Containers are a developer's new best friend. For all the non-developers, what does this mean? This session will demystify this abstraction called containers, and dive deep on how it changes the way we provision, deliver, deploy and manage applications. Speaker: Shiva Narayanaswamy, Solutions Architect, Amazon Web Services

1. © 2016, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Shiva Narayanaswamy, Solutions Architect
September 2016
Containers for Non-­Developers

2. Containerised Microservices
Dom 0
Instance Instance Instance
OS OS OS
Container Runtime Container Runtime Container Runtime
App App
Service Service
App App
Service Service
App App
Service Service

3. Container Orchestration
Dom 0
Instance Instance Instance
OS OS OS
Container Runtime Container Runtime Container Runtime
App Service App App Service Service
Container Orchestration

4. Container Orchestration
Dom 0
Instance/OS Instance/OS Instance/OS
App Service App App Service Service
Service Management
Scheduling
Resource Management
Orchestration
Service Management
§Labels
§Groups/Namespaces
§Dependencies
§Load Balancing
§Health Check
§Service Discovery

5. Container Orchestration
Dom 0
Instance/OS Instance/OS Instance/OS
App Service App App Service Service
Service Management
Scheduling
Resource Management
Orchestration
Scheduling
§Placement
§Replication/Scaling
§Resurrection
§Rescheduling
§Rolling deploys
§Upgrades
§Downgrades
§Colocation

6. Container Orchestration
Dom 0
Instance/OS Instance/OS Instance/OS
App Service App App Service Service
Service Management
Scheduling
Resource Management
Orchestration
Resource
Management
§ Memory
§ CPU
§ GPU
§ Volumes
§ Ports
§ IPs

7. Non Functional Capabilities
Scalability
Performance, Responsiveness, Efficiency
Availability
Fault Tolerance, Reliability, DR
Flexibility
Extensibility, Portability, Interoperability
Usability
Familiarity, Debuggability, Maintainability
Portability
Container Runtime, Host OS, Cloud Provider, On-­prem
Security
Isolation, Encryption, Secrets Management, Auditability

8. In NO Particular Order
[ ] Schedulers and Orchestration
[ ] Networking
[ ] Security
[ ] Operating Systems
[ ] Storage
[ ] Monitoring

9. Schedulers and Orchestration

10. Schedulers – General Blurb
Cluster
Machines
Cluster State
Information
Monolothic Two-­Level Shared State
No Concurrency Pessimistic
Concurrency
(offers)
Optimistic
Concurrency
(transactions)
Scheduling Logic

11. Customers Like Options

12. Docker
Task
Container Instance
Amazon
ECS
Container
ECS Agent
ELB
Internet
ELB
User /
Scheduler
API
Cluster Management Engine
Task
Container
Docker
Task
Container Instance
Container
ECS Agent
Task
Container
Docker
Task
Container Instance
Container
ECS Agent
Task
Container
AZ 1 AZ 2
Key/Value Store
Agent Communication Service
ECS

13. Networking

14. Container Networking
Dom 0
Instance Instance Instance
OS OS OS
Container Runtime Container Runtime Container Runtime
Container Container Container Container Container Container

15. Overlay all of the Thingz
• Flannel
• Calico
• WeaveNet
• Swarm Mode

16. Security

17. Security Pro-­Tips
§ Host Security
§ Lock it down
§ Namespaces and cgroups are your friends
§ Select few belong to docker UNIX group
§ SELinux is also your friend
§ Docker daemon runs as root!
§ Docker Daemon Security
§ Do not run in privileged mode
§ Lock down inter container comms –icc=false
§ Secure APIs with TLS certificates

18. Whale-­Say
"Only trusted users should be allowed to control your Docker daemon"
“If you run Docker on a server, it is recommended to run exclusively Docker
in the server, and move all other services within containers controlled by
Docker”

19. IMAGE REGISTRY
CI/CD
DEPLOYMENT SYSTEM
SOURCE
CODE REPO
SECURITY
SCANNING
CONTINUOUS
ASSURANCE
Pull latest
signed image
Commit Code
Trigger Build
Push signed
image
Pull latest
stable signed
image
DEVELOPER
Workflow

20. More Prescriptive Advice Here…
https://benchmarks.cisecurity.org/tools2/docker/CIS_
Docker_1.11.0_Benchmark_v1.0.0.pdf

21. Operating System

22. Micro OS
CoreOS
RancherOS
Ubuntu Snappy
RedHat Atom
VmWare Photon
ECS Optimized Amazon Linux
RedHat
Atomic
VmWare
Photon
Ubuntu
Snappy
CoreOS RancherOS
395 MB
317 MB
215 MB
20 MB
150 MB

23. Storage

24. Persistent Storage
§ POSIX is legacy filesystem. So don’t!
§ Named volumes
§ Data only container
§ Flocker
§ Shared file system (EFS, GlusterFS etc.)

25. Monitoring and Operations

26. Monitoring and Operating
Monitoring systems need to be more available and scalable than the systems (and services) being monitored
~ Adrian Cockroft

27. Demo
ApacheDogs and NginxCats

28. Thank You!