1.
Rise of the Machine Images
Immutable
Infrastructure
@axelfontaine

2.
InfoQ.com: News & Community Site
• 750,000 unique visitors/month
• Published in 4 languages (English, Chinese, Japanese and Brazilian
Portuguese)
• Post content from our QCon conferences
• News 15-20 / week
• Articles 3-4 / week
• Presentations (videos) 12-15 / week
• Interviews 2-3 / week
• Books 1 / month
Watch the video with slide
synchronization on InfoQ.com!
http://www.infoq.com/presentations
/immutable-infrastructure

3.
Purpose of QCon
- to empower software development by facilitating the spread of
knowledge and innovation
Strategy
- practitioner-driven conference designed for YOU: influencers of
change and innovation in your teams
- speakers and topics driving the evolution and innovation
- connecting and catalyzing the influencers and innovators
Highlights
- attended by more than 12,000 delegates since 2007
- held in 9 cities worldwide
Presented at QCon London
www.qconlondon.com

4.
About Axel Fontaine
• Founder and CEO of Boxfuse
• Over 15 years industry experience
• Continuous Delivery expert
• Regular speaker at tech conferences
• JavaOne RockStar
@axelfontaine

5.
flywaydb.org

6.
boxfuse.com

7.
about
questions

8.
sometime in the 20th century …

9.
http://en.wikipedia.org/wiki/File:Tdkc60cassette.jpg

10.
+=ON
PREM
+
Challenges
 Power
 Network
 Cooling
 Phys. Security
 Phys. Space
 OS Install
 OS Patching
 App Install
 App Updates
 Procurement
 Vendor Mgmt
 Capacity Plan.
 Financing

11.
+=ON
PREM
+
Challenges
 Power
 Network
 Cooling
 Phys. Security
 Phys. Space
 OS Install
 OS Patching
 App Install
 App Updates
 Procurement
 Vendor Mgmt
 Capacity Plan.
 Financing

12.
+=ON
PREM
+
Challenges
 Power
 Network
 Cooling
 Phys. Security
 Phys. Space
 OS Install
 OS Patching
 App Install
 App Updates
 Procurement
 Vendor Mgmt
 Capacity Plan.
 Financing
MonthsHours Days or Weeks

13.
+= +
Challenges
 Power
 Network
 Cooling
 Phys. Security
 Phys. Space
 OS Install
 OS Patching
 App Install
 App Updates
 Procurement
 Vendor Mgmt
 Capacity Plan.
 Financing
MonthsHours Days or Weeks
COLO

14.
+= +
Challenges
 OS Install
 OS Patching
 App Install
 App Updates
 Procurement
 Vendor Mgmt
 Capacity Plan.
 Financing
Hours Days or Weeks
ROOT
SERVER

15.
 OS Install
 OS Patching
 App Install
 App Updates
Let’s talk about software

16.
POLL:
which level of automation are you at?
 Build
 Unit Tests
 Continuous Integration
 Acceptance Tests
 Continuous Deployment (Code)
 Continuous Deployment (Code + DB + Configuration)
 Infrastructure

17.
Build Test

18.
Build Test

19.
• One immutable unit
• Regenerated after every change
• Promoted from Environment to Environment
Classic Mistake: Build per Environment

20.
OS Kernel
Libraries
Language
App Server
App

21.
OS Kernel
Libraries
Language
App Server
App

22.
why aren’t we doing the same
for the layers this is running on ???

23.
OS Kernel
Libraries
Language
App Server
App
Build Test

24.
OS Kernel
Libraries
Language
App Server
App
Build Test
App

25.
OS Kernel
Libraries
Language
App Server
App
OS Kernel
Libraries
Language
App Server
App
OS Kernel
Libraries
Language
App Server
App
Any difference is a potential source of errors

26.
OS Kernel
Libraries
Language
App Server
App
OS Kernel
Libraries
Language
App Server
App
OS Kernel
Libraries
Language
App Server
App
Updates UpdatesUpdates
Sysadmin

27.
If I had asked my
customers what they
wanted they would have
said a faster horse.
Henry Ford

28.
OS Kernel
Libraries
Language
App Server
App
OS Kernel
Libraries
Language
App Server
App
OS Kernel
Libraries
Language
App Server
App
Updates UpdatesUpdates
Sysadmin

29.
OS Kernel
Libraries
Language
App Server
App
OS Kernel
Libraries
Language
App Server
App
OS Kernel
Libraries
Language
App Server
App
Updates UpdatesUpdates
Automated
Sysadmin

30.
fast forward to 2016 …

31.
Every day, AWS adds
enough server capacity
to power the whole $7B
enterprise Amazon.com
was in 2004.
Weekends included.

32.
Shift to a world of abundance
(no more resource scarcity)

33.
"Advanced Test Reactor" by Argonne National Laboratory -
originally posted to Flickr as Advanced Test Reactor core,
Idaho National LaboratoryUploaded using F2ComButton.
Licensed under CC BY-SA 2.0 via Wikimedia Commons -
http://commons.wikimedia.org/wiki/File:Advanced_Test_Reac
tor.jpg#mediaviewer/File:Advanced_Test_Reactor.jpg
"RIAN archive 341194 Kursk Nuclear Power Plant" by RIA
Novosti archive, image #341194 / Sergey Pyatakov / CC-BY-SA
3.0. Licensed under CC BY-SA 3.0 via Wikimedia Commons -
http://commons.wikimedia.org/wiki/File:RIAN_archive_341194_
Kursk_Nuclear_Power_Plant.jpg#mediaviewer/File:RIAN_archi
ve_341194_Kursk_Nuclear_Power_Plant.jpg
Control Plane Data Plane

34.
Control Plane Data Plane

35.
Automated
Provisioning
Cost-driven
Architectures

36.
it is time to rethink the faster horse

37.
App
OS Kernel
Libraries
Language
App Server
Build Test

38.
App
OS Kernel
Libraries
Language
App Server
Build Test
Undifferentiated
Heavy lifting

39.
App
OS Kernel
Libraries
Language
App Server
Build Test

40.
App
Machine
Image
OS Kernel
Libraries
Language
App Server
Build Test
Machine
Image

41.
OS Kernel
Libraries
Language
App Server
App
OS Kernel
Libraries
Language
App Server
App
OS Kernel
Libraries
Language
App Server
App
Machine
Image
Machine
Image
Machine
Image

42.
Machine
Image
Machine
Image
Machine
Image
Updates

43.
but there is one big problem left …

44.
Machine
Image
Network Cable

45.
Machine
Image
Network Cable
Multiple
GB

46.
Running servers in
production should be like
going backpacking. You
take the bare minimum
with you. Anything else
is going to hurt.
A Wise Man

47.
what is really adding business value ???

48.
Machine
Image
Network Cable

49.
Editors
Daemons OS Kernel
Libraries
Utilities
Drivers
App
App Server
Package Mgr
Compilers
SSH
Firewall
Compatibility
Man Pages
Language
Log Files
Users
Shells
Machine
Image
Network Cable

50.
OS Kernel
Libraries
App
App Server
Language
Bootable
App

51.
15
MB

52.
Multiple
GB
15
MB

53.
Network Cable
Bootable
App

54.
who is this for ???

55.
OS Kernel
Libraries
Language
App Server
App
12-factor app

56.
demo

57.
What are the implications ???

58.
Focus shift
Individual instances become disposable
Instance Service

59.
Treat servers like cattle instead of pets

60.
for servers is dead!

61.
high uptime is a liability
The longer an instance is up,
the harder it becomes to recreate exactly
(and it will fail eventually!)

62.
How to solve service discovery ?
Use a stable
entry point
with an
internal registry
? Elastic
Load
Balancer
Instance
Instance
Instance

63.
What about security ?
When was the last time your toaster got hacked?

64.
What about security ?
Complexity is the Enemy of Security

65.
What about security ?
• Smallest possible attack surface
• Vastly reduced implications due to low
uptime and transient nature of instances
• Very difficult to exploit other systems
because essential tooling is missing
Bootable
App

66.
• Bake as much configuration as
possible for all environments
directly in the Bootable App
• Use environment detection
and auto-configuration
what about configuration ???

67.
Bootable
App
Key Value
JDBC_URL jdbc:…
ENV prod
what about configuration ???
• Bake as much configuration as
possible for all environments
directly in the Bootable App
• Use environment detection
and auto-configuration
• Pass remaining configuration
at startup and expose it as
environment variables

68.
Instance
what about the database ???
• Keep all persistent state out of the instance,
including the database
• Use one of the many good hosted solutions
available like Amazon RDS or Google Cloud SQL
• Use a database migration tool to update the
schema on application startup

69.
what about the logs ???
LOG
file
LOG
file
LOG
file
ssh me@myserver1
tail -f server.log
ssh me@myserver2
tail -f server.log
ssh me@myserver3
tail -f server.log

70.
LOG
file
LOG
file
LOG
file log server
where logs can be
• aggregated
• stored and backuped
• indexed
• searched

71.
what about sessions ???
Keep session in an encrypted and signed cookie
• avoids session timeouts
• avoids server clustering & session replication
• avoids sticky sessions & server affinity
Instance

72.
what about rolling out new versions ???

73.
Availability Zone 2
Load
Balancer
Logs
Availability Zone 1
App
V1
App
V1

74.
Load
Balancer
Logs
Availability Zone 1
App
V1
App
V1
Availability Zone 2

75.
Load
Balancer
Logs
Availability Zone 1
App
V1
App
V1
App
V2
App
V2
Availability Zone 2

76.
Load
Balancer
Logs
Availability Zone 1
Availability Zone 2
App
V1
App
V1
App
V2
App
V2

77.
what about containers ???
(as in OS-level virtualization)

78.
understanding modern CPUs
Both Intel and AMD have
hardware support for virtualization
• isolation
• performance penalty

79.
Image
Hardware
Hypervisor
Image
Hardware
OS+Container
Runtime
ContainerVM
on prem
your
responsibility

80.
Image
Hardware
Hypervisor
Image
Hardware
OS+Container
Runtime
ContainerVM
cloud
Hypervisor

81.
cloud
your
responsibility
cloud
responsibilityinstance
scheduling
machine
images
instances instance
volumes
instance
networking
container
scheduling
container
images
containers container
volumes
container
networking

82.
1.5 months of t2.nano

83.
1 hour of t2.nano

84.
cloud
your
responsibility
cloud
responsibilityinstance
scheduling
machine
images
instances instance
volumes
instance
networking
container
scheduling
container
images
containers container
volumes
container
networking
Only makes sense if
you cannot afford
0.5p/hour
granularity

85.
summary

86.
• One immutable unit
• Regenerated after every change
• Promoted from Environment to Environment
Classic Mistake: Build per Environment

87.
Bootable
App
• One immutable unit
• Regenerated after every change
• Promoted from Environment to Environment
• Use Minimal Images
• Focus on Cost in your architecture
Classic Mistake: Build per Environment

88.
boxfuse.com

89.
Thanks

90.
AXEL FONTAINE
@axelfontaine
boxfuse.com
I'LL BE BACK

91.
Watch the video with slide synchronization on
InfoQ.com!
http://www.infoq.com/presentations/immutable-
infrastructure