Webtech Conference: Introducing LXC: fast and secure virtualization

Introducing LXC: fast and secure virtualization Luca Bonmassar

Virtualization: a big world • Hardware virtualization • Virtual Machines • Operating system-level virtualization • Application virtualization

LXC - Linux Containers • LXC is not a virtual machine, but a virtual environment with its own process and network space • Complementary to chroot, it allows to isolate (sets of) processes running on a single control host • Same concept of BSD “jails”

LXC & CGroups • Cgroups (control groups) are an extension to the linux fair scheduler to allow resource management • A program is in a particular control group, it will be given a share of the resources of the machine • You get to specify how big or small that share can be • Containers can be associated to CGroups: in this way each container has a set of resources associated

LXC - Pros • Containers partition the OS resources into isolated groups • Better balance on resource usage between the isolated groups • Applications have the illusion of running on a separate machine • Lower overhead than true virtualization

LXC - Cons • Poor documentation • Some features are unstable • Several bug/regressions between 0.3, 0.6.5 and 0.7 • Immature for a production environment • Do Try This At Home (at your own risk)

Setup • Kernel space (>=2.6.29) – Linux Vanilla + recompile – Ready in most of the recent distros • User space (lxc user tools) – Source code + recompile – Packages from distro (deb, rpm, etc.) • Chroot jail (optional) • Container configuration (lxc.conf)

Container lifetime - guest

Container lifetime - guest Create

Container lifetime - guest Create Start

Container lifetime - guest Create Start Execute

Container lifetime - guest Create Start Execute Freeze

Container lifetime - guest Create Start Execute Freeze Unfreeze

Container lifetime - guest Create Start Execute Freeze Unfreeze Stop

Container lifetime - host • The host can manipulate through user space tools the state of each container: • Spawn a new container (lxc-create) • Init the container (lxc-init) and run it (lxc-start) • Execute a new process in a container (lxc-execute) • Pause/resume a container (lxc-freeze, lxc- unfreeze) • Stop a container (lxc-stop) • Monitor a container (lxc-monitor) • Wait for the container to reach a state (lxc-wait) • ...

LXC facts • Part of the mainstream kernel since >=2.6.29. Userspace tools and kernel ready in most of the latest distros (Ubuntu 10.04, Debian 5, Fedora 12, ...) • Container boot and shutdown time is negligible • No hw support needed

LXC on the road: sandbox • Create containers as sandbox • Sandbox containers can be set with its own isolated file system (chroot/read only fs), cpu, devices, network stack and process space • The container can execute untrusted code • The host can still control the container, monitor it and kill it anytime

LXC on the road:fair sharing • A container can isolate processes to share fairly resources (cpu, network, IO, memory, ...) • Partition user groups into LXC containers • Divide host resources into CGroups • Map CGroups into LXC containers

LXC deployments • No hw support - LXC can be easily deployed under different contexts • Trashware • Other virtualization solutions (Virtualbox, VMWare, Parallels, ...) • Cloud computing (OS images available for Amazon EC2)

LXC references • http://lxc.sourceforge.net • http://www.ibm.com/developerworks/ linux/library/l-lxc-containers/ • http://broadcast.oreilly.com/2009/06/ manage-your-performance-with-cgroups- and-projects.html

Thank you! Any questions? luca@coderloop.com linkedin.com/in/lucabonmassar www.coderloop.com

Webtech Conference: Introducing LXC: fast and secure virtualization

by Luca Bonmassar on Nov 23, 2010

Accessibility

Categories

Tags

Upload Details

Usage Rights

1 Embed 2

Statistics

Webtech Conference: Introducing LXC: fast and secure virtualization — Presentation Transcript