As presented at http://www.meetup.com/Docker-Switzerland/events/224119487/ In the future, all our applications will be automatically configured and our deploys will be automated, repeatable, and testable. Application containers offer the best promise for making this a reality, but realizing that opportunity requires container-native application architecture, workflows, and infrastructure. Here I outline what true container-native infrastructure looks like.

1. SecurityManagement Networking IntrospectionPerformance Utilization
7 characteristics of container-
native infrastructure

2. SecurityManagement Networking IntrospectionPerformance Utilization
container-native all the things

4. SecurityManagement Networking IntrospectionPerformance Utilization
Public Cloud
Triton Elastic Container Service. We run our
customer’s mission critical applications on
container native infrastructure
Private Cloud
Triton Elastic Container Infrastructure is an
on-premise, container run-time environment used
by some of the world’s most recognizable brands

5. SecurityManagement Networking IntrospectionPerformance Utilization
Public Cloud
Triton Elastic Container Service. We run our
customer’s mission critical applications on
container native infrastructure
Private DataCenter
Triton Elastic Container Infrastructure is an
on-premise, container run-time environment used
by some of the world’s most recognizable brands
it’s open source!
fork me, pull me: https://github.com/joyent/sdc

6. The best place to run Docker
Portability
From laptop to any
public or private cloud
Great for DevOps
Tools for management,
deployment & scale
Productivity
Faster code, test
and deploy

7. background
some

8. Infrastructure containers
• We use them like VMs
• They perform like bare metal
• We can pack 3x more containers than VMs on a
single compute node
• They require no changes in application architecture
• First appeared in FreeBSD as jails in 1999-ish;
defined for Solaris in 2002; Linux implementation in
progress (user namespaces mainlined in 2013)
• Joyent has been using them to power our public
cloud for almost a decade

10. SmartOS container hypervisor
• Forked from Open Solaris in 2010
• Part of the Illumos community
• Open source
• Includes the core compute, network, and storage
virtualization components:
• Zones = truly secure containers
• Crossbow = in-kernel network virtualization,
offers unique NIC(s) for each container
• ZFS = fast and secure virtualized filesystems

11. Triton (was SmartDataCenter)
• Open source, Mozilla licensed
• Complete data center automation; including…
• Automated boot and configuration of compute nodes
• Multi-tenant management layer for compute, network,
and storage across N compute nodes
• Turns an entire data center into a single, massive
container host
• Customer-facing services, including Docker and CloudAPI
to support self-service provisioning and management
• Bring your own application scheduling and orchestration

12. Like bare metal virtual machines
Infrastructure containers

13. Secure container hypervisor
SmartOS

14. Container infrastructure automation
Triton

15. but…

17. application containers
and

18. different
are

19. Container spectrum
application containers
infrastructure containers

20. Container spectrum
infrastructure containers
slimmed-down
infrastructure containers
application containers

21. Container spectrum
application containers
infrastructure containers
multi-process
Docker containers

22. application containers
implementation
are an opinionated

23. Docker container advantages
• Convenient imaging toolchain
• Easy sharing and re-use of images
• Dockerfiles are machine+human readable documentation
for everything needed to build and run the application
• Docker Compose yamls are machine+human readable
documentation for how to assemble a set of containers
into a larger application
• Docker begs us to automate discovery and configuration
• Docker allow us to imagine deployment and execution
as a single step

24. commoditizes
Docker
the possibility of
• immutable infrastructure
• automated, testable, repeatable deploys
• the kind of apps we all dream of

29. it didn’t
or
photos
happen

30. it didn’t
or
photos
happen

31. it doesn’t
or
repo
work

32. it doesn’t
or
work
public repo

33. with
public repo
1. Dockerfile
2. docker-compose.yml
3. documentation, etc…

34. but…

38. containers in VMs
deploying
slows performance

39. containers in VMs
deploying
adds complexity

40. containers in VMs
deploying
slows scaling

41. containers in VMs
deploying
wastes power

42. containers in VMs
deploying
causes global warming

43. containers in VMs
deploying
defeats the purpose

44. source

45. source

46. source

47. source

48. VMs cause complexity by…
• Requiring pre provisioning and configuration before they can
host containers
• Mixing VM and container life cycles
• Reducing surface area for deployments, making pockets of
unused capacity inevitable
• Reducing performance due to hardware virtualization
• Adding layers to networking
• Allowing room for us to turn them into pets
• Requiring re-packing of containers when scaling down

49. but…

50. on bare metal Linux
containers
struggle with
up-front costs

51. on bare metal Linux
containers
struggle with
elasticity

52. on bare metal Linux
containers
struggle with
data center automation

53. on bare metal Linux
containers
struggle with
multi-tenant security

54. –Docker's Jérôme Petazzoni

55. Bare metal Linux complexities
• No data center automation
• No security domain
• No performance isolation
• No elasticity…where do you scale to?

56. but…

57. there is
another way

58. most
infrastructure

59. two
scenario
pick

60. two:
• elasticity
• security
• performance
pick
bare
metal
{

61. two:
• elasticity
• security
• performance
pick
hardware
virtual
machine{

62. container-native
infrastructure

63. three
scenario
pick

64. three:
• elasticity
• security
• performance
pick
bare
metal
containers
{

65. how do you
secure it for
So…
bare metal?

66. Container anatomy
Application
package
Runtime
environment

67. Container anatomy
Application
package
Execution
driver
}
Docker

68. Container anatomy
Application
package
LXC
}
Docker

69. Container anatomy
Application
package
libcontainer
}
Docker

70. Container anatomy
Application
package
rkt
}
CoreOS

71. Container anatomy
Application
package
runC
}
OpenContainerFoundation

72. Container anatomy
Application
package
SmartOS
Zone
}
DockeronTriton

73. can i run my
Linux images
So…
on Triton?

74. yes!

76. so…

77. promised you
a list
i

78. the unit of compute
is a container
1:

79. you provision
containers
2:

80. the containers run
on bare metal
3:

81. the kernel offers
real security
4:

82. no escape
no incursion
that means

83. the containers are protected
from noisy neighbors
5:

84. 48 cores of bare metal
if a single container can
dominate them all?
what’s the point of

85. every container gets
a VNIC
6:

86. every container gets
a VNIC
6:
(or two)

87. every container gets
a VNIC
6:
(or more)

88. well-connected container
is a happy container
because a

89. You pay for
containers
7:

90. You pay for
containers
7:
(not VMs)

91. science fiction
this is not

92. available
now
this is

93. The best place to run containers.
Making Ops simple and scalable.
SecurityManagement Networking IntrospectionPerformance Utilization

94. Demo
time

95. Container-native everything
Application architecture
• Design for automated discovery and configuration
Workflow
• Embrace containerization in every step, from dev to deploy
Infrastructure
• Automates the infrastructure from the silicon to the container
• Enforces a single lifecycle: the container
• Eliminates pet VMs and servers
• Makes provisioning and execution a single step
• Delivers the promise of containers: automatable, testable,
repeatable deploys

96. SecurityManagement Networking IntrospectionPerformance Utilization
thank you

97. The 7 characteristics of
container-native infrastructure
1. The unit of compute is a container, not a VM
2. You provision containers, not VMs
3. The containers run on bare metal
4. The containers are multi-tenant bare metal secure
5. Every container gets its share
6. Every container gets one or more VNICs
7. You pay for containers, not VMs