Config Management Camp, Gent, Feb. 2016 Speaker: Johannes M. Scheuermann, Arnold Bechtoldt Since the hype around containers is still going on, many people are planning to move their applications into containers. You can earn lots of benefits when making this decision. But similar to other hypes you will notice that you will face many challenges that need to be handled. In this session we want to share some of our lessons learned in both of these worlds. We want to discuss when to choose cfg mgmt and when to choose containerized solutions. Also we will show some use cases were you can use a combination of both strategies. About Arnold Bechtoldt and Johannes Scheuermann: Arnold and Johannes are working for inovex in Germany. Arnold has a strong background in configuration management and Johannes is working with container technologies for years. Both like to try and discuss different (and new) approaches to solve today's infrastructure challenges. Due to this strong interaction they decided to make a talk about the up- and downsides of both worlds. Twitter: @johscheuer https://www.inovex.de/de/content-pool/vortraege/

1. Configuration Management vs.
Container Automation
Arnold Bechtoldt,
Johannes M. Scheuermann
Gent, 02.02.2016

2. Arnold Bechtoldt
Systems Engineer @ inovex (Germany)
〉 Software-Defined Datacenters (XaaS)
〉 Infrastructure as Code
〉 Continuous Integration/Delivery
〉 High Availability & Scale-Out
〉 DevOps & Consulting
2

3. Johannes M. Scheuermann
Student @ inovex (Germany)
〉 Software-Defined Datacenters (XaaS)
〉 Container (Docker, rkt)
〉 Orchestration (Kubernetes, Mesos)
〉 High Availability & Scale-Out
〉 OpsDev
3

4. 1. Motivation
2. Pitfalls & Lessons Learned
3. Use Cases
4. Conclusions
5. Q&A
Agenda
4

5. 〉 Several backgrounds
〉 Different opinions
〉 Experience in small to large scaled enterprise environments
〉 (Some) beers and discussions
〉 Goal: Share ideas/lessons learned
Motivation
5

6. Pitfalls & Lessons Learned

7. 〉 Software development „at its best“
§ VCS/refactoring/pair programming/CI/CD
§ Code quality is important
〉 Over-Engineering (Generic Code)
§ KISS
〉 „Configuration Management is Legacy (OS) Management!“
§ Lightweight containers (process isolation) to reduce OS management „overhead“?
„Config Management sucks“ (Pitfalls)
7

9. 〉 „Docker is still a hype!“
§ Gives you lots of opportunities
§ Choose your tool stack wisely
§ Avoid „Bing Bang“ changes
〉 Lack of well-known/established open standards
§ Open Container Initiative
§ CNI (CoreOS) vs. CNM (Docker)
„Containers suck, too“ (Pitfalls)
9

10. 〉 „Docker security is a mess!“
§ Basic understanding of cgroups/caps/ns are helpful
§ Physical separation!
§ Talk & work with your devs
〉 „Images on Docker Hub are insecure!“
§ Just community contributions
§ Docker images are packages/artifacts, treat them like VMDK/VHD/VDI/DEB/RPM
§ Build your own (lightweight) (base) images
§ Use base images without lots of userland tools if possible (e.g. Alpine Linux)
„Containers suck, too“ (Pitfalls)
10

11. 〉 Over-Engineered Dockerfiles („/bin/bash“)
§ KISS
§ Software/Process isolation
§ Replace large shell scripts with CM running outside the container
〉 Scheduling/Orchestration is a whole new area
§ KISS if possible
§ Step-by-step/Smooth migration
„Containers suck, too“ (Pitfalls)
11

12. 12

13. Use Cases

14. 14
Private
Public
Cloud
IaaS
PaaS/CaaS
VMs
Containers
Apps
Setup
CM
CM CM?

15. 〉 Continuous integration & delivery
〉 Microservices (rapid deployment)
〉 Blue/Green Deployment (immutability)
Use Cases
15

16. Conclusions

17. 〉 Containers aren‘t the holy grail, but enhance architecture
〉 Containers have lower overhead compared to VMs
〉 Containers and CM share the same problems
〉 Containers won‘t work without Dev(+)Ops cooperation
〉 Containers and CM Systems will coexist J
Conclusions
17

21. 21
We are hiring
http://www.inovexperts.com

22. Q&A

23. Arnold Bechtoldt
inovex GmbH
CC BY-NC-ND +ArnoldBechtoldtGER
github.com/
bechtoldt
arbe.io
@johscheuer inovex.de +JohannesScheuermann
github.com/
johscheuer
youtube.com/
inovexGmbH
abechtoldt@inovex.de
Johannes M. Scheuermann
inovex GmbH
jscheuermann@inovex.de