This document summarizes key aspects of Docker internals, including how it provides isolation using namespaces and cgroups, manages images using AUFS and layers, and runs and manages containers via its daemon. It outlines Docker's use of isolation, images, process management, and roadmap for future versions including new backend interfaces and improved service discovery.

1. Docker Internals
SF Docker Meetup at Twilio
11/14/2013
Docker version 0.6.6 / 0.7.0-rc5
##dockermeetup
By Guillaume J. Charmes <guillaume@docker.com>
@charme_g

2. This is your last chance
1.
2.
3.
4.
Isolation
Images
Process Management
Roadmap

3. Isolation
• LXC
•
•
•
•
Cgroups/Namespaces
Processes
Mounts
Network
• Network
• NAT (DOCKER chain)
• Expose / Links
• File System
• Chroot on steroids

4. Isolation
• Isolation: Namespaces
• Only 1 syscall (setns()). No hypervisor
• Mounts, Uts (hostname), Net, Pid, IPC, User
• Resource management: Cgroups
• Memory Limitation
• CPU Shares
• Future: blkio

5. Isolation
• Network
•
•
•
•
Bridge
Veth
NAT
Expose / Links
• File System
• Chroot++
• Image management

6. 1.
2.
3.
4.
Isolation
Images
Process Management
Roadmap

7. Images
• AUFS
• Image format
•
•
•
•
Base image
Layer + parent id
Whiteouts (.wh.)
Difference Image vs Container
• Registry
• Future
• Devicemapper
• Backend interface

8. Images
• Why AUFS?
• Production usage for years
• Layers
• Multiple RO layers, 1 RW -> Diff
• Limitations
• 42 layers
• Whiteouts
• Deletion management

9. Images
• Image format
• Payload (layer)
• Metadata (parent id)
• Image vs Container
• Differences
• Future: Unified format

10. Images
• Image sharing: Registry
• Push/Pull via diffs
• Future
• Backend interface / Devicemapper
• Unified image format: whiteouts (.wh.)

11. 1.
2.
3.
4.
Isolation
Images
Process Management
Roadmap

12. Process Management
• Docker daemon
• Transports unix/tcp
docker run internals
• Attach logic
• Logs
• Host Integration
• Dockerfile
• RUN
• EXPOSE
• What is the Context?
• Service Discovery

13. Process Management
• Docker daemon
• Transports: docker –d –H tcp://127.0.0.1:4243 –H unix:///var/run/docker.sock
• Holds all containers
• Handles the logging
• Docker client
• Everything uses the Remote API

14. Process Management
docker run
• Create
• Start
• Attach
internals
• General Config vs Host Config
• Attach protocol
• TTY
• Non-TTY

15. 1.
2.
3.
4.
Isolation
Images
Process Management
Roadmap

16. Roadmap
• Docker 0.7
• File system backend interface
• Docker 0.8
• Isolation backend interface
• Full introspection
• Future
• Ambassador Pattern

17. Conclusion
• Wide global support with backend interfaces
• Service discovery improvement
• Road to multi host / orchestration

18. Thank you!
www.docker.io