As presented at LinuxCon/ContainerCon 2015: http://sched.co/3YTd Containers are changing the manner in which applications are run across all data centers. However, it’s time to improve the efficiency of containers by removing VMs altogether and enabling containers to exist as first class citizens in the datacenter. The removal of the VM is just one of the seven characteristics of container-native infrastructure that offers specific performance and operational advantages to Docker in production. From more convenient networking to improved host management and overall better performance, container-native infrastructure is the future of the data center. In this session, Joyent Product Manager Casey Bisson will explore the difference between container-native and legacy infrastructure, including a side-by-side demonstration of clear differences.

1. SecurityManagement Networking IntrospectionPerformance Utilization
the 7 characteristics of
container-native infrastructure

2. here
has…
who

3. container?
built a

4. container?
run a

5. container
run a
in production?

6. yeah?

7. you run it?
where’d

8. in a VM
you ran it
didn’t you?

12. container-native!
that’s not

14. container-native
infrastructure
7 characteristics of

15. @misterbisson
tweet questions to

16. native?
Container-

24. container
Unit of compute

25. containers
Provision

26. VMs
…not

27. bare metal
Containers run on

28. VMs
…not in

29. containers
Pay for

30. VMs
…not

33. Our simple app
Nginx
Couchbase
Node
audiofprint

34. Deploy that app
Nginx
Couchbase
Node
audiofprint
Nginx
Couchbase
Node
audiofprint
VM-native Container-Native
VM: 2 vCPU / 7.5GB RAM

35. Now scale it
CouchbaseCouchbase
Nginx Node
audiofprint
Nginx Node
audiofprint
VM: 2 vCPU / 7.5GB RAMVM: 2 vCPU / 7.5GB RAM
VM-native Container-Native
Nginx
Couchbase
Node audiofprint
Nginx
Couchbase
Node audiofprint
VM: 2 vCPU / 7.5GB RAMVM: 2 vCPU / 7.5GB RAM

36. What’s that bill?
VM-native
4 VMs
8 containers
$0.560/hour
$403.20/month
Container-native
0 VMs
8 containers
$0.315/hour
$226.66/month

37. have to be
why does it
that way?

38. most
infrastructure

39. two
scenario
pick

40. two:
• elasticity
• security
• performance
pick

41. two:
• elasticity
• security
• performance
pick
bare
metal
{

42. two:
• elasticity
• security
• performance
pick
hardware
virtual
machine{

43. container-native
infrastructure

44. three
scenario
pick

45. three:
• elasticity
• security
• performance
pick
bare
metal
containers
{

46. but

47. the kernel
supports it
only if

48. only if

49. the kernel
supports it
only if

50. –Docker's Jérôme Petazzoni

51. –Travis CI’s Sven Fuchs

52. not Docker’s
fault
it’s

53. the kernel’s
fault
it’s

54. breath for a moment

55. are we
doing this?
why

56. foundation
containers are the

57. foundation
not the goal
containers are the

62. it didn’t
or
photos
happen

63. it didn’t
or
photos
happen

64. it doesn’t
or
repo
work

65. it doesn’t
or
work
public repo

66. with
public repo
1. Dockerfile
2. docker-compose.yml
3. documentation, etc…

67. wait

68. stop
wait

69. stop
wait
the audience says…

70. how

71. proprietary code
in a public repo?
can i put

72. proprietary code
i argue back
but that’s not

73. “For our Go microservices, we use Travis CI
to run tests and to create Debian
packages as build artifacts. Travis uploads
these packages to S3, and then another
system pulls them down, signs them, and
imports them into our private Apt repository.
We use FPM to create packages, and Aptly to
manage our repos.”

74. “[W]e’ve really embraced chatops at 500px,
so we've scripted the use of those tools into
our beloved and loyal Hubot friend, BMO.
Anyone at 500px can easily deploy the
site or a microservice with a simple chat
message like bmo deploy <this
thing>.”

75. that’s
1. public APIs & open source tools
2. glue code / infrastructure as code
3. secrets & configuration details

76. so, either
1. the glue code really is proprietary
2. they didn’t have time
3. it doesn’t work
4. the secrets are baked into the code
5. it runs on pets and can’t be
deployed repeatably

79. so, either
1. the glue code really is proprietary
2. they didn’t have time
3. it doesn’t work
4. the secrets are baked into the code
5. it runs on pets and can’t be
deployed repeatably

80. fix that
please

81. we need
1. immutable infrastructure
2. repeatable installs
3. separate config from code

82. container-native
makes it possible

83. container-native
makes it real
developing for

84. breath for a moment

85. promised you
a list
i

86. the unit of compute
is a container
1:

87. you provision
containers
2:

88. the containers run
on bare metal
3:

89. the kernel offers
real security
4:

90. no escape
no incursion
that means

91. porous
containers
non-

92. the containers are protected
from noisy neighbors
5:

93. 48 cores of bare metal
if a single container can
dominate them all?
what’s the point of

94. every container gets
a VNIC
6:

95. every container gets
a VNIC
6:
(or two)

96. every container gets
a VNIC
6:
(or three)

97. every container gets
a VNIC
6:
(or more)

98. well-connected container
is a happy container
because a

99. You pay for
containers
7:

100. You pay for
containers
7:
(not VMs)

101. science fiction
this is not

102. state of the art
this is

103. available
now
this is

104. actually
not new at all
this is

107. container spectrum
bare metal alternatives
to hardware VMs

108. container spectrum
infrastructure containers

109. container spectrum
application containers
bare metal alternatives
to hardware VMs

110. container spectrum
Docker
infrastructure containers

111. container spectrum
Docker
infrastructure containers
multi-process
Docker containers

112. container spectrum
Docker
infrastructure containers
slimmed-down
infrastructure containers

113. container spectrum
Docker
infrastructure containers
multi-process
Docker containers
slimmed-down
infrastructure containers

114. container spectrum
Docker
infrastructure containers
multi-process
Docker containers
slimmed-down
infrastructure containers
they’re all
good

115. breath for a moment

116. container-native
makes it possible

117. container-native
makes it real
developing for

118. and

119. container-native
makes it fast
and

120. hosts
no more

121. pets
no more

122. lifecycle
no more
management

123. pay for
only
what you use

124. breath for a moment

125. The best place to run containers.
Making Ops simple and scalable.
SecurityManagement Networking IntrospectionPerformance Utilization

126. SecurityManagement Networking IntrospectionPerformance Utilization
Public Cloud
Triton Elastic Container Service. We run our
customer’s mission critical applications on
container native infrastructure
Private Cloud
Triton Elastic Container Infrastructure is an
on-premise, container run-time environment used
by some of the world’s most recognizable brands

127. SecurityManagement Networking IntrospectionPerformance Utilization
Public Cloud
Triton Elastic Container Service. We run our
customer’s mission critical applications on
container native infrastructure
Private DataCenter
Triton Elastic Container Infrastructure is an
on-premise, container run-time environment used
by some of the world’s most recognizable brands
it’s open source!
fork me, pull me: https://github.com/joyent/sdc

128. how do you
secure it for
So…
bare metal?

129. Container anatomy
Application
package
Runtime
environment

130. Container anatomy
Application
package
Execution
driver

131. Container anatomy
Application
package
LXC
}
Docker

132. Container anatomy
Application
package
libcontainer
}
Docker

133. Container anatomy
Application
package
appc
}
Rocket

134. Container anatomy
Application
package
runC
}
OpenContainerFoundation

135. Container anatomy
Application
package
SmartOS
Zone
}
DockeronTriton

136. can i run my
Linux images
So…
on Triton?

137. yes!

139. Demo
time

140. SecurityManagement Networking IntrospectionPerformance Utilization
thank you

141. the 7 characteristics of
container-native infrastructure
1. the unit of compute is a container
2. you provision containers
3. the containers run on bare metal
4. the containers are multi-tenant bare metal secure
5. every container gets its share
6. every container gets one or more VNICs
7. you pay for containers