7/31/13 Mirage: Extreme Specialisation of Cloud Appliances
file://localhost/Users/mort/research/projects/mirage/src/v2/mir...
7/31/13 Mirage: Extreme Specialisation of Cloud Appliances
file://localhost/Users/mort/research/projects/mirage/src/v2/mir...
7/31/13 Mirage: Extreme Specialisation of Cloud Appliances
file://localhost/Users/mort/research/projects/mirage/src/v2/mir...
7/31/13 Mirage: Extreme Specialisation of Cloud Appliances
file://localhost/Users/mort/research/projects/mirage/src/v2/mir...
7/31/13 Mirage: Extreme Specialisation of Cloud Appliances
file://localhost/Users/mort/research/projects/mirage/src/v2/mir...
7/31/13 Mirage: Extreme Specialisation of Cloud Appliances
file://localhost/Users/mort/research/projects/mirage/src/v2/mir...
7/31/13 Mirage: Extreme Specialisation of Cloud Appliances
file://localhost/Users/mort/research/projects/mirage/src/v2/mir...
7/31/13 Mirage: Extreme Specialisation of Cloud Appliances
file://localhost/Users/mort/research/projects/mirage/src/v2/mir...
7/31/13 Mirage: Extreme Specialisation of Cloud Appliances
file://localhost/Users/mort/research/projects/mirage/src/v2/mir...
7/31/13 Mirage: Extreme Specialisation of Cloud Appliances
file://localhost/Users/mort/research/projects/mirage/src/v2/mir...
7/31/13 Mirage: Extreme Specialisation of Cloud Appliances
file://localhost/Users/mort/research/projects/mirage/src/v2/mir...
7/31/13 Mirage: Extreme Specialisation of Cloud Appliances
file://localhost/Users/mort/research/projects/mirage/src/v2/mir...
7/31/13 Mirage: Extreme Specialisation of Cloud Appliances
file://localhost/Users/mort/research/projects/mirage/src/v2/mir...
7/31/13 Mirage: Extreme Specialisation of Cloud Appliances
file://localhost/Users/mort/research/projects/mirage/src/v2/mir...
7/31/13 Mirage: Extreme Specialisation of Cloud Appliances
file://localhost/Users/mort/research/projects/mirage/src/v2/mir...
7/31/13 Mirage: Extreme Specialisation of Cloud Appliances
file://localhost/Users/mort/research/projects/mirage/src/v2/mir...
7/31/13 Mirage: Extreme Specialisation of Cloud Appliances
file://localhost/Users/mort/research/projects/mirage/src/v2/mir...
7/31/13 Mirage: Extreme Specialisation of Cloud Appliances
file://localhost/Users/mort/research/projects/mirage/src/v2/mir...
7/31/13 Mirage: Extreme Specialisation of Cloud Appliances
file://localhost/Users/mort/research/projects/mirage/src/v2/mir...
7/31/13 Mirage: Extreme Specialisation of Cloud Appliances
file://localhost/Users/mort/research/projects/mirage/src/v2/mir...
7/31/13 Mirage: Extreme Specialisation of Cloud Appliances
file://localhost/Users/mort/research/projects/mirage/src/v2/mir...
7/31/13 Mirage: Extreme Specialisation of Cloud Appliances
file://localhost/Users/mort/research/projects/mirage/src/v2/mir...
7/31/13 Mirage: Extreme Specialisation of Cloud Appliances
file://localhost/Users/mort/research/projects/mirage/src/v2/mir...
7/31/13 Mirage: Extreme Specialisation of Cloud Appliances
file://localhost/Users/mort/research/projects/mirage/src/v2/mir...
7/31/13 Mirage: Extreme Specialisation of Cloud Appliances
file://localhost/Users/mort/research/projects/mirage/src/v2/mir...
7/31/13 Mirage: Extreme Specialisation of Cloud Appliances
file://localhost/Users/mort/research/projects/mirage/src/v2/mir...
7/31/13 Mirage: Extreme Specialisation of Cloud Appliances
file://localhost/Users/mort/research/projects/mirage/src/v2/mir...
7/31/13 Mirage: Extreme Specialisation of Cloud Appliances
file://localhost/Users/mort/research/projects/mirage/src/v2/mir...
7/31/13 Mirage: Extreme Specialisation of Cloud Appliances
file://localhost/Users/mort/research/projects/mirage/src/v2/mir...
7/31/13 Mirage: Extreme Specialisation of Cloud Appliances
file://localhost/Users/mort/research/projects/mirage/src/v2/mir...
7/31/13 Mirage: Extreme Specialisation of Cloud Appliances
file://localhost/Users/mort/research/projects/mirage/src/v2/mir...
7/31/13 Mirage: Extreme Specialisation of Cloud Appliances
file://localhost/Users/mort/research/projects/mirage/src/v2/mir...
7/31/13 Mirage: Extreme Specialisation of Cloud Appliances
file://localhost/Users/mort/research/projects/mirage/src/v2/mir...
7/31/13 Mirage: Extreme Specialisation of Cloud Appliances
file://localhost/Users/mort/research/projects/mirage/src/v2/mir...
7/31/13 Mirage: Extreme Specialisation of Cloud Appliances
file://localhost/Users/mort/research/projects/mirage/src/v2/mir...
7/31/13 Mirage: Extreme Specialisation of Cloud Appliances
file://localhost/Users/mort/research/projects/mirage/src/v2/mir...
Upcoming SlideShare
Loading in...5
×

Mirage: Extreme Specialization Of Cloud Appliances

13,424

Published on

Public compute clouds provide a flexible platform to host applications as a set of appliances, e.g., web servers or databases. Each appliance usually contains an OS kernel and userspace processes, within which applications access resources via APIs such as POSIX. The flexible architecture of the cloud comes at a cost: the addition of another layer in the already complex software stack. This reduces performance and increases the size of the trusted computing base.

Our new Mirage operating system proposes a radically different way of building these appliances. Mirage supports the progressive specialisation of functional language (OCaml) application source code, and gradually replaces traditional OS components with type-safe libraries. This ultimately results in “unikernels”: sealed, fixed-purpose images that run directly on the hypervisor without an intervening guest OS such as Lin ux.

Developers no longer need to become sysadmins, expert in the configuration of all manner of system components, to use cloud resources. At the same time, they can develop their code using their usual tools, only making the final push to the cloud once they are satisfied their code works. As they explicitly link in components that would normally be provided by the host OS, the resulting unikernels are also highly compact: facilities that are not used are simply not included in the resulting unikernel. For example, the self-hosting Mirage web server image is less than a megabyte in size!

We will describe the architecture of Mirage in the talk, show some code examples, and interesting benchmark results that compare the performance of our unikernels to traditional applications such as Apache, BIND and OpenSSH.

Published in: Technology
0 Comments
2 Likes
Statistics
Notes
  • Be the first to comment

No Downloads
Views
Total Views
13,424
On Slideshare
0
From Embeds
0
Number of Embeds
12
Actions
Shares
0
Downloads
35
Comments
0
Likes
2
Embeds 0
No embeds

No notes for slide

Mirage: Extreme Specialization Of Cloud Appliances

  1. 1. 7/31/13 Mirage: Extreme Specialisation of Cloud Appliances file://localhost/Users/mort/research/projects/mirage/src/v2/mirage-decks/files/slides/oscon13/complete.html#/ 1/36 Anil Madhavapeddy University of Cambridge Richard Mortier University of Nottingham Dave Scott Citrix Systems R&D MIRAGE: EXTREME SPECIALISATION OF CLOUD APPLIANCES @avsm @mort___ @mugofsoup http://openmirage.org http://decks.openmirage.org/oscon13/ http://www.youtube.com/watch?v=2Mx8Bd5JYyo
  2. 2. 7/31/13 Mirage: Extreme Specialisation of Cloud Appliances file://localhost/Users/mort/research/projects/mirage/src/v2/mirage-decks/files/slides/oscon13/complete.html#/ 2/36 THE CLOUD THREAT MODEL Internet SAN/NAS Tenants SDN
  3. 3. 7/31/13 Mirage: Extreme Specialisation of Cloud Appliances file://localhost/Users/mort/research/projects/mirage/src/v2/mirage-decks/files/slides/oscon13/complete.html#/ 3/36 THE CLOUD THREAT MODEL Type-safety in the application layer defeats several external threats. Type-safety in the kernel will make all external I/O safe, but at what cost?
  4. 4. 7/31/13 Mirage: Extreme Specialisation of Cloud Appliances file://localhost/Users/mort/research/projects/mirage/src/v2/mirage-decks/files/slides/oscon13/complete.html#/ 4/36 THE CLOUD THREAT MODEL Most attacks never come from within a guest, only from external traffic. So why all these privilege checks?
  5. 5. 7/31/13 Mirage: Extreme Specialisation of Cloud Appliances file://localhost/Users/mort/research/projects/mirage/src/v2/mirage-decks/files/slides/oscon13/complete.html#/ 5/36 KEY DESIGN INSIGHTS The hypervisor gifts us a stable hardware interface. Cures the curse of library operating systems! Protocol-level compatibility between special-purpose cloud appliances, e.g. a webserver, a database VM.
  6. 6. 7/31/13 Mirage: Extreme Specialisation of Cloud Appliances file://localhost/Users/mort/research/projects/mirage/src/v2/mirage-decks/files/slides/oscon13/complete.html#/ 6/36 UNIKERNELS! Virtual machines are UNIX processes “done right” on the cloud.
  7. 7. 7/31/13 Mirage: Extreme Specialisation of Cloud Appliances file://localhost/Users/mort/research/projects/mirage/src/v2/mirage-decks/files/slides/oscon13/complete.html#/ 7/36 CONTRIBUTIONS The unikernel approach to building single-purpose appliances Library OS + high level programming interface Single-address space layout Evaluation of these techniques using a functional programming language (OCaml) Benefits of type-safety need not damage performance Static typing + modules = high level manipulation Language extensions for systems programming in OCaml
  8. 8. 7/31/13 Mirage: Extreme Specialisation of Cloud Appliances file://localhost/Users/mort/research/projects/mirage/src/v2/mirage-decks/files/slides/oscon13/complete.html#/ 8/36 CURRENT VIRTUAL APPLIANCES Compiler has to stop at userspace. Every level has a different API, calling convention, and privilege requirements.
  9. 9. 7/31/13 Mirage: Extreme Specialisation of Cloud Appliances file://localhost/Users/mort/research/projects/mirage/src/v2/mirage-decks/files/slides/oscon13/complete.html#/ 9/36 SPECIALISED VIRTUAL APPLIANCES
  10. 10. 7/31/13 Mirage: Extreme Specialisation of Cloud Appliances file://localhost/Users/mort/research/projects/mirage/src/v2/mirage-decks/files/slides/oscon13/complete.html#/ 10/36 SPECIALISED VIRTUAL APPLIANCES
  11. 11. 7/31/13 Mirage: Extreme Specialisation of Cloud Appliances file://localhost/Users/mort/research/projects/mirage/src/v2/mirage-decks/files/slides/oscon13/complete.html#/ 11/36 SPECIALISED VIRTUAL APPLIANCES
  12. 12. 7/31/13 Mirage: Extreme Specialisation of Cloud Appliances file://localhost/Users/mort/research/projects/mirage/src/v2/mirage-decks/files/slides/oscon13/complete.html#/ 12/36 PROGRESSIVE SPECIALISATION
  13. 13. 7/31/13 Mirage: Extreme Specialisation of Cloud Appliances file://localhost/Users/mort/research/projects/mirage/src/v2/mirage-decks/files/slides/oscon13/complete.html#/ 13/36 MICROBENCHMARKS! Unikernel appliances are: Smaller, both in kLoC & image size Boot faster, at packet round-trip time timescales High performance Type-safe
  14. 14. 7/31/13 Mirage: Extreme Specialisation of Cloud Appliances file://localhost/Users/mort/research/projects/mirage/src/v2/mirage-decks/files/slides/oscon13/complete.html#/ 14/36 APPLIANCE IMAGE SIZE Appliance Standard Build Dead Code Elimination DNS 0.449 MB 0.184 MB Web Server 0.674 MB 0.172 MB Openflow learning switch 0.393 MB 0.164 MB Openflow controller 0.392 MB 0.168 MB All configuration and data compiled into the image by the toolchain. Live migration is easy and fun :-)
  15. 15. 7/31/13 Mirage: Extreme Specialisation of Cloud Appliances file://localhost/Users/mort/research/projects/mirage/src/v2/mirage-decks/files/slides/oscon13/complete.html#/ 15/36 BOOT TIME Unikernels are compact enough to boot and respond to network traffic in real-time.
  16. 16. 7/31/13 Mirage: Extreme Specialisation of Cloud Appliances file://localhost/Users/mort/research/projects/mirage/src/v2/mirage-decks/files/slides/oscon13/complete.html#/ 16/36 HOW LARGE IS LARGE?
  17. 17. 7/31/13 Mirage: Extreme Specialisation of Cloud Appliances file://localhost/Users/mort/research/projects/mirage/src/v2/mirage-decks/files/slides/oscon13/complete.html#/ 17/36 EVENT DRIVEN CO-THREADS Garbage collected heap management is more efficient in a single address-space environment. Thread latency can be reduced by eliminating multiple levels of scheduling.
  18. 18. 7/31/13 Mirage: Extreme Specialisation of Cloud Appliances file://localhost/Users/mort/research/projects/mirage/src/v2/mirage-decks/files/slides/oscon13/complete.html#/ 18/36 THREAD SCALING SINGLE INSTANCE Threads are heap allocated values, so benefit from the faster garbage collection cycle in the Mirage Xen version, and the scheduler can be overridden by application-specific needs.
  19. 19. 7/31/13 Mirage: Extreme Specialisation of Cloud Appliances file://localhost/Users/mort/research/projects/mirage/src/v2/mirage-decks/files/slides/oscon13/complete.html#/ 19/36 BLOCK STORAGE Additionally, reading from a Mirage NAS-like storage VM achieves 942MiB/s buffered, and 1.8GiB/s unbuffered.
  20. 20. 7/31/13 Mirage: Extreme Specialisation of Cloud Appliances file://localhost/Users/mort/research/projects/mirage/src/v2/mirage-decks/files/slides/oscon13/complete.html#/ 20/36 TECHNIQUES Several implementation techniques give rise to these benefits: Simplified memory management Zero-copy IO buffer management Hypervisor security extension for VM sealing (W^X)
  21. 21. 7/31/13 Mirage: Extreme Specialisation of Cloud Appliances file://localhost/Users/mort/research/projects/mirage/src/v2/mirage-decks/files/slides/oscon13/complete.html#/ 21/36 MEMORY MANAGEMENT SPECIALISED! Compiled native source code and runtime statically linked with random start offset. IO memory is mapped into a reserved area and can be distinguished. OCaml heap is contiguous, with simpler write barriers as a result.
  22. 22. 7/31/13 Mirage: Extreme Specialisation of Cloud Appliances file://localhost/Users/mort/research/projects/mirage/src/v2/mirage-decks/files/slides/oscon13/complete.html#/ 22/36 BUFFER MANAGEMENT ZERO-COPY IO
  23. 23. 7/31/13 Mirage: Extreme Specialisation of Cloud Appliances file://localhost/Users/mort/research/projects/mirage/src/v2/mirage-decks/files/slides/oscon13/complete.html#/ 23/36 OPTIONAL VM SEALING Single address-space and no dynamic loading W^X address space Address offsets are randomized at compile-time Dropping page table privileges: Added freeze hypercall called just before app starts Subsequent page table updates are rejected by Xen Exception for I/O mappings if they are non-exec and do not modify any existing mappings Very easy in unikernels due to focus on compile-time specialisation instead of run-time complexity
  24. 24. 7/31/13 Mirage: Extreme Specialisation of Cloud Appliances file://localhost/Users/mort/research/projects/mirage/src/v2/mirage-decks/files/slides/oscon13/complete.html#/ 24/36 MACROBENCHMARKS We have implemented several larger appliances. We discuss deens, our DNS server in detail here. We also have: a simple webserver, an OpenFlow Switch, and an OpenFlow Controller.
  25. 25. 7/31/13 Mirage: Extreme Specialisation of Cloud Appliances file://localhost/Users/mort/research/projects/mirage/src/v2/mirage-decks/files/slides/oscon13/complete.html#/ 25/36 DNS SERVER CODE let main () = lwt zones = read key "zones" "zone.db" in Net.Manager.bind (fun mgr dev -> let src = `any_addr, 53 in Dns.Server.listen dev src zones ) Cooperative threads as functions Statically evaluated configuration Functional callbacks Libraries directly link to network stack
  26. 26. 7/31/13 Mirage: Extreme Specialisation of Cloud Appliances file://localhost/Users/mort/research/projects/mirage/src/v2/mirage-decks/files/slides/oscon13/complete.html#/ 26/36 DNS SERVER PERFORMANCE BASELINE Baseline figures, running Bind (standard) and NSD (high performance). NSD achieves around 70 kreqs/s.
  27. 27. 7/31/13 Mirage: Extreme Specialisation of Cloud Appliances file://localhost/Users/mort/research/projects/mirage/src/v2/mirage-decks/files/slides/oscon13/complete.html#/ 27/36 DNS SERVER PERFORMANCE MIRAGE Comparing against Mirage appliance, with and without simple memoisation. This algorithmic optimisation added just 6 lines of code.
  28. 28. 7/31/13 Mirage: Extreme Specialisation of Cloud Appliances file://localhost/Users/mort/research/projects/mirage/src/v2/mirage-decks/files/slides/oscon13/complete.html#/ 28/36 DNS SERVER PERFORMANCE C/MINIOS A rudimentary C-based appliance linking NSD directly against MiniOS. Poor user-space library performance vastly outweighs language effects.
  29. 29. 7/31/13 Mirage: Extreme Specialisation of Cloud Appliances file://localhost/Users/mort/research/projects/mirage/src/v2/mirage-decks/files/slides/oscon13/complete.html#/ 29/36 SCALING VIA PARALLEL INSTANCES Request throughput for serving a simple static page using Apache on Linux vs. a Mirage appliance. Rather than pay the cost of interlocking for thread-level parallelism, we scale by running many instances of the Mirage appliance.
  30. 30. 7/31/13 Mirage: Extreme Specialisation of Cloud Appliances file://localhost/Users/mort/research/projects/mirage/src/v2/mirage-decks/files/slides/oscon13/complete.html#/ 30/36 OPENFLOW CONTROLLER OpenFlow controller is competitive with NOX (C++), but much higher level. Applications can link directly against the switch to route their data.
  31. 31. 7/31/13 Mirage: Extreme Specialisation of Cloud Appliances file://localhost/Users/mort/research/projects/mirage/src/v2/mirage-decks/files/slides/oscon13/complete.html#/ 31/36 SUMMARY OCaml is the baseline language for all new code Our C runtime is small, and getting smaller Is fully event-driven and non-preemptive Rewriting protocols wasn’t that hard Not necessarily the best research strategy though But an extremely useful learning experience Tech transfer is vital Unikernels fit perfectly on the cloud Internet protocol building blocks Seamless interop with legacy code through VMs
  32. 32. 7/31/13 Mirage: Extreme Specialisation of Cloud Appliances file://localhost/Users/mort/research/projects/mirage/src/v2/mirage-decks/files/slides/oscon13/complete.html#/ 32/36 PURE OCAML CODE Device drivers netfront, blkfront xenstore Networking/Communication IP/TCP/UDP/DHCP/DNS(SEC) (v4) HTTP, SSH, OpenFlow (controller/switch) vchan IPC Storage NFS, FAT32 distributed k/v store 9P :-) GITHUB.COM/MIRAGE http://arakoon.org
  33. 33. 7/31/13 Mirage: Extreme Specialisation of Cloud Appliances file://localhost/Users/mort/research/projects/mirage/src/v2/mirage-decks/files/slides/oscon13/complete.html#/ 33/36 MIRAGE ONLINE Website, Code, O'Reilly OCaml book, OPAM package manager Allows constraints to be applied to package installation Very useful for managing assembly of the many small OCaml modules that construct a Mirage appliance http://www.openmirage.org http://github.com/mirage http://realworldocaml.org http://opam.ocamlpro.com
  34. 34. 7/31/13 Mirage: Extreme Specialisation of Cloud Appliances file://localhost/Users/mort/research/projects/mirage/src/v2/mirage-decks/files/slides/oscon13/complete.html#/ 34/36 KEY RESEARCH DIRECTIONS Interoperability — with billions of VMs out there A unikernel per-language? Interconnect strategies? Heap sharing? Formal method integration easier or harder? Coordination — planetary scale computers Resources are highly elastic now. How to coordinate a million microkernels? “Warehouse Scale Computing” Library Applications — where are they? Irminsule, a git-like functional distributed database Beanstalk, a self-scaling web server
  35. 35. 7/31/13 Mirage: Extreme Specialisation of Cloud Appliances file://localhost/Users/mort/research/projects/mirage/src/v2/mirage-decks/files/slides/oscon13/complete.html#/ 35/36 WE'RE HIRING! MUST ENJOY OPEN SOURCE! OCamlLabs, Cambridge, UK Real world functional programming with OCaml Need compiler hackers, protocol heads, PL/type theory systems Networks-as-a-Service, University of Nottingham, UK (2 posts, 3 years, deadline Friday August 2nd) Joint with University of Cambridge & Imperial College Network virtualisation for millions of microkernel apps Need Mirage hackers, network protocol experts, graph theorists http://www.cl.cam.ac.uk/projects/ocamllabs http://bit.ly/13sBjjC
  36. 36. 7/31/13 Mirage: Extreme Specialisation of Cloud Appliances file://localhost/Users/mort/research/projects/mirage/src/v2/mirage-decks/files/slides/oscon13/complete.html#/ 36/36 Thanks! Questions? (...and please rate the talk!) HTTP://TWITTER.COM/MORT___
  1. A particular slide catching your eye?

    Clipping is a handy way to collect important slides you want to go back to later.

×