OpenRheinRuhr 2018 - Ops hates containers! Why?

Ops hates containers. Why?
Martin Alfke - example42 GmbH

Ops hates containers! Why? OpenRheinRuhr 2018 - Martin Alfke © example42 GmbH !2
Developers say:
• Ops are responsible for
• base container image
• running container
• staging containers
• container security
Customer meeting with Dev, Sec and Ops

Ops hates containers! Why? OpenRheinRuhr 2018 - Martin Alfke © example42 GmbH
Customer meeting with Dev, Sec and Ops
!3
Security / Developer dialogue:
• Security:
• “Dev must ensure security”
• “Dev must name Kernel
capabilities and CGroup settings”
• Developers:
• “what is CGroup settings?”
• Security:
• “We probably should meet when
we all know the basics.”

DOCKER DOCKER DOCKER DOCKER DOCKER DOCKER
!4
Image: wikimedia.org

Container Myths
!5
• No need for conﬁguration
management - anywhere
• Easier to build, deploy and run
• Easier to test and verify
• Easier to ﬁx issues
Image: tatlin

Container Myths - Part 2
!6
• No need to check status and health?
• No need to identify security?
• No need to login, no need for logs?
• No need for dedicated hardware,
runs on cloud?
Image: tatlin

Container de-mystified
!7
• It is just a change-root, delivered as
a ‘package’
• Build steps are layers like VCS
commits
• Containers need infrastructure
• Containers are managed like
binaries
Image: tatlin

Container Runtime
!8
• People start with docker because it
is easy
• docker pull / docker run
• like curl -k | sudo bash
Image: tatlin

OPS, NET, SEC: Act!
!9
Simple can be harder than complex: You have to work hard to
get your thinking clean to make it simple. But it's worth it in the
end because once you get there, you can move mountains. -
Steve Jobs [BusinessWeek, May 25, 1998]

OPS, NET, SEC: Act!
!10
• Mainframe
• PC
• VM
• Container
Image: example42 GmbH

OPS, NET, SEC: Act!
!11
• Uptime decreasing
• Maintenance increasing

OPS, NET, SEC: Act!
!12
• Staff does not scale
with platform

OPS, NET, SEC: Act!
!13
• 100% Automation !

OPS, NET, SEC: Act!
!14
• 80/20 - Pattern:
Image: tatlin

OPS, NET, SEC: Act!
!15
• 80/20 - Pattern:
• 80% time spending on 20% not
automated
Image: tatlin

Containers
!16

Understanding containers
!17
• Short living instances
• 12factor (http://12factor.net)
• Persistant vs volatile data
• Single node view
Image: tatlin

Troubleshoot containers
!18
• registry and container build process
• docker down
• docker in docker
Image: tatlin

Using containers
!19
• CI/CD Pipelines
• Build Processes
• Dashboards
• Puppet Infrastructure(!) (https://
github.com/puppetlabs/
pupperware/)
Image: tatlin

Container Management
!20

Understanding container management
!21
• Multi node container runtime
• Orchestration
• Network (Egress / Ingress / Proxy)
• Maintenance
Image: tatlin

Troubleshoot container management
!22
• Kill a node / container
• Why running an CM API service as
container might be a bad idea?
• Misconﬁguration
• Upgrades
Image: tatlin

Managing container orchestration
!23
Installation and conﬁguration of an
application stack.
• Puppet
• Ansible
• Chef
• Saltstack
Image: tatlin

Commercial container management
!24
• Self hosted vs Managed
• everybody does K8s?
Image: tatlin

Other container management
!25
• Mesos/Aurora/Marathon
• Titus (Netﬂix)
• Docker Swarm
• Nomad/Terraform
• CoreOS / rkt
Image: tatlin

Was there something in the past?
!26
Image: tatlin

Containers and CfgMgmt
!27
• Where do you run your databases?
• Can you move everything to
containers?
• What about legacy applications?
Image: tatlin

Containers and Monitoring
!28
• Dynamic Resources need dynamic
monitoring solution
• Global platform and service health
• Some monitoring tools for
containers: sysdig, cAdvisor, Puppet
Discovery, Prometheus
Image: tatlin

Containers and Hardware
!29
• Serverless does not mean no
hardware
• Opsless does not mean no Ops
• Check with ﬁnance (CAPEX vs.
OPEX)
Image: tatlin

Conclusion
!30
Image: tatlin

Conclusion
!31
• Containers adoption increases.
• Ops people: start learning, stop play
and complaining.
• Security ﬁrst - even on PoC
• Automate everything
• Choose your container tools and
environments. Image: tatlin

Ops hate not having full control
of their systems. Not containers.
Martin Alfke - example42 GmbH

OpenRheinRuhr 2018 - Ops hates containers! Why?

More Related Content

What's hot

Similar to OpenRheinRuhr 2018 - Ops hates containers! Why?

More from Martin Alfke

OpenRheinRuhr 2018 - Ops hates containers! Why?