gVisor, Kata Containers, Firecracker, Docker: Who is Who in the Container Space?
4 likes1,771 views
The document discusses various container technologies and runtimes such as gVisor, Kata Containers, and Firecracker, outlining their architectures and use cases. It emphasizes the importance of container orchestration with Kubernetes, detailing features like scheduling, resource management, and service management. Additionally, it touches on security aspects and the evolution of container technology, urging users to consider their cloud provider and environment when selecting a runtime.
gVisor, Kata Containers, Firecracker, Docker: Who is Who in the Container Space?
- 1. gVisor, Kata Container, Firecracker, Docker Who is Who in the Container Space @joerg_schad
- 2. 2
- 3. Jörg Schad, PhD Head of Engineering and ML @ArangoDB ● Suki.ai ● Mesosphere ● Architect @SAP Hana ● PhD Distributed DB Systems ● Twitter: @joerg_schad
- 4. 4 ● Native Multi Model Database ○ Stores, K/V, Documents & Graphs ● Distributed ○ Graphs can span multiple nodes ● AQL - SQL-like multi-model query language ● ACID Transactions including Multi Collection Transactions
- 5. Databases & Container 5https://landscape.cncf.io/
- 6. ArangoDB Oasis ● Managed Service for ArangoDB ● Run many ArangoDB deployments in the cloud ○ AWS, Google, Azure, ... ● Fully managed deployments ● Security for 2020 and beyond ● Highly scalable
- 7. Some structure 7 Container Runtimes “Secure” Container
- 9. There are no containers... 9
- 10. Container Internals 10 joerg@docker-test:~$ docker exec -it 737395b89b4a bash root@737395b89b4a:/# ps aux USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND root 1 0.0 0.1 32652 5240 ? Ss 16:39 0:00 nginx: master process nginx -g daemon off; nginx 6 0.0 0.0 33108 2348 ? S 16:40 0:00 nginx: worker process root 255 1.0 0.0 18128 3168 pts/0 Ss 16:51 0:00 bash root 260 0.0 0.0 36632 2868 pts/0 R+ 16:51 0:00 ps aux x joerg@docker-test:~$ ps faux USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND message+ 26869 0.0 0.1 45248 3816 ? Ss 16:37 0:00 /usr/bin/containerd root 4491 0.0 0.1 10728 5172 ? Sl 16:39 0:00 _ containerd-shim -namespace moby -workdir /var/ root 4509 0.0 0.1 32652 5240 ? Ss 16:39 0:00 _ nginx: master process nginx -g daemon off; systemd+ 4541 0.0 0.0 33108 2348 ? S 16:40 0:00 _ nginx: worker process root 2140 0.2 1.9 550876 72948 ? Ssl 16:38 0:02 /usr/bin/dockerd -H fd:// --containerd=/ joerg 4619 0.0 0.1 64844 6184 ? Ss 16:42 0:00 /lib/systemd/systemd --user joerg 4620 0.0 0.0 84648 1684 ? S 16:42 0:00 _ (sd-pam)
- 13. Implications - JRE 8 13https://jaxenter.com/nobody-puts-java-container-139373.html
- 14. Implications - JRE 8 14https://jaxenter.com/nobody-puts-java-container-139373.html ● # of JIT compiler threads ● # Garbage Collection threads ● # of thread in the common fork-join pool ● …
- 15. © 2017 Mesosphere, Inc. All Rights Reserved. ServiceApp ServiceServiceAppApp OS 15 CONTAINERS - Rapid deployment - Dependency vendoring - Container image repositories - Spreadsheet scheduling OS OS Machine Infrastructure Machine Machine Container Runtime Container Runtime Container Runtime ServiceService ServiceServiceServiceService
- 17. Container Orchestration 17 CONTAINER SCHEDULING ● Placement ● Replication/Scaling ● Resurrection ● Rescheduling ● Rolling Deployment ● Upgrades ● Downgrades ● Collocation RESOURCE MANAGEMENT ● Memory ● CPU ● GPU ● Volumes ● Ports ● IPs ● Images/Artifacts SERVICE MANAGEMENT ● Labels ● Groups/Namespaces ● Dependencies ● Load Balancing ● Readiness Checking
- 18. © 2017 Mesosphere, Inc. All Rights Reserved. Orchestration 18 Machine Infrastructure Web Apps & Services Scheduling Resource Management Container Runtime Machine & OS Service Management CONTAINER ORCHESTRATION Machine & OS Machine & OS Container Runtime Container Runtime
- 20. Kubernetes 20 CONTAINER SCHEDULING ● Placement ● Replication/Scaling ● Resurrection ● Rescheduling ● Rolling Deployment ● Upgrades ● Downgrades ● Collocation RESOURCE MANAGEMENT ● Memory ● CPU ● GPU ● Volumes ● Ports ● IPs ● Images/Artifacts SERVICE MANAGEMENT ● Labels ● Groups/Namespaces ● Dependencies ● Load Balancing ● Readiness Checking
- 21. What Does “Kubernetes” Mean? Greek for “pilot” or “Helmsman of a ship” Image Source
- 23. Container 23
- 24. How did we end up here? 24 Container Runtimes “Secure Container
- 25. Docker 25 All-In-One Solution ● A container image format ● A method for building container images (Dockerfile/docker build) ● A way to manage container images (docker images, docker rm , etc.) ● A way to manage instances of containers (docker ps, docker rm , etc.) ● A way to share container images (docker push/pull) ● A way to run containers (docker run)
- 26. Docker Daemon 26
- 29. CRI (Container Runtime Interface) 29 https://github.com/kubernetes/cri-api/
- 30. CRI (Container Runtime Interface) 30 https://www.slideshare.net/PhilEstes/lets-try-every-cri-runtime-available-for-kubernetes
- 35. OCI (Open Container Initiative) 35 https://www.opencontainers.org/ Open industry standards around container formats and runtime ● docker run example.com/org/app:v1.0.0 ● rkt run example.com/org/app,version=v1.0.0
- 36. CRI-O 36 OCI-based implementation of CRI https://cri-o.io/
- 38. runc (libcontainer) 38 https://github.com/opencontainers/runc CLI tool for spawning and running containers - Default (low-level) runtime - Original Docker runtime - OCI project
- 39. Container-d 39https://containerd.io/ Daemon managing the complete container lifecycle - image transfer - storage - container execution - supervision - storage to network attachments and beyond.
- 42. Podman 42https://podman.io/ Daemonless container engine for running OCI containers - docker compatible alias docker=podman
- 44. Container vs VM (revisited) 44 ?
- 45. How did we end up here? 45 Container Runtimes “Secure Container
- 46. Kata Containers 46 Lightweight virtual machines - KVM Hypervisor - QEMU* VM - Kernel Samepage Merging - Overhead - Disk - Memory - CPU https://katacontainers.io/
- 48. Kata Containers & container-d 48
- 49. Firecracker 49
- 51. Firecracker 51 Minimal VM - Alternative to QEMU - only 5 emulated devices virtio-net, virtio-block, virtio-vsock, serial console, minimal keyboard controller - < 125 ms startup time - < 5 MiB memory footprint. - Needs to be specifically compiled
- 55. Nabla Containers 55 Reimplement OS in Userspace ● Library OS ● Unikernel ● Few native syscalls (secomp) ○ read, write, exit_group, clock_gettime, ppoll, pwrite64, and pread64 https://github.com/google/gvisor
- 57. GVisor 57 - User Space Kernel - Reimplement kernel in Golang - Limited sycalls to actual kernel ~ 80 - Performance impact - Network - Storage - Hardware Passthrough - GPU https://github.com/google/gvisor
- 58. runV 58https://github.com/hyperhq/runv Hypervisor based OCI runtime - Ignores certain OCI spec fields - Namespace - Capability - Device - linux and mount fields
- 60. Comparison 60 Native Container User Space Kernel Virtual Machine Fast, low overhead Reduced attack interface Safest Little isolation Limited Syscalls, special build Performance & Resource overhead
- 61. What now? 61 Container Runtime - What does your Cloud Provider Support? - What does your k8s support - Mostly Standards “Secure” Container - What environment are you running? - Multi-Tenant? - User-defined input/code? - Risk - User-data? - ….
- 63. Thanks for listening! 63 • @arangodb • https://www.arangodb.com/ docker pull arangodb Test-drive Oasis 14-days for free