Configuration Management vs. Container Automation
2 likes1,432 views
The document discusses the differences and interactions between configuration management and container automation, emphasizing lessons learned and pitfalls encountered in implementation. It highlights that while containers offer benefits like lower overhead, they come with their own challenges such as security issues and the need for collaboration between development and operations teams. The authors conclude that containers are not a replacement for configuration management, but rather a complementary approach in modern infrastructure management.
Configuration Management vs. Container Automation
- 1. Configuration Management vs. Container Automation Arnold Bechtoldt, Johannes M. Scheuermann Gent, 02.02.2016
- 2. Arnold Bechtoldt Systems Engineer @ inovex (Germany) 〉 Software-Defined Datacenters (XaaS) 〉 Infrastructure as Code 〉 Continuous Integration/Delivery 〉 High Availability & Scale-Out 〉 DevOps & Consulting 2
- 3. Johannes M. Scheuermann Student @ inovex (Germany) 〉 Software-Defined Datacenters (XaaS) 〉 Container (Docker, rkt) 〉 Orchestration (Kubernetes, Mesos) 〉 High Availability & Scale-Out 〉 OpsDev 3
- 4. 1. Motivation 2. Pitfalls & Lessons Learned 3. Use Cases 4. Conclusions 5. Q&A Agenda 4
- 5. 〉 Several backgrounds 〉 Different opinions 〉 Experience in small to large scaled enterprise environments 〉 (Some) beers and discussions 〉 Goal: Share ideas/lessons learned Motivation 5
- 6. Pitfalls & Lessons Learned
- 7. 〉 Software development „at its best“ § VCS/refactoring/pair programming/CI/CD § Code quality is important 〉 Over-Engineering (Generic Code) § KISS 〉 „Configuration Management is Legacy (OS) Management!“ § Lightweight containers (process isolation) to reduce OS management „overhead“? „Config Management sucks“ (Pitfalls) 7
- 9. 〉 „Docker is still a hype!“ § Gives you lots of opportunities § Choose your tool stack wisely § Avoid „Bing Bang“ changes 〉 Lack of well-known/established open standards § Open Container Initiative § CNI (CoreOS) vs. CNM (Docker) „Containers suck, too“ (Pitfalls) 9
- 10. 〉 „Docker security is a mess!“ § Basic understanding of cgroups/caps/ns are helpful § Physical separation! § Talk & work with your devs 〉 „Images on Docker Hub are insecure!“ § Just community contributions § Docker images are packages/artifacts, treat them like VMDK/VHD/VDI/DEB/RPM § Build your own (lightweight) (base) images § Use base images without lots of userland tools if possible (e.g. Alpine Linux) „Containers suck, too“ (Pitfalls) 10
- 11. 〉 Over-Engineered Dockerfiles („/bin/bash“) § KISS § Software/Process isolation § Replace large shell scripts with CM running outside the container 〉 Scheduling/Orchestration is a whole new area § KISS if possible § Step-by-step/Smooth migration „Containers suck, too“ (Pitfalls) 11
- 12. 12
- 13. Use Cases
- 15. 〉 Continuous integration & delivery 〉 Microservices (rapid deployment) 〉 Blue/Green Deployment (immutability) Use Cases 15
- 16. Conclusions
- 17. 〉 Containers aren‘t the holy grail, but enhance architecture 〉 Containers have lower overhead compared to VMs 〉 Containers and CM share the same problems 〉 Containers won‘t work without Dev(+)Ops cooperation 〉 Containers and CM Systems will coexist J Conclusions 17
- 22. Q&A
- 23. Arnold Bechtoldt inovex GmbH CC BY-NC-ND +ArnoldBechtoldtGER github.com/ bechtoldt arbe.io @johscheuer inovex.de +JohannesScheuermann github.com/ johscheuer youtube.com/ inovexGmbH [email protected] Johannes M. Scheuermann inovex GmbH [email protected]