These are the slides for a talk I gave at Docker User Group Stuttgart, covering LinuxKit and Moby essentials.

1. LinuxKit & Moby
The next level of the container ecosystem

2. 2

3. $ whoami
● Patrick Kleindienst
● Masters student at Stuttgart Media University, course of studies “Computer
Science & Media”
● Master’s candidate at IBM Research & Development (Böblingen)
@Apophis1990
3

4. Outline
● About LinuxKit
○ Motivation
○ Design Principles: Portability, Leanness, Security
● About Project Moby
○ Motivation
○ Diving through container history
● Demo: Moby & LinuxKit in action
4

5. LinuxKit: Motivation
“Last year, one of the most common requests we heard
from our users was to bring a Docker-native experience to
their platforms. These platforms were many and varied[.]
(...) One of the issues we encountered was that [...] users
wanted Linuxcontainer support but the platform itself did
not ship with Linux included.”
(Justin Cormack, [1])
Cloud Server Desktop
5

6. Example: Docker for Mac
6

7. ● Released by Docker Inc. at DockerCon 2017 in Austin (Texas)
● Addresses need for secure, lean and portable Linux subsystems
● Brings native Docker and Linux container support to various platforms
● Already in use in e.g. Docker for Mac/Windows for a couple of time
7

8. LinuxKit Design Principles: Portability
Supported server/desktop hypervisors:
● HyperKit (macOS)
● Hyper-V (Windows)
● qemu (macOS, Windows, Linux)
● VMware (macOS, Windows)
Supported cloud platforms:
● Amazon Web Services
● Google Cloud
● Microsoft Azure
● packet.net
8

9. LinuxKit Design Principles: Leanness
● Image core = Linux Kernel + some system libraries + container runtime
● Everything else is optional!
● Small foot print, image size ~ 35 MB
● minimal boot time
● Helps with security
9

10. LinuxKit Design Principles: Security
● container-specific OSes reduce attack surface
● less overhead -> less attack vectors (compared to popular distros like Debian)
● Isolation: optional services run inside dedicated containers
● Containerized services allow for fine-grained control of privileges and resource
consumption
● Immutable infrastructure (read-only filesystem)
10

11. Why security matters - an example
What’s so special about the “ping” binary?
# ls -l $(which ping)
-rwsr-xr-x 1 root root 44168 Mai 7 2014 /bin/ping
(taken from LinuxMint 18.1 Serena)
11

12. Ok but, … what does LinuxKit have to do with Moby?
12

13. The Moby Project
● Also released by Docker Inc. at DockerCon 2017 in Austin (Texas)
● Tribute to size and needs of the community
● Moby provides:
○ A library of containerized backend components (runC, containerd, notary, networking, …)
○ A framework for assembling these components into functional container platforms
○ A reference assembly (Moby Origin) as the base for the Docker container platform
● Building container platforms by means of containers
13

14. At the beginning (2013-2014)
Containers as a pioneer domain; monolithic opensource Docker codebase
14

15. The cloud era (2015-2016)
Massive adoption for cloud-native apps; strip down monolith into components
15

16. Today (2017)
Containers going mainstream; Embraced by more and more environments, platforms
and industries
16

17. Future of the container ecosystem (>= 2017)
Collaboration and sharing of assemblies; Use assemblies and existing/custom
components to build specialized container platforms
17

18. Give me an example!
18

19. Demo: Redis OS
19

20. Thank you for your attention!
20

21. Sources (1)
● Videos:
○ Docker Inc. 2017. DockerCon 2017 - General Session Day 1. YouTube video. 1:50:22. Posted by
“Docker”. April 24, 2017. https://www.youtube.com/watch?v=hwkqju_BXEo&t=4sm
● Blogs:
○ [1] Cormack, Justin. 2017. Announcing LinuxKit: A Toolkit for building secure, lean and portable
Linux subsystems. Accessed June 29, 2017.
https://blog.docker.com/2017/04/introducing-linuxkit-container-os-toolkit/
○ [2] Hykes, Solomon. 2017. Introducing Moby Project: A new open-source project to advance the
software containerization movement. Accessed June 29, 2017.
https://blog.docker.com/2017/04/introducing-the-moby-project/
○ [3] Docker Inc. 2017. linuxkit/linuxkit. Accessed June 29, 2017. https://github.com/linuxkit/linuxkit
○ [4] Docker Inc. 2017. moby/moby. Accessed June 29, 2017https://github.com/moby/moby
○ [5] Moby Project. 2017. Moby Project. Accessed June 29, 2017. https://mobyproject.org/
21

22. Sources (2)
● Pictures:
○ https://i2.wp.com/blog.docker.com/wp-content/uploads/linux-kit@2x.png?resize=400%2C96&ssl=1
○ https://upload.wikimedia.org/wikipedia/commons/thumb/1/1d/AmazonWebservices_Logo.svg/800px
-AmazonWebservices_Logo.svg.png
○ https://upload.wikimedia.org/wikipedia/commons/thumb/c/c9/Windows-server-2016.png/1024px-Wi
ndows-server-2016.png
○ https://upload.wikimedia.org/wikipedia/commons/thumb/f/fa/Apple_logo_black.svg/2000px-Apple_l
ogo_black.svg.png
○ https://i0.wp.com/blog.docker.com/wp-content/uploads/1-2.png?w=763&ssl=1
○ https://tuchacloud.com/wp-content/uploads/2016/03/KVM-tucha.png
○ https://i1.wp.com/blog.docker.com/wp-content/uploads/3a660141-cb0c-426b-9b6b-cec7b8a2f548-1.jp
g?resize=389%2C117&ssl=1
○ https://upload.wikimedia.org/wikipedia/de/thumb/6/6b/Redis_Logo.svg/1200px-Redis_Logo.svg.png
22