Container, Container, Container -유재석 (AWS 솔루션즈 아키텍트)

© 2019, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Jaeseok Yoo
Container, Container, Container …

Time
9:30 - 11:00 Docker & Container Orchestration
k8s, Amazon EKS
HoL: Launch EKS Cluster
11:00 – 11:15 Beak
11:15 – 12:30 HoL: Deploy Dashboard, Microservices, Logging
12:30 – 14:00 Launch
14:00 – 15:00 Amazon ECS, AWS Fargate
15:00 – 16:45 HoL: Dedicated game server operation
16:45 – 17:00 Clean Up

Docker

애플리케이션의 구성
런 타임 엔진 코드
디펜던시 구성

• 다른 애플리케이션 스택
• 다른 하드웨어 배포 환경
• 다른 환경에서 애플리케이션을
실행하는 효율적인 방법은?
• 다른 환경으로 쉽게
마이그레이션하는 방법은?
문제점

솔루션 - 도커
이식성 : 이미지 기반 배포
유연성 : 마이크로 서비스 모듈화
신속성 : 가벼운 도커 이미지
효율성 : OS kernel 공유

VM과 컨테이너 비교
Server (Host)
Host OS
Hypervisor
App 2
Guest OS Guest OS Guest OS
Bins/Libs Bins/Libs Bins/Libs
App 1 App 3
VM
Server (Host)
Host OS
Docker
Bins/Libs Bins/Libs Bins/Libs
App 1 App 2 App 3
Container
Hypervisor
Guest OS

Docker 이미지 구성
bootfs
kernel
Base image
Image
Image
W
ritable
Container
add
nginx
add
nodejs
U
buntu
References
parent
image
Base Image : 템플릿으로 사용되는
읽기 전용 이미지
Base Image에서 시작해서 커스텀
Image 추가하는 방식
Dockerfile 활용하여 손쉽게 배포 관련
구성 설정 및 재배포에 용이함

Dockerfile
# our base image
FROM alpine:3.5
# Install python and pip
RUN apk add --update py2-pip
# install Python modules needed by the Python app
COPY requirements.txt /usr/src/app/
RUN pip install --no-cache-dir -r
/usr/src/app/requirements.txt
# copy files required for the app to run
COPY app.py /usr/src/app/
COPY templates/index.html /usr/src/app/templates/
# tell the port number the container should expose
EXPOSE 5000
# run the application
CMD ["python", "/usr/src/app/app.py"]
$ docker build -t <YOUR_USERNAME>/myfirstapp .
Sending build context to Docker daemon 9.728 kB
Step 1 : FROM alpine:latest
---> 0d81fc72e790
Step 2 : RUN apk add --update py-pip
---> 976a232ac4ad
Removing intermediate container 8abd4091b5f5
Step 3 : COPY requirements.txt /usr/src/app/
---> 65b4be05340c
Step 4 : RUN pip install --no-cache-dir -r
/usr/src/app/requirements.txt
---> 8de73b0730c2
Step 5 : COPY app.py /usr/src/app/
…
Dockerfile은 컨테이너 내부 이미지 환경 및 구성 정의

고객사례 - Nextdoor
Base OS version
Apt packages:
OpenSSL
libpq
syslog-ng
Datadog
Python runtime
PyPI packages:
Boto
Django
Mapnik
SendGrid
Source code
Static assets
Images
JS
CSS

Layer 별 각기 다른 업데이트 주기
Quarterly
Weekly/
monthly
Continuous

AMI에서 Docker Container로 변경
Base OS layer
System packages
Python packages
Nextdoor source

Docker 이전에는 빌드 20분 소요
chroot
sudo apt-get install
sudo pip install
git clone
make install
dpkg create

Base image , system deps 추가
FROM hub.corp.nextdoor.com/nextdoor/nd_base:precise
ADD app/docker/scripts/apt-fast
app/docker/scripts/system-deps.sh
/deps/
RUN /deps/system-deps.sh

Python virtualenv 설정 업데이트
ADD app/docker/scripts/venv-deps.sh
app/apps/nextdoor/etc/requirements*.txt
app/apps/nextdoor/etc/nextdoor.yml
app/services/scheduler/etc/scheduler.yml
app/services/supervisor/etc/supervisor.yml
/deps/
RUN /deps/venv-deps.sh

App 소스 업데이트
ADD app/static/nextdoorv2/images /app/static/nextdoorv2/images
ADD app/thrift /deps/thrift
ADD app/nd /deps/nd
ADD app /app

빌드 시간 20분 -> 평균 2분
ECS에 최종 배포까지 평균 5분

Common Questions
• How do I deploy my containers to hosts?
• How do I do zero downtime or blue green deployments?
• How do I keep my containers alive?
• How can my containers talk to each other?
• Linking? Service Discovery?
• How can I configure my containers at runtime?
• What about secrets?
• How do I best optimize my "pool of compute”?

How do we make this work at scale?

We need to
• start, stop, and monitor lots of containers running on
lots of hosts
• decide when and where to start or stop containers
• control our hosts and monitor their status
• manage rollouts of new code (containers) to our hosts
• manage how traffic flows to containers and how
requests are routed

Container Orchestration
Instance Instance Instance
OS OS OS
Container Runtime Container Runtime Container Runtime
App Service App App Service Service

myJob: {
Cpu: 10
Mem: 256
}
Orchestrator
Schedule
Run “myJob”

Instance/OS Instance/OS Instance/OS
Service Management
Scheduling
Resource Management
OrchestrationService Management
§Availability
§Lifecycle
§Discovery

Service Management
Scheduling
Resource Management
Orchestration
Scheduling
§Placement
§Scaling
§Upgrades
§Rollbacks

Service Management
Scheduling
Resource Management
Orchestration
Resource Management
§ Memory
§ CPU
§ Ports

What are container orchestration tools?

Amazon Container Services Landscape
MANAGEMENT
Deployment, Scheduling,
Scaling & Management of
containerized applications
HOSTING
Where the containers run
Amazon Elastic
Container Service
Amazon Elastic
Container Service
for Kubernetes
Amazon EC2 AWS Fargate
IMAGE REGISTRY
Container Image
Repository
GA : June 6, 2018
Seoul : Jan 11, 2019
Amazon Elastic
Container Registry

Amazon ECS
EC2 INSTANCES
LOAD
BALANCER
Internet
ECS
AGENT
TASK
Container
TASK
Container
ECS
AGENT
TASK
Container
TASK
Container
AGENT COMMUNICATION
SERVICE
Amazon ECS
API
CLUSTER MANAGEMENT
ENGINE
KEY/VALUE STORE
ECS
AGENT
TASK
Container
TASK
Container
LOAD
BALANCER

Amazon ECS : Cluster
EC2 INSTANCES
LOAD
BALANCER
Internet
ECS
AGENT
TASK
Container
TASK
Container
ECS
AGENT
TASK
Container
TASK
Container
AGENT COMMUNICATION
SERVICE
Amazon ECS
API
CLUSTER MANAGEMENT
ENGINE
KEY/VALUE STORE
ECS
AGENT
TASK
Container
TASK
Container
LOAD
BALANCER

Amazon ECS : Task
EC2 INSTANCES
LOAD
BALANCER
Internet
ECS
AGENT
TASK
Container
TASK
Container
ECS
AGENT
TASK
Container
TASK
Container
AGENT COMMUNICATION
SERVICE
Amazon ECS
API
CLUSTER MANAGEMENT
ENGINE
KEY/VALUE STORE
ECS
AGENT
TASK
Container
TASK
Container
LOAD
BALANCER

Tasks are defined via Task Definitions
{
"containerDefinitions": [
{
"name": "simple-app",
"image": "httpd:2.4",
"cpu": 10,
"memory": 300,
"portMappings": [
{
"hostPort": 80,
"containerPort": 80,
"protocol": "tcp"
}
],
"essential": true,
"mountPoints": [
{
"containerPath": "/usr/local/apache2/htdocs",
"sourceVolume": "my-vol"
}
]
},
{
"name": "busybox",
"image": "busybox",
"cpu": 10,
"memory": 200,
"volumesFrom": [
{
"sourceContainer": "simple-app"
}
],
"command": [
"/bin/sh -c "...""
],
"essential": false
}
],
"volumes": [
{
"name": “my-vol"
}
]
}

{
{
"name": "simple-app",
"image": "httpd:2.4",
"cpu": 10,
"memory": 300,
"portMappings": [
{
"hostPort": 80,
"containerPort": 80,
"protocol": "tcp"
}
],
"essential": true,
"mountPoints": [
{
"containerPath": "/usr/local/apache2/htdocs",
"sourceVolume": "my-vol"
}
]
},
10 CPU units (1024 is a full CPU)
300 MB of memory
Expose port 80 in container
to port 80 on host
Create and mount volumes
Essential to our task

{
"name": "busybox",
"image": "busybox",
"cpu": 10,
"memory": 200,
"volumesFrom": [
{
"sourceContainer": "simple-app"
}
],
"command": [
"/bin/sh -c "...""
],
"essential": false
}
],
"volumes": [
{
"name": “my-vol"
}
]
}
From Docker Hub
Mount volume from other container
Command to exec
Volumes

Task log to CloudWatch Logs
CloudWatch Logs Amazon S3
Amazon Kinesis
AWS Lambda
Amazon ElasticSearch
Amazon ECS Store
Stream
Process
Search
CloudWatch Logs
CloudWatch Logs
CloudWatch Logs

IAM Task Role
AWS IAM
Amazon
DynamoDB
S3
AWS IAM
DynamoDBRole
S3Role
Amazon
ECS
IAM Task
Role
Identity
Access
Management
(IAM)
ECS Task

Task Placement Constraints
Name Example
AMI ID
attribute:ecs.ami-id == ami-
eca289fb
Availability
Zone
attribute:ecs.availability-
zone == us-east-1a
Instance
Type
attribute:ecs.instance-type
== t2.small
Distinct
Instances
type=“distinctInstance”
Custom attribute:stack == prod
Cluster
Constraints
Custom
Constraints
Placement
Strategies
Apply Filter
CPU, memory, port requirements
AZ, EC2 type, AMI, or custom
constraints
Spread or Binpack
placement strategy
Select final instances for
task deployment

Task Placement Strategies
Binpacking Spread Affinity Distinct Instance

Amazon ECS : Service
EC2 INSTANCES
LOAD
BALANCER
Internet
ECS
AGENT
TASK
Container
TASK
Container
ECS
AGENT
TASK
Container
TASK
Container
AGENT COMMUNICATION
SERVICE
Amazon ECS
API
CLUSTER MANAGEMENT
ENGINE
KEY/VALUE STORE
ECS
AGENT
TASK
Container
TASK
Container
LOAD
BALANCER

CloudWatch ECS Metric
2 Dimensions
• ClusterName
• ServiceName
4 metrics
• CPUReservation
• MemoryReservation
• CPUUtilization
• MemoryUtilization
Container
Instance
…
Cluster
Task
definition
Task
Service
CloudWatch
ECS Metrics
CloudWatch
EC2 Metrics
Container
Instance
Container
Instance

ECS Cluster (EC2 Instance) Auto Scale out
Event: Per cluster CPU, memory
reservation, or usage
New services
ECS
ECS cluster
CloudWatch
Developers
CloudWatch event

ECS Cluster (EC2 Instance) Auto Scale in
Draining
ECS
ECS cluster
CloudWatch
Event: Per cluster CPU, memory
reservation, or usage

Service Auto Scaling
Amazon EC2
Service
Resource
buffer
(+~15%)

Auto Scaling Target Tracking
Only need to set the target value for the
metric
(ex: CPU utilization 50%)
Auto Scaling automatically adjusts the Task
DesiredCount in Service
CloudWatch metric
ECSServiceAverageCPUUtilization
ECSServiceAverageMemoryUtilization
ALBRequestCountPerTarget
CPUTraffic
DesiredCount
Time
100%
0%
50%
10%
20%
30%
40%
60%
70%
80%
90%
5
30
10
15
20
25
Target CPU Utilization DesiredCount

AWS Fargate : Only focus on tasks!
Simple, Easy, efficient
Serverless
Container!
=No EC2 Instances
to provision, scale
or manage
ECS
Native API ,
Integrated with
VPC, ELB, IAM,
CloudWatch
and more
Pay for CPU,
Memory Usage

AWS Fargate
Scheduling and Orchestration
Cluster Manager Placement Engine
ECS
AMI
Docker
agent
ECS
agent
EC2 Instance
ECS
AMI
Docker
agent
ECS
agent
EC2 Instance
ECS
AMI
Docker
agent
ECS
agent
EC2 Instance

Amazon EC2 and AWS Fargate Hybrid cluster
ECS Instance ECS Instance ECS Instance ECS InstanceECS Instance ECS Instance
EC2
FARGATE
Notifications
Amazon ECS CLUSTER
Availability Zone #1 Availability Zone #2 Availability Zone #3
Subnet 2
172.31.2.0/24
Subnet 1
172.31.1.0/24
Subnet 3
172.31.3.0/24
Web
Shopping
Cart

Fargate
Define application containers: Image
URL, CPU & Memory requirements, etc.
register
Task Definition
create
Cluster
• Infrastructure Isolation
boundary
• IAM Permissions boundary
run
Task
• A running instantiation of
a task definition
• Use Fargate launch type
create
Service
Elastic Load
Balancing

CPU & Memory specification
Task Level Resources:
• Total CPU/memory across all containers
• Required fields
• Billing dimensions
Units
• CPU: cpu-units. 1 vCPU = 1024 cpu-units
• Memory: MB
Container Level Resources:
• Defines sharing of task resources among
containers
• Optional fields
{
"family": "scorekeep",
"cpu": "1 vCpu",
"memory": "2 gb",
{
"name":“scorekeep-frontend",
"image":"xxx.dkr.ecr.us-east-1.amazonaws.com/fe“,
"cpu": 256,
"memoryReservation": 512
},
{
"name":“scorekeep-api",
"image":"xxx.dkr.ecr.us-east-1.amazonaws.com/api",
"cpu": 768,
}
]
}
Task
Level
Resources
Container
Level
Resources
Task Definition Snippet

VPC Integration
Launch your Fargate Tasks into subnets
Under the hood :
• We create an Elastic Network Interface (ENI)
• The ENI is allocated a private IP from your subnet
• The ENI is attached to your task
• Your task now has a private IP from your subnet!
You can assign public IPs to your tasks
Configure security groups to control inbound & outbound
traffic
172.31.0.0/16
Subnet
172.31.1.0/24
Other Entities in VPC
EC2 LB DB etc.
Private IP
172.31.1.164
ENI Fargate
TaskPublic /
208.57.73.13 /

VPC Configuration
{
"family": "scorekeep",
"cpu": "1 vCpu",
"memory": "2 gb",
"networkMode": "awsvpc",
{
"name":“scorekeep-frontend",
"image":"xxx.dkr.ecr.us-east-1.amazonaws.com/fe",
"cpu": 256,
},
{
"name":“scorekeep-api",
"image":"xxx.dkr.ecr.us-east-1.amazonaws.com/api",
"cpu": 768,
}
]
}
$ aws ecs run-task ...
-- task-definition scorekeep:1
-- network-configuration
“awsvpcConfiguration = {
subnets=[subnet1-id, subnet2-id],
securityGroups=[sg-id]
}”
Enables ENI
creation &
attachment
to Task
Run Task
Task Definition

Fargate Storage
Layer Storage Space :
• 10 GB layer storage available per task
across all containers in a single task
• Includes image layers
Ephemeral storage backed by Amazon EBS
Fargate volume Storage :
• 4 GB volume space per task
• Visible across containers
• Configure via task definitions
Image Layers
Writable Layer
Image Layers
Writable Layer
Container 1 Container 2
10 GB per Task
Container 1 Container 2
4 GB Volume Storage
mount
/var/container1/data /var/container2/data

Fargate pricing
CPU Memory
256 (.25 vCPU) 512MB, 1GB, 2GB
512 (.5 vCPU) 1GB to 4GB
1024 (1 vCPU) 2GB to 8GB
1 vCPU = $0.04656/hour
1 GB Mem = $0.00511/hour
50 different CPU/memory configurations

Thank you!

Container, Container, Container -유재석 (AWS 솔루션즈 아키텍트)

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to Container, Container, Container -유재석 (AWS 솔루션즈 아키텍트)

Similar to Container, Container, Container -유재석 (AWS 솔루션즈 아키텍트) (20)

More from Amazon Web Services Korea

More from Amazon Web Services Korea (20)

Recently uploaded

Recently uploaded (20)

Container, Container, Container -유재석 (AWS 솔루션즈 아키텍트)