GIDS 2020 - Unpacking the Container
- 1. UNPACKING THE CONTAINER A Deep Dive into Virtual Container Technology Melissa McKay @melissajmckay http://jfrog.com/shownotes
- 3. MELISSA MCKAY Developer Advocate @JFrog @melissajmckay 4
- 4. THE AGENDA • Brief History • The Container Market • What is Docker? • What is a Container? • A few Container Gotchas • Managing Images with JFrog Artifactory 5
- 5. ALL ABOUT . . . CONTAINERS 6
- 6. 7 SHARING LIMITED RESOURCES 1979 / 1982- chroot
- 7. 8 PROGRESS TOWARD VIRTUALIZATION ▪ 2000 - FreeBSD jail ▪ 2004 - Solaris Zones / snapshots ▪ 2006 - Google Process Containers / cgroups ▪ 2008 - IBM LinuX Containers (LXC) ▪ 2013 - Docker (open source!) - Google LMCTFY (open source!) ▪ 2014 - Docker trades LXC for libcontainer ▪ … more stuff happened ▪ June 2015 - Open Container Project/Initiative (OCI) ○ Runtime Specification (runtime-spec) ○ Image Specification (image-spec) ▪ … even more stuff happened and is still happening!
- 8. THE CONTAINER MARKET (according to Sysdig) 9 2017 - 45,000 Containers, 99% Docker 2018 - 90,000 Containers Fig. 1. 2018 Container Runtimes from: "2018 Docker usage report," 29 May. 2018, sysdig.com/blog/2018-docker-usage-report/. Accessed 10 Jun. 2020.
- 9. THE CONTAINER MARKET 10 2019 - 2 million Containers (includes both SaaS & on prem users) Fig. 2. 2019 Container Runtimes from: "Sysdig 2019 Container Usage Report: New Kubernetes and security insights," 29 Oct. 2019, sysdig.com/blog/sysdig-2019-container-usage-report/. Accessed 10 Jun. 2020.
- 11. 12 WHAT DO WE ACTUALLY NEED/WANT? • An isolated environment where a user/application can operate, sharing the host system’s OS/kernel without interfering with the operation of another isolated environment on the same system (a container) • A way to define a container (an image format) • A way to build an image of a container • A way to manage container images • A way to distribute/share container images • A way to create a container environment • A way to launch/run a container (a container runtime) • A way to manage the lifecycle of container instances
- 12. DOCKER, THE WHOLE PACKAGE 13 DOCKER ENGINE DOCKER IMAGE FORMAT Dockerfile docker build docker images docker rm docker push docker pull DOCKER HUB docker run docker stop docker ps
- 13. BREAKING UP THE MONOLITH 14 OCI CONTAINER RUNTIME OCI IMAGE FORMAT • Docker V2 Image Spec • runC (which used to be libcontainer... which was written by Docker) OTHERS - containerd, rkt, cri-o, Kata, etc... https://lwn.net/Articles/741897/ https://www.ianlewis.org/en/container-runtimes-part-1-introduction-container-r
- 15. CONTAINER COMPONENTS 16 TARBALL OF A FILESYSTEM LINUX FEATURES • namespaces • cgroups • Union File systems Mix these together to create and run a container! Voila! https://docs.docker.com/get-started/overview/
- 16. FILESYSTEM DETAILS 17 ... ... NOTE: On OSX, containers will actually be running in a tiny Linux VM (use screen) screen ~/Library/Containers/com.docker.docker/Data/vms/0/tty screen ~/Library/Containers/com.docker.docker/Data/vms/0/tty
- 20. CONTAINER GOTCHAS - RUNNING AS ROOT 21
- 21. CONTAINER GOTCHAS - NO CONSTRAINTS 22
- 22. CONTAINER GOTCHAS - NEVER UPDATING 23
- 23. MANAGING YOUR IMAGES - ARTIFACTORY 24
- 24. MANAGING YOUR IMAGES - XRAY 25