Download to read offline
Uploaded byKarl Matthias
Docker: Behind the API
The document discusses Docker's functionalities, including packaging, distribution, logging, and lifecycle management, emphasizing that a container is essentially a constrained process sharing the host kernel. Key concepts such as kernel namespaces and control groups (cgroups) are introduced, illustrating how processes are isolated and managed. Additionally, it mentions the potential for networking setups and provides links for further resources and a demo code.
More Related Content
Similar to Docker: Behind the API
Docker: Behind the API
- 1. Docker: Behind theAPI Karl Matthias Principal Systems Engineer
- 2. Applications Need… • Packaging(docker build, import, export) • Distribution (docker push/pull) • Logging (docker logs, fork/exec with pipes) • Lifecycle Management (docker start/stop/kill, events API) • Resource Constraints (kernel cgroups) • Process Isolation* (kernel namespaces) • Networking* (docker-proxy, iptables, bridging)
- 3. A Container isa Process (tree) • Containers all share a kernel instance • It’s a process with some limits applied • You can see them in ps on the host • Docker, Rkt, RunC, etc are not required
- 4. Containing the Process • Kernel Namespaces: – ipc, mnt, net, pid, user, uts • cgroup (Control Group) – Your container gets one • Optionally SELinux or AppArmor policy
- 5. Containers, Deconstructed Container is(at least) a: • Namespace or namespaces • cgroup • (optionally SELinux or AppArmor) More on Docker’s default networking later
- 6. The Demo Building aContainer • We’ll look at Namespaces • We’ll create a basic network setup • We’ll do it in shell • We’ll do it as root Disclaimer: This is not production ready! It’s a demo!
- 7.
- 8. There is SoMuch More • Filesystem backends • Execution drivers • Logging backends • libnetwork and the networking model • Etc.
- 9. Thanks! Diving Deeper: • Codefrom this demo: https://goo.gl/rwfueu • Network Namespaces in Linux: http://goo.gl/o8W7NQ • User Namespaces in Docker: – https://goo.gl/q9qK11 – http://goo.gl/m4a90G Where to find me: • Nitro: http://gonitro.com • “Docker: Up and Running”: http://goo.gl/pc5HQ3 • My Blog: https://relistan.com • Twitter: @relistan • GitHub: relistan