Successfully reported this slideshow.
We use your LinkedIn profile and activity data to personalize ads and to show you more relevant ads. You can change your ad preferences anytime.

Lying, Cheating, and Winning with Containers in Networking

1,319 views

Published on

Containers have swept the world of datacenter computing over the past half-decade. They've simply revolutionized the way we deploy software. Unfortunately, we brought the blight of VMs with us. Checmate speaks to a new set of mechanisms to make container networking join the 21st century.

Published in: Technology
  • Be the first to comment

Lying, Cheating, and Winning with Containers in Networking

  1. 1. © 2016 Mesosphere, Inc. All Rights Reserved. LYING, CHEATING, AND WINNING WITH CONTAINERS IN NETWORKING 1 Sargun Dhillon, 2016
  2. 2. © 2016 Mesosphere, Inc. All Rights Reserved. WHO AM I? 2
  3. 3. © 2016 Mesosphere, Inc. All Rights Reserved. WHO DO I WORK FOR? 3
  4. 4. © 2016 Mesosphere, Inc. All Rights Reserved. DC/OS 4
  5. 5. © 2016 Mesosphere, Inc. All Rights Reserved. NETWORKING A HISTORY 5
  6. 6. © 2016 Mesosphere, Inc. All Rights Reserved. IT, IN THE YEAR 2000 6 • Applications mostly client / server • Mostly desktops, controlled by central IT • Local storage, on-site • Low bandwidth, high latency
  7. 7. © 2016 Mesosphere, Inc. All Rights Reserved. 7 The Transformation
  8. 8. © 2016 Mesosphere, Inc. All Rights Reserved. OLD WORLD 8
  9. 9. © 2016 Mesosphere, Inc. All Rights Reserved. NEW WORLD 9
  10. 10. © 2016 Mesosphere, Inc. All Rights Reserved. BYOD: BRING YOUR OWN DEVICE 10 •Real gains by allowing employees to use their own device •Productivity •Morale •Cost •End node security problems
  11. 11. © 2016 Mesosphere, Inc. All Rights Reserved. OLD WORLD 11
  12. 12. © 2016 Mesosphere, Inc. All Rights Reserved. OLD WORLD 12
  13. 13. © 2016 Mesosphere, Inc. All Rights Reserved. OLD WORLD 13
  14. 14. © 2016 Mesosphere, Inc. All Rights Reserved. RISE OF SOFTWARE AS A SERVICE 14 •3rd Party provided apps: •Hosted applications •Hosted email •Hosted file storage •Elastic services for an elastic work force •Amortization of cost over time
  15. 15. © 2016 Mesosphere, Inc. All Rights Reserved. NEED 15 • More applications need to be hosted • Better utilization of computer hardware • Greater need for faster reactivity • Greater need for “reliability” • Greater need for elasticity • Greater need for scalability
  16. 16. © 2016 Mesosphere, Inc. All Rights Reserved. ENABLING TECHNOLOGIES 16 •Hardware-assisted virtualization •Guest oblivious •Paravirtualization •Guest assisted •Proprietary Storage Hardware •Proprietary Networking Hardware
  17. 17. © 2016 Mesosphere, Inc. All Rights Reserved. 17 The Private “Cloud”
  18. 18. © 2016 Mesosphere, Inc. All Rights Reserved. 18 Networking’s Answer?
  19. 19. © 2016 Mesosphere, Inc. All Rights Reserved. 19 “Software Defined Networking”
  20. 20. © 2016 Mesosphere, Inc. All Rights Reserved. 20 Openflow
  21. 21. © 2016 Mesosphere, Inc. All Rights Reserved. 21
  22. 22. © 2016 Mesosphere, Inc. All Rights Reserved. 22
  23. 23. © 2016 Mesosphere, Inc. All Rights Reserved. 23
  24. 24. © 2016 Mesosphere, Inc. All Rights Reserved. 24
  25. 25. © 2016 Mesosphere, Inc. All Rights Reserved. 25
  26. 26. © 2016 Mesosphere, Inc. All Rights Reserved. 26
  27. 27. © 2016 Mesosphere, Inc. All Rights Reserved. 27
  28. 28. © 2016 Mesosphere, Inc. All Rights Reserved. 28 Never Panned out
  29. 29. © 2016 Mesosphere, Inc. All Rights Reserved. 29 Virtualization Kept Becoming More Common
  30. 30. © 2016 Mesosphere, Inc. All Rights Reserved. 30 And then something happened…
  31. 31. © 2016 Mesosphere, Inc. All Rights Reserved. 31
  32. 32. © 2016 Mesosphere, Inc. All Rights Reserved. EXPLOSION OF THE SOFTWARE DEFINED NETWORKS 32 • Offerings • Cisco Nexus • Juniper Contrail • Plumgrid • Nuage • Calico • Also replicated state
  33. 33. © 2016 Mesosphere, Inc. All Rights Reserved. 33 And after a couple years…
  34. 34. © 2016 Mesosphere, Inc. All Rights Reserved. 34
  35. 35. © 2016 Mesosphere, Inc. All Rights Reserved. 35 (Or more generically, “containers”)
  36. 36. © 2016 Mesosphere, Inc. All Rights Reserved. NETWORKING SOLUTIONS COMPARED 36 Containers: •Calico •Plumgrid •Cisco Contiv •Contrail •Weave Openstack: •Calico •Plumgrid •Cisco Contiv •Contrail •Cisco Nexus 1000V
  37. 37. © 2016 Mesosphere, Inc. All Rights Reserved. NETWORKING SOLUTIONS COMPARED 37 Containers: •Calico •Plumgrid •Cisco Contiv •Contrail •Weave Openstack: •Calico •Plumgrid •Cisco Contiv •Contrail •Cisco Nexus 1000V
  38. 38. © 2016 Mesosphere, Inc. All Rights Reserved. 38 Containers are all about abstraction
  39. 39. © 2016 Mesosphere, Inc. All Rights Reserved. 39 Containers are UX
  40. 40. © 2016 Mesosphere, Inc. All Rights Reserved. WHERE THE RUBBER MEETS THE ROAD 40 • Namespaces for abstraction • Mount • PID • User • UTS • Network • CGroups for resource isolation • Memory • Blkio • CPU
  41. 41. © 2016 Mesosphere, Inc. All Rights Reserved. MOUNT NAMESPACE 41
  42. 42. © 2016 Mesosphere, Inc. All Rights Reserved. PID NAMESPACE 42
  43. 43. © 2016 Mesosphere, Inc. All Rights Reserved. UTS NAMESPACE 43
  44. 44. © 2016 Mesosphere, Inc. All Rights Reserved. NETWORK NAMESPACE 44
  45. 45. © 2016 Mesosphere, Inc. All Rights Reserved. NETWORK NAMESPACE 45
  46. 46. © 2016 Mesosphere, Inc. All Rights Reserved. NETWORK NAMESPACE 46
  47. 47. © 2016 Mesosphere, Inc. All Rights Reserved. NETWORK NAMESPACE 47
  48. 48. © 2016 Mesosphere, Inc. All Rights Reserved. NETWORK NAMESPACE 48
  49. 49. © 2016 Mesosphere, Inc. All Rights Reserved. 49 Somehow we brought the blight with us
  50. 50. © 2016 Mesosphere, Inc. All Rights Reserved. 50 Why do we need this abstraction?
  51. 51. © 2016 Mesosphere, Inc. All Rights Reserved. 51 Why do we need network namespaces at all?
  52. 52. © 2016 Mesosphere, Inc. All Rights Reserved. 52
  53. 53. © 2016 Mesosphere, Inc. All Rights Reserved. 53
  54. 54. © 2016 Mesosphere, Inc. All Rights Reserved. 54
  55. 55. © 2016 Mesosphere, Inc. All Rights Reserved. 55 Peering inside
  56. 56. © 2016 Mesosphere, Inc. All Rights Reserved. 56
  57. 57. © 2016 Mesosphere, Inc. All Rights Reserved. 57 Ok, so well, what’s some memory?
  58. 58. © 2016 Mesosphere, Inc. All Rights Reserved. 58 Performance
  59. 59. © 2016 Mesosphere, Inc. All Rights Reserved. REDIS PERFORMANCE 59
  60. 60. © 2016 Mesosphere, Inc. All Rights Reserved. 60 MySQL Performance with Containers 0 75000 150000 225000 300000 Container-free Host Mode Bridged Overlay Transactions / Sec
  61. 61. © 2016 Mesosphere, Inc. All Rights Reserved. ENTER: CHECMATE 61 IPTables for sys calls
  62. 62. © 2016 Mesosphere, Inc. All Rights Reserved. 62 First try: LD_PRELOAD
  63. 63. © 2016 Mesosphere, Inc. All Rights Reserved. 63 How does connect() work?
  64. 64. © 2016 Mesosphere, Inc. All Rights Reserved. 64
  65. 65. © 2016 Mesosphere, Inc. All Rights Reserved. 65
  66. 66. © 2016 Mesosphere, Inc. All Rights Reserved. 66 How does connect() work on LD_PRELOAD?
  67. 67. © 2016 Mesosphere, Inc. All Rights Reserved. 67
  68. 68. © 2016 Mesosphere, Inc. All Rights Reserved. 68
  69. 69. © 2016 Mesosphere, Inc. All Rights Reserved. 69
  70. 70. © 2016 Mesosphere, Inc. All Rights Reserved. 70
  71. 71. © 2016 Mesosphere, Inc. All Rights Reserved. 71 …But no
  72. 72. © 2016 Mesosphere, Inc. All Rights Reserved. 72 Static Linking
  73. 73. © 2016 Mesosphere, Inc. All Rights Reserved. 73 What else is there?
  74. 74. © 2016 Mesosphere, Inc. All Rights Reserved. 74 This seems familiar
  75. 75. © 2016 Mesosphere, Inc. All Rights Reserved. 75 Something new
  76. 76. © 2016 Mesosphere, Inc. All Rights Reserved. 76 Something new(-ish)
  77. 77. © 2016 Mesosphere, Inc. All Rights Reserved. 77
  78. 78. © 2016 Mesosphere, Inc. All Rights Reserved. 78
  79. 79. © 2016 Mesosphere, Inc. All Rights Reserved. EBPF: EXTENDED BERKELEY PACKET FILTER 79 • Stems from BPF (“port 80 and protocol tcp” look familiar) • JIT’d to X86-64 code • Or custom hardware (see Mellanox, Netronome) • Safe • No jumping backwards • No unsafe access • Programmed in C
  80. 80. © 2016 Mesosphere, Inc. All Rights Reserved. 80
  81. 81. © 2016 Mesosphere, Inc. All Rights Reserved. 81
  82. 82. © 2016 Mesosphere, Inc. All Rights Reserved. 82 Advanced Usecases
  83. 83. © 2016 Mesosphere, Inc. All Rights Reserved. 83 How do I prevent my containers from exhausting ephemeral ports?
  84. 84. © 2016 Mesosphere, Inc. All Rights Reserved. 84 IPTables?
  85. 85. © 2016 Mesosphere, Inc. All Rights Reserved. 85
  86. 86. © 2016 Mesosphere, Inc. All Rights Reserved. 86
  87. 87. © 2016 Mesosphere, Inc. All Rights Reserved. 87 Load Balancing
  88. 88. © 2016 Mesosphere, Inc. All Rights Reserved. 88
  89. 89. © 2016 Mesosphere, Inc. All Rights Reserved. 89 What about performance?
  90. 90. © 2016 Mesosphere, Inc. All Rights Reserved. 90 Redis Operations / Second Ops/Sec 0 1250 2500 3750 5000 Bridged Checmate More is better
  91. 91. © 2016 Mesosphere, Inc. All Rights Reserved. 91 Redis Latency Milliseconds 0 0.55 1.1 1.65 2.2 Bridged Checmate Less is better
  92. 92. © 2016 Mesosphere, Inc. All Rights Reserved. 92 What about debugging?
  93. 93. © 2016 Mesosphere, Inc. All Rights Reserved. STANDARD BSD API 93 • getpeername() work • Makes “ALGs” less relevant • Makes connection-less protocols more sane • recvfrom() • sendto()
  94. 94. © 2016 Mesosphere, Inc. All Rights Reserved. 94
  95. 95. © 2016 Mesosphere, Inc. All Rights Reserved. 95 How long until this ends up in your living room datacentre?
  96. 96. © 2016 Mesosphere, Inc. All Rights Reserved. 96 Kernel Patches in Development
  97. 97. © 2016 Mesosphere, Inc. All Rights Reserved. 97 Interest in Developing Higher Level Language
  98. 98. © 2016 Mesosphere, Inc. All Rights Reserved. 98 Functional Programming?
  99. 99. © 2016 Mesosphere, Inc. All Rights Reserved. 99
  100. 100. © 2016 Mesosphere, Inc. All Rights Reserved. 100 More Natural
  101. 101. © 2016 Mesosphere, Inc. All Rights Reserved. 101 Need help with usecases, and testers
  102. 102. © 2016 Mesosphere, Inc. All Rights Reserved. 102 Development of Control Plane
  103. 103. © 2016 Mesosphere, Inc. All Rights Reserved. 103 Kernel Upgrades
  104. 104. © 2016 Mesosphere, Inc. All Rights Reserved. 104 What did we learn?
  105. 105. © 2016 Mesosphere, Inc. All Rights Reserved. 105 We’re probably doing it wrong (today)
  106. 106. © 2016 Mesosphere, Inc. All Rights Reserved. 106 The future looks bright
  107. 107. © 2016 Mesosphere, Inc. All Rights Reserved. 107 With programmable filtering, what would you do?

×