A deep dive into the history of containers as well as an introduction to how they work under the covers. This includes a discussion around Control Groups and Process Namespaces, as well as touching on some underlying syscalls, such as Fork and Clone.

1. Corwin on Containers

2. Who Am I
●
○
●
○
■
■
■
●

3. What are we Talking About Today

4. Containers!
●
●
●
●
●
○
○
●

5. Definition of DevOps

6. “DevOps is about
recognizing that
the backing
infrastructure is
not separate from
your application,
but a vital part of
it.”

7. Linux Crash Course

8. Everything is a File
●
●
●
●
●
●
●
○ …

9. User Space and Kernel Space
●
●
●

10. Fork and Exec
●
○ fork(2) exec(2).
● fork(2)
○
● exec(2)

11. Let's talk about Containers!

12. What is Containerization?
●
○
○
●
●

13. Can be Very Similar to Virtual Machines
●
○
■
○
■
○
■

14. Tend to be lighter weight than VMs
●
○
●
○
○

15. The History of Containers

16. Chroot
●
●
●
○
●
○ chroot(2)
●

17. FreeBSD Jails and Solaris Zones
●
●
●
●

18. LXC
●
●
●
○
●
○
●
●

19. Docker
●
●
○
●
○
●

20. RKT
●
●
●
○
●
●
●

21. How do Containers Work?

22. Two Primary Kernel Features
●
●

23. Process Namespaces
●
●
○
○
●

24. Process Namespaces
●
●
●
●
●
●
●

25. Creating a New Process Namespace
●
unshare --fork --net /bin/bash

26. Creating a New Process Namespace
●
$ ip link
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen
1
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: enp0s3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP mode DEFAULT group
default qlen 1000
link/ether 02:f4:7c:c4:3b:a3 brd ff:ff:ff:ff:ff:ff

27. Creating a New Process Namespace
●
$ ip link
1: lo: <LOOPBACK> mtu 65536 qdisc noop state DOWN mode DEFAULT group default qlen 1
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
●

28. Creating a New Process Namespace
static int child_exec(void *parent_args) {
printf("New Namespace:n");
system("ip link");
return(0);
}
int main(int argc, char **argv) {
printf("Host: n");
system("ip link");
printf("n----nn");
int clone_flags = SIGCHLD | CLONE_NEWNET;
pid_t child_pid = clone(child_exec, child_stack + STACKSIZE, clone_flags, NULL);
waitpid(child_pid, NULL, 0);
exit(EXIT_SUCCESS);
}

29. Creating a New Process Namespace
int clone_flags = SIGCHLD | CLONE_NEWNET;
pid_t child_pid = clone(
child_exec,
child_stack + STACKSIZE,
clone_flags,
NULL
);

30. Creating a New Process Namespace
● clone(2) fork(2)
○ clone(2) fork(2)
○ fork(2) clone(2)
○
○

31. Control Groups
●
○
●
●

32. ●
○
●
○
●
○
●
○
Control Groups

33. ●
● /sys/fs/cgroup
Control Groups Implementation

36. Create a New Control Group
cgcreate -g memory:test_group
mkdir /sys/fs/cgroup/memory/test_group

37. New Group!!!

39. Add a Process to “test_group”
cgclassify -g memory:test_group $PID
echo $PID > /sys/fs/cgroup/memory/test_group/tasks

40. In Summary
● …
● …

41. Further Reading
●
○
●
○
●
○

42. How Does this Help Me?

43. Testing New Technologies

44. Dependency Requirements

45. Developer Onboarding

46. End to End Testing

47. Building
FROM node:8.5.0
RUN mkdir -p /usr/app/src
WORKDIR /usr/app
ADD package.json package.json
ADD gulpfile.js gulpfile.js
ADD webpack.*.js /usr/app/
RUN npm install && gulp build.prod

48. Future
●
○
○
●
○
●
○

49. Questions?