Linux Containers

732 views
572 views

Published on

0 Comments
3 Likes
Statistics
Notes
  • Be the first to comment

No Downloads
Views
Total views
732
On SlideShare
0
From Embeds
0
Number of Embeds
7
Actions
Shares
0
Downloads
17
Comments
0
Likes
3
Embeds 0
No embeds

No notes for slide

Linux Containers

  1. 1. Linux Containers - LXC Marian HackMan Marinov 17 Jun 2014 Marian HackMan Marinov Linux Containers - LXC
  2. 2. Why am I speaking about containers? Marian HackMan Marinov Linux Containers - LXC
  3. 3. Difference between lxc and docker Docker is for applications Linux Containers are for starting up a whole new Linux distribution instances Marian HackMan Marinov Linux Containers - LXC
  4. 4. Implementation limitations LXC is not a VM. . . but it should be :) Our patches for /proc CPU cpuinfo interrupts schedstat softirqs stat timer list zoneinfo irq dir (exposes CPU limit information trough smp affinity) Memory - meminfo Others modules sysrq-trigger fs dir (shows all attached block devices) scsi dir (leaks block device information) sys dir (writes are allowed only in the main cgroup) Uptime Marian HackMan Marinov Linux Containers - LXC
  5. 5. Security Drop these capabilities sys module sys boot sys time sys rawio sys pacct sys tty config sys module mac admin mac override audit control audit write mknod setfcap syslog block suspend wake alarm Do not enable kcore/vmcore Secure kallsyms We implemented new capability - CAP LXC ADMIN tasks limit per cgroup RLIMIT NPROC && SIGNALS Limit the namespaces to a single tier instead of hirarchy We made it so, every user that has CAP LINUX IMMUTABLE to be able to actualy chattr files and dirs Marian HackMan Marinov Linux Containers - LXC
  6. 6. Security Allow umount from within a namespace Allow mounting devpts, but only with new instance Fix prctl set mm() permisions, so will work from namespaces Allow pivot root() to everyone with CAP LXC ADMIN setns() now requires CAP LXC ADMIN hardened proc permissions GRsecurity http://sw.1h.com/grsecurity Marian HackMan Marinov Linux Containers - LXC
  7. 7. Functional changes SHM, SEM, MSQ limits and inheritance Kernel version within the containers Licensing issues with other vendors xt owner match does not work tc does not work in the OOM patches from upstream memcg-kill-alloc-task proc-loadavg fixes Marian HackMan Marinov Linux Containers - LXC
  8. 8. Namespaces UTS User IPC Mount PID Network Marian HackMan Marinov Linux Containers - LXC
  9. 9. Control Groups Devices CPU cpusets cpu quota cpu shares Memory memory limits memory+swap limits kernel memory limits BlkI/O weighted I/O limiting iops I/O limiting Network priority and classification Note: actually does not work with openvswitch :) Freezer Marian HackMan Marinov Linux Containers - LXC
  10. 10. snapshots LVM snapshots work QCOW2 snapshots work(with some small issues) Marian HackMan Marinov Linux Containers - LXC
  11. 11. Near live migration CRIU - Checkpoint Restore In Userspace Dump a process(es) with its whole state Copy to the dump to a remote machine Restore the whole dump and continue Marian HackMan Marinov Linux Containers - LXC
  12. 12. Network options macvlan veth bridge utils openvswitch Marian HackMan Marinov Linux Containers - LXC
  13. 13. Thank You Marian HackMan Marinov Linux Containers - LXC

×