A lot of people use Docker/rkt, but very often we do not have time to actually understand how they work. So today in half-hour I will show you in a nutshell how that works. My hope is that even after you know how to build a container engine, I can still convince you that the existing tools are worth spending $MM to create and use.
Unlocking the Future of AI Agents with Large Language Models
Understanding and building Your Own Docker
1. 1/22
Building blocks of Linux Containers
Motiejus Jakˇstys
motiejus@uber.com
@mo kelione
2016-11-18
c 2016. Uber Technologies Inc. All rights reserved.
2. 2/22
Table of Contents
Introduction
Why me
A container in Linux is...
Namespaces
Isolation in Linux
What did we just do
File systems and COW
What did we forget?
Leftover elephants in the room
The End
c 2016. Uber Technologies Inc. All rights reserved.
7. 3/22
Conclusion!
Devil Hides in The Details?
Many use Docker.
We lack time to understand.
c 2016. Uber Technologies Inc. All rights reserved.
8. 3/22
Conclusion!
Devil Hides in The Details?
Many use Docker.
We lack time to understand.
You need to understand infra to successfully
troubleshoot infra.
c 2016. Uber Technologies Inc. All rights reserved.
9. 3/22
Conclusion!
Devil Hides in The Details?
Many use Docker.
We lack time to understand.
You need to understand infra to successfully
troubleshoot infra.
There are trade-offs in the configuration.
c 2016. Uber Technologies Inc. All rights reserved.
10. 3/22
Conclusion!
Devil Hides in The Details?
Many use Docker.
We lack time to understand.
You need to understand infra to successfully
troubleshoot infra.
There are trade-offs in the configuration.
Make container engine in 30 minutes.
c 2016. Uber Technologies Inc. All rights reserved.
11. 3/22
Conclusion!
Devil Hides in The Details?
Many use Docker.
We lack time to understand.
You need to understand infra to successfully
troubleshoot infra.
There are trade-offs in the configuration.
Make container engine in 30 minutes.
Details!
c 2016. Uber Technologies Inc. All rights reserved.
12. 3/22
Conclusion!
Devil Hides in The Details?
Many use Docker.
We lack time to understand.
You need to understand infra to successfully
troubleshoot infra.
There are trade-offs in the configuration.
Make container engine in 30 minutes.
Details! → You will still pick existing tools.
c 2016. Uber Technologies Inc. All rights reserved.
13. 4/22
Why me
My resume: oncall experience.
2009 − 2012 Telecom (Dev + Ops).
2012 − 2014 Online Gaming (Dev + Ops).
2014 − 2016 Amazon (Dev + Ops).
2016 − now Uber (Dev + Ops):
From 2016.02: Dev.
From 2016.11: SRE.
c 2016. Uber Technologies Inc. All rights reserved.
14. 4/22
Why me
My resume: oncall experience.
2009 − 2012 Telecom (Dev + Ops).
2012 − 2014 Online Gaming (Dev + Ops).
2014 − 2016 Amazon (Dev + Ops).
2016 − now Uber (Dev + Ops):
From 2016.02: Dev.
From 2016.11: SRE.
I had to understand how exactly infrastructure
works.
c 2016. Uber Technologies Inc. All rights reserved.
15. 5/22
A container in Linux is ...
c 2016. Uber Technologies Inc. All rights reserved.
16. 5/22
A container in Linux is ...
Fork/exec with bells & whistles:
c 2016. Uber Technologies Inc. All rights reserved.
17. 5/22
A container in Linux is ...
Fork/exec with bells & whistles:
Fancy tarball for distribution.
c 2016. Uber Technologies Inc. All rights reserved.
18. 5/22
A container in Linux is ...
Fork/exec with bells & whistles:
Fancy tarball for distribution.
COW filesystem to make it start fast.
c 2016. Uber Technologies Inc. All rights reserved.
19. 5/22
A container in Linux is ...
Fork/exec with bells & whistles:
Fancy tarball for distribution.
COW filesystem to make it start fast.
Cgroups for fairness.
c 2016. Uber Technologies Inc. All rights reserved.
20. 5/22
A container in Linux is ...
Fork/exec with bells & whistles:
Fancy tarball for distribution.
COW filesystem to make it start fast.
Cgroups for fairness.
Namespaces for isolation.
c 2016. Uber Technologies Inc. All rights reserved.
21. 6/22
Table of Contents
Introduction
Why me
A container in Linux is...
Namespaces
Isolation in Linux
What did we just do
File systems and COW
What did we forget?
Leftover elephants in the room
The End
c 2016. Uber Technologies Inc. All rights reserved.
24. 7/22
We will cover
User namespaces.
Pid namespaces.
c 2016. Uber Technologies Inc. All rights reserved.
25. 7/22
We will cover
User namespaces.
Pid namespaces.
Mount namespaces.
c 2016. Uber Technologies Inc. All rights reserved.
26. 7/22
We will cover
User namespaces.
Pid namespaces.
Mount namespaces.
Network namespaces.
c 2016. Uber Technologies Inc. All rights reserved.
27. 7/22
We will cover
User namespaces.
Pid namespaces.
Mount namespaces.
Network namespaces.
There are more, but not today.
c 2016. Uber Technologies Inc. All rights reserved.
35. 11/22
Network namespace
Demonstrate this:
Create namespace.
Activate loopback (lo).
Create pair of devices veth1a and veth1b:
veth1b will go to the namespace.
c 2016. Uber Technologies Inc. All rights reserved.
36. 11/22
Network namespace
Demonstrate this:
Create namespace.
Activate loopback (lo).
Create pair of devices veth1a and veth1b:
veth1b will go to the namespace.
veth1a will stay in default.
c 2016. Uber Technologies Inc. All rights reserved.
37. 11/22
Network namespace
Demonstrate this:
Create namespace.
Activate loopback (lo).
Create pair of devices veth1a and veth1b:
veth1b will go to the namespace.
veth1a will stay in default.
Add ip addresses.
c 2016. Uber Technologies Inc. All rights reserved.
38. 11/22
Network namespace
Demonstrate this:
Create namespace.
Activate loopback (lo).
Create pair of devices veth1a and veth1b:
veth1b will go to the namespace.
veth1a will stay in default.
Add ip addresses.
curl and ping.
c 2016. Uber Technologies Inc. All rights reserved.
39. 11/22
Network namespace
Demonstrate this:
Create namespace.
Activate loopback (lo).
Create pair of devices veth1a and veth1b:
veth1b will go to the namespace.
veth1a will stay in default.
Add ip addresses.
curl and ping.
lsof, bind on ports separately.
c 2016. Uber Technologies Inc. All rights reserved.
40. 11/22
Network namespace
Demonstrate this:
Create namespace.
Activate loopback (lo).
Create pair of devices veth1a and veth1b:
veth1b will go to the namespace.
veth1a will stay in default.
Add ip addresses.
curl and ping.
lsof, bind on ports separately.
Ever wanted to run tcpdump on an application?
c 2016. Uber Technologies Inc. All rights reserved.
46. 13/22
What did we just do
Created a container:
c 2016. Uber Technologies Inc. All rights reserved.
47. 13/22
What did we just do
Created a container:
User namespace apt-get, iptables, mount, etc.
c 2016. Uber Technologies Inc. All rights reserved.
48. 13/22
What did we just do
Created a container:
User namespace apt-get, iptables, mount, etc.
Isolated pids no nobody, isolate from each other.
c 2016. Uber Technologies Inc. All rights reserved.
49. 13/22
What did we just do
Created a container:
User namespace apt-get, iptables, mount, etc.
Isolated pids no nobody, isolate from each other.
Isolated mounts e.g. for /tmp.
c 2016. Uber Technologies Inc. All rights reserved.
50. 13/22
What did we just do
Created a container:
User namespace apt-get, iptables, mount, etc.
Isolated pids no nobody, isolate from each other.
Isolated mounts e.g. for /tmp.
Isolated network safely bind to :80.
c 2016. Uber Technologies Inc. All rights reserved.
51. 13/22
What did we just do
Created a container:
User namespace apt-get, iptables, mount, etc.
Isolated pids no nobody, isolate from each other.
Isolated mounts e.g. for /tmp.
Isolated network safely bind to :80.
An improvement over ”run and hope it doesn’t
affect anything else”.
c 2016. Uber Technologies Inc. All rights reserved.
52. 14/22
Table of Contents
Introduction
Why me
A container in Linux is...
Namespaces
Isolation in Linux
What did we just do
File systems and COW
What did we forget?
Leftover elephants in the room
The End
c 2016. Uber Technologies Inc. All rights reserved.
53. 15/22
File systems and COW
A container:
Needs a file system.
c 2016. Uber Technologies Inc. All rights reserved.
54. 15/22
File systems and COW
A container:
Needs a file system.
Starts quickly regardless of size.
c 2016. Uber Technologies Inc. All rights reserved.
55. 15/22
File systems and COW
A container:
Needs a file system.
Starts quickly regardless of size.
Do not want to copy 1GB with every startup.
c 2016. Uber Technologies Inc. All rights reserved.
56. 15/22
File systems and COW
A container:
Needs a file system.
Starts quickly regardless of size.
Do not want to copy 1GB with every startup.
Copy On Write!
c 2016. Uber Technologies Inc. All rights reserved.
57. 15/22
File systems and COW
A container:
Needs a file system.
Starts quickly regardless of size.
Do not want to copy 1GB with every startup.
Copy On Write!
lvm? zfs? btrfs?
c 2016. Uber Technologies Inc. All rights reserved.
58. 16/22
A quick demo
Create tank/images/debian@latest
Create tank/containers/t1 from @latest
unshare --mount --pid --fork chroot . bash
c 2016. Uber Technologies Inc. All rights reserved.
59. 17/22
Table of Contents
Introduction
Why me
A container in Linux is...
Namespaces
Isolation in Linux
What did we just do
File systems and COW
What did we forget?
Leftover elephants in the room
The End
c 2016. Uber Technologies Inc. All rights reserved.
61. 18/22
Leftover elephants in the room
Trivial to escape this ”container”.
c 2016. Uber Technologies Inc. All rights reserved.
62. 18/22
Leftover elephants in the room
Trivial to escape this ”container”.
Sec: no leftover file descriptors.
c 2016. Uber Technologies Inc. All rights reserved.
63. 18/22
Leftover elephants in the room
Trivial to escape this ”container”.
Sec: no leftover file descriptors.
Resource fairness.
c 2016. Uber Technologies Inc. All rights reserved.
64. 18/22
Leftover elephants in the room
Trivial to escape this ”container”.
Sec: no leftover file descriptors.
Resource fairness.
Sec/DoS: shared kernel resources.
c 2016. Uber Technologies Inc. All rights reserved.
65. 18/22
Leftover elephants in the room
Trivial to escape this ”container”.
Sec: no leftover file descriptors.
Resource fairness.
Sec/DoS: shared kernel resources.
Supervision, daemonization and cleanup.
c 2016. Uber Technologies Inc. All rights reserved.
66. 18/22
Leftover elephants in the room
Trivial to escape this ”container”.
Sec: no leftover file descriptors.
Resource fairness.
Sec/DoS: shared kernel resources.
Supervision, daemonization and cleanup.
Logging.
c 2016. Uber Technologies Inc. All rights reserved.
67. 18/22
Leftover elephants in the room
Trivial to escape this ”container”.
Sec: no leftover file descriptors.
Resource fairness.
Sec/DoS: shared kernel resources.
Supervision, daemonization and cleanup.
Logging.
Collect zombie processes.
c 2016. Uber Technologies Inc. All rights reserved.
68. 18/22
Leftover elephants in the room
Trivial to escape this ”container”.
Sec: no leftover file descriptors.
Resource fairness.
Sec/DoS: shared kernel resources.
Supervision, daemonization and cleanup.
Logging.
Collect zombie processes.
Image management.
c 2016. Uber Technologies Inc. All rights reserved.
69. 18/22
Leftover elephants in the room
Trivial to escape this ”container”.
Sec: no leftover file descriptors.
Resource fairness.
Sec/DoS: shared kernel resources.
Supervision, daemonization and cleanup.
Logging.
Collect zombie processes.
Image management.
Should someone else do it?
c 2016. Uber Technologies Inc. All rights reserved.
70. 19/22
We almost have a container engine
c 2016. Uber Technologies Inc. All rights reserved.
71. 19/22
We almost have a container engine
But look at my conclusions again.
c 2016. Uber Technologies Inc. All rights reserved.
72. 19/22
We almost have a container engine
But look at my conclusions again.
Devil hides in the details.
c 2016. Uber Technologies Inc. All rights reserved.
73. 19/22
We almost have a container engine
But look at my conclusions again.
Devil hides in the details.
Tooling companies (Docker, CoreOS, etc)
raised > $108
.
c 2016. Uber Technologies Inc. All rights reserved.
74. 20/22
To recap
Easy to understand kernel facilities.
c 2016. Uber Technologies Inc. All rights reserved.
75. 20/22
To recap
Easy to understand kernel facilities.
Devil hides in the details.
c 2016. Uber Technologies Inc. All rights reserved.
76. 20/22
To recap
Easy to understand kernel facilities.
Devil hides in the details.
Either spend a lot of time and headache, or
re-use existing tools.
c 2016. Uber Technologies Inc. All rights reserved.
77. 21/22
Table of Contents
Introduction
Why me
A container in Linux is...
Namespaces
Isolation in Linux
What did we just do
File systems and COW
What did we forget?
Leftover elephants in the room
The End
c 2016. Uber Technologies Inc. All rights reserved.
78. 22/22
We’re hiring!
Uber SRE locations: SF, NYC, Seattle, Vilnius.
Check out join.uber.com
Also, contact me at motiejus@uber.com
c 2016. Uber Technologies Inc. All rights reserved.