.
Structural overview of Windows Server Containers and related processes.
In-depth look into how processes interact within Windows Server Containers.
Discussion on the importance of APIs and system services necessary for container operations.
Introduction to Microsoft-distributed base images for containers: windowsservercore and nanoserver.
Second demo segment illustrating the workings of Windows containers.
Explanation of resource control improvements and namespace utilization in Windows.
Details about system-level namespaces hidden from users and their mapping.
Challenges of using NTFS semantics in container frameworks and the hybrid file system model.
Discussion on how Windows Registry functions as a simple file system supporting Docker.
The presentation on Hyper-V containers providing enhanced isolation for specific workloads.
Details about executing containers in virtual machines for improved security and isolation.
Description of the internal operations of Windows Server containers with Hyper-V.
Insight into the optimized infrastructure of Hyper-V containers and their management.
Methods for streamlined operations using small utility VMs to enhance performance.
Techniques for increasing efficiency through cloning and forking utility VMs.
Final demonstration showcasing the functionality of the presented technologies.
Thanking the audience and concluding the presentation.
More Related Content
Similar to Windows Server and Docker - The Internals Behind Bringing Docker and Containers to Windows by Taylor Brown and John Starks
![[FDD 2016] Marek Śledziński - Microsoft Windows a sprawa kontenerów](https://cdn.slidesharecdn.com/ss_thumbnails/msledzinski-170302135543-thumbnail.jpg?width=640&height=640&fit=bounds)
Windows Server and Docker - The Internals Behind Bringing Docker and Containers to Windows by Taylor Brown and John Starks
- 1. Windows Server andDocker The Internals Behind Bringing Docker and Containers to Windows John Starks & Taylor Brown Principal Leads in Windows
- 2. Basics Architecture Porting Docker Agenda Shallow dive Namespaces Filesystem Base images Hyper-V Containers Two great things Better together
- 3.
- 4. Docker on Windows •Not “Docker for Windows” • Integration coming • Port of Docker Engine (not a fork) • Same remote API, same tools work on top (Compose, Swarm, etc.) • Built on new native container technology in Windows • Runs on Windows Server 2016 and on the latest Windows 10 • Runs Windows Server containers on Windows hosts • Doesn't run Linux containers • Available to try now • http://aka.ms/containers
- 5.
- 6. How? • New system-levelcontainer capabilities in Windows • Namespaces • Resource controls • Union file system • Adapted Docker to Windows • Adapted Windows to Docker
- 7. Architecture In Linux containerd+ runc REST Interface libcontainerd graphlibnetwork plugins Control Groups cgroups Namespaces Pid, net, ipc, mnt, uts Layer Capabilities Union Filesystems AUFS, btrfs, vfs, zfs*, DeviceMapper Other OS Functionality Docker Client Docker Registry Docker Compose Docker Swarm
- 8. Architecture In Windows RESTInterface libcontainerd graphlibnetwork plugins Control Groups Job objects Namespaces Object Namespace, Process Table, Networking Layer Capabilities Registry, Union like filesystem extensions Other OS Functionality Compute Service Docker Client Docker Registry Docker Compose Docker Swarm
- 9. Compute Service • Publicinterface to containers • Replaces containerd on Windows • Manages running containers • Abstracts low-level capabilities • Language bindings available • C#: https://github.com/Microsoft/ dotnet-computevirtualization • Go: https://github.com/Microsoft/ hcsshim
- 10.
- 11. Host User Mode Container Management WindowsServer Containers System Processes Application Processes System Processes System Processes Application Processes
- 12. Container contents • PublicWindows API delivered via DLLs, not syscalls • Lots of interdependencies • Highly dependent on system services running • RPC calls hidden in Win32 APIs • Automatically starts smss • init equivalent • Launches a variety of system services • No “FROM scratch”
- 13. Base images • Distributedby Microsoft • Two options • windowsservercore: large (huge?), highly compatible • nanoserver: small, fast, smaller API surface • docker pull coming soon! • microsoft/windowsservercore • microsoft/nanoserver
- 14.
- 15. Namespaces • Silo: extensionto Windows Job object • Set of processes • Resource controls • New: set of namespaces • New namespace virtualization • Registry • Process IDs, sessions • Object namespace • File system • Network compartments
- 16. Object namespace • System-levelnamespace, hidden from users • C:Windows maps to DosDevicesC:Windows • Contains all device entry points • DosDevicesC: • Registry • DeviceTcp • Silo can "chroot" to different object root • SilosfooDosDevicesC: • SilosbarDosDevicesC:
- 17.
- 18. File system • Windowsapplications expect NTFS semantics • Transactions, file IDs, USN journal • Building a full union FS with NTFS semantics is hard • Hybrid model • Virtual block device + NTFS partition per container • Symlinks to layers on host FS to keep block devices small
- 19. Registry… Windows Registry •Basically a simple file system • Built a true union FS • Saves cloning a full set of registry hives per container
- 20.
- 21. Hyper-V Containers • Someworkloads need more isolation • Hostile multi-tenancy • Regulated workloads • Solution: transparently run each container in a VM! • (Mostly) invisible to both Docker and the user • docker run --isolation=hyperv • Hyper-V Containers are the default on Windows 10 • Images are the same
- 22. Host User Mode Container Management WindowsServer Containers System Processes Application Processes System Processes System Processes Application Processes
- 23. Hyper-V Containers Host UserMode Virtual Machine Specifically Optimized To Run a Container Container Management System Processes System Processes Application Processes
- 24. Making it work •Small, stateless “utility VM” • Smallest Windows yet? • Writes not persisted • Storage attached via SMB • VMBus transport • File cache sharing • Networking attached via virtual NIC
- 25. Cloning • Launching theutility VM takes time and memory • Do it once, freeze the result • Fork the VM for each new instance • Eliminates startup time • Shares memory
- 26.
- 27.
Editor's Notes
- #6 * docker images * docker run --rm test cmd /c echo Hello DockerCon!
- #15 * docker run -it --rm windowsservercore powershell get-process * docker run -it --rm nanoserver powershell get-process * Look at taskmgr
- #18 * objdir \ * objdir \DosDevices * docker run -it --rm test cmd objdir \DosDevices
- #27 * docker run --rm --isolation=hyperv test cmd /c echo Help, I'm trapped in a VM! * Run it again (should be faster) * docker run --rm -it --isolation=hyperv test cmd powershell get-process * Show taskmgr on host