Docker 1.11 Meetup: Containerd and runc, by Arnaud Porterie and Michael Crosby

•

1 gostou•119 visualizações

In this talk, Michal Crosby will present on runC and Containerd, the internals and how they work together to start and manage containers in Docker. Afterwards, Arnaud Porterie will touch on about what was shipped in 1.11 and how it will enable some of the things we are working on for 1.12.

Tecnologia

Wifi: DockerGuest
Password: containyourself

What is containerd?
• It is a runc multiplexer
• Manages container lifecycle operations
– signal
– pause/resume
– events
3

Why build it?
• Decouple container lifecycle/execution management from Docker
• Small and fast
• runc integration
4

How is it built?
5
• Lock-free Events
– start
– signal
– exit
– SIGCHLD

How is it built?
6
• Concurrency
– 200 containers + 200 workers = 54.5/s
– 200 containers + 10 workers = 71.2/s

How is it built?
7
• containerd-shim
– daemonless containers
– 1 shim per container
– report exit status
• fifos for STDIO
• reparent to system init

Docker 1.11
… and a glimpse of the future

Docker 1.11
• Relies entirely on containerd / runC for execution
– No more direct dependency on libcontainer
– Docker alone isn’t capable of running containers anymore ¯_(ツ)_/¯
• What does it mean for the user?
– Short answer: right now, nothing
– Still pretty cool!
9

Docker 1.11
10
Docker Engine
> _
containerd
runC
shim
runC
shim
runC
shim
runC
shim

Docker 1.11
• Focus on correctness
– No regressions on the runtime
– Without performance degradation
• Introduce the new binaries
• A first look at the new features this will enable
11
# ls -lah /usr/local/bin/docker*
-rwxr-xr-x 1 root root 34M Apr 23 03:13 /usr/bin/docker
-rwxr-xr-x 1 root root 14M Apr 23 03:12 /usr/bin/docker-containerd
-rwxr-xr-x 1 root root 11M Apr 23 03:12 /usr/bin/docker-containerd-ctr
-rwxr-xr-x 1 root root 7.0M Apr 23 03:12 /usr/bin/docker-containerd-shim
-rwxr-xr-x 1 root root 9.1M Apr 23 03:11 /usr/bin/docker-runc

Choosing your execution backend
• Before: Docker had a hardcoded set of supported “execution drivers”
• Future plans
– Specify your execution backend on a per-container basis
– E.g., `docker run --exec-driver=custom redis`
• A whole ecosystem of OCI-compliant backends
– runV, a hypervisor-based runtime
– runZ, an ongoing effort from Oracle based on Solaris Zones
– Clear Containers, an Intel project based on a lightweight hypervisor
12

Choosing your execution backend
13
Docker Engine
> _
containerd
runC
shim
runX
shim
runY
shim
runZ
shim

Resilience
• Container lifecycle should be independent of the daemon
– Ultimate goal: Docker should never decide on stopping a container
• Not there yet, but we’re getting closer!
14

Resilience
15
Docker Engine
> _
containerd
runC
shim
runC
shim
runC
shim
runC
shim

Resilience
16
> _
containerd
runC
shim
runC
shim
runC
shim
runC
shim
Docker Engine

Resilience
17
Docker Engine
> _
runC
shim
runC
shim
runC
shim
runC
shim
containerd

Mais conteúdo relacionado

Mais procurados

Pipework: Software-Defined Network for Containers and DockerJérôme Petazzoni

Weave Networking on DockerStylight

Docker Container: isolation and security宇傅

CoreOS introduction - Johann RomefortStylight

CoreOS IntroIsaac Johnston

VyOS Users Meeting #2, VyOSのVXLANの話upaa

Docker NetworkingWeaveworks

Introction to docker swarmHsi-Kai Wang

Understanding docker networkingLorenzo Fontana

Docker meetupsyed1

Containerd: Building a Container Supervisor by Michael CrosbyDocker, Inc.

Docker Network Overview and legacy "--link"Avash Mulmi

Docker Networking with New Ipvlan and Macvlan DriversBrent Salisbury

Small, Simple, and Secure: Alpine Linux under the MicroscopeDocker, Inc.

青云CoreOS虚拟机部署kubernetes Zhichao Liang

Docker Networking & Swarm Mode IntroductionPhi Huynh

Consul and docker swarm clusterEueung Mulyana

Install ovs on local pcApplistarVN

Deep dive in Docker Overlay NetworksLaurent Bernaille

Building a network emulator with Docker and Open vSwitchGoran Cetusic

Mais procurados (20)

Pipework: Software-Defined Network for Containers and Docker

Weave Networking on Docker

Docker Container: isolation and security

CoreOS introduction - Johann Romefort

CoreOS Intro

VyOS Users Meeting #2, VyOSのVXLANの話

Docker Networking

Introction to docker swarm

Understanding docker networking

Docker meetup

Containerd: Building a Container Supervisor by Michael Crosby

Docker Network Overview and legacy "--link"

Docker Networking with New Ipvlan and Macvlan Drivers

Small, Simple, and Secure: Alpine Linux under the Microscope

青云CoreOS虚拟机部署kubernetes

Docker Networking & Swarm Mode Introduction

Consul and docker swarm cluster

Install ovs on local pc

Deep dive in Docker Overlay Networks

Building a network emulator with Docker and Open vSwitch

Destaque

Creatividad infantilstephanie_saa21

2014-15 Year In ReviewJacara Jenkins

Deber de computaciónAriRoman21

Cosmetic mirrorRachel Han

Correo electrónicoAntonio Narvaez

4CORNERS ALLIANCE GROUPLedile R Tshwane

Master thesis Report No E 2008 124Niklas Johansson

Docker swarm-mike-goelzer-mv-meetup-45min-workshop 02242016 (1)Michelle Antebi

Earth Retaining Stabilizing StructuresThangavadivel Thanujan

Simbolos estructural Mapinfo5Tomas Reategui

Why UI Developers Love GraphQL - Sashko Stubailo, Apollo/MeteorJon Wong

Destaque (11)

Creatividad infantil

2014-15 Year In Review

Deber de computación

Cosmetic mirror

Correo electrónico

4CORNERS ALLIANCE GROUP

Master thesis Report No E 2008 124

Docker swarm-mike-goelzer-mv-meetup-45min-workshop 02242016 (1)

Earth Retaining Stabilizing Structures

Simbolos estructural Mapinfo5

Why UI Developers Love GraphQL - Sashko Stubailo, Apollo/Meteor

Semelhante a Docker 1.11 Meetup: Containerd and runc, by Arnaud Porterie and Michael Crosby

The State of Linux Containersinside-BigData.com

ExpoQA 2017 Using docker to build and test in your laptop and JenkinsElasTest Project

HLayer / Docker and its ecosystemAymen EL Amri

Docker+javaDPC Consulting Ltd

Docker PresentationAdhoura Academy

Using Docker with OpenStack - Hands On!Adrian Otto

Dockers zero to heroNicolas De Loof

Introduction to automated environment management with Docker Containers - for...Lucas Jellema

Docker 1.11 PresentationSreenivas Makam

Ippevent : openshift Introductionkanedafromparis

Docker Container SecuritySuraj Khetani

Demystifying the Nuts & Bolts of Kubernetes ArchitectureAjeet Singh Raina

Detailed Introduction To Dockernklmish

Linux Containers & DockerJumping Bean

Introduction to Docker at the Azure Meet-up in New YorkJérôme Petazzoni

Docker Athens: Docker Engine Evolution & Containerd Use CasesPhil Estes

Live Container Migration: OpenStack Summit Barcelona 2016Phil Estes

Everything you need to know about DockerAlican Akkuş

Develop with linux containers and dockerFabio Fumarola

Docker Workshop - Orchestrating Docker ContainersHugo Henley

Semelhante a Docker 1.11 Meetup: Containerd and runc, by Arnaud Porterie and Michael Crosby (20)

The State of Linux Containers

ExpoQA 2017 Using docker to build and test in your laptop and Jenkins

HLayer / Docker and its ecosystem

Docker+java

Docker Presentation

Using Docker with OpenStack - Hands On!

Dockers zero to hero

Introduction to automated environment management with Docker Containers - for...

Docker 1.11 Presentation

Ippevent : openshift Introduction

Docker Container Security

Demystifying the Nuts & Bolts of Kubernetes Architecture

Detailed Introduction To Docker

Linux Containers & Docker

Introduction to Docker at the Azure Meet-up in New York

Docker Athens: Docker Engine Evolution & Containerd Use Cases

Live Container Migration: OpenStack Summit Barcelona 2016

Everything you need to know about Docker

Develop with linux containers and docker

Docker Workshop - Orchestrating Docker Containers

Último

Digital Identity is Under Attack: FIDO Paris Seminar.pptxLoriGlavin3

SALESFORCE EDUCATION CLOUD | FEXLE SERVICESmohitsingh558521

Commit 2024 - Secret Management made easyAlfredo García Lavilla

How to write a Business Continuity PlanDatabarracks

"Debugging python applications inside k8s environment", Andrii SoldatenkoFwdays

"ML in Production",Oleksandr BaganFwdays

Hyperautomation and AI/ML: A Strategy for Digital Transformation Success.pdfPrecisely

The Fit for Passkeys for Employee and Consumer Sign-ins: FIDO Paris Seminar.pptxLoriGlavin3

Advanced Computer Architecture – An IntroductionDilum Bandara

Nell’iperspazio con Rocket: il Framework Web di Rust!Commit University

Connect Wave/ connectwave Pitch Deck PresentationSlibray Presentation

DSPy a system for AI to Write Prompts and Do Fine TuningLars Bell

New from BookNet Canada for 2024: BNC CataList - Tech Forum 2024BookNet Canada

Use of FIDO in the Payments and Identity Landscape: FIDO Paris Seminar.pptxLoriGlavin3

SIP trunking in Janus @ Kamailio World 2024Lorenzo Miniero

What is DBT - The Ultimate Data Build Tool.pdfMounikaPolabathina

Unraveling Multimodality with Large Language Models.pdfAlex Barbosa Coqueiro

The Role of FIDO in a Cyber Secure Netherlands: FIDO Paris Seminar.pptxLoriGlavin3

Streamlining Python Development: A Guide to a Modern Project SetupFlorian Wilhelm

The State of Passkeys with FIDO Alliance.pptxLoriGlavin3

Docker 1.11 Meetup: Containerd and runc, by Arnaud Porterie and Michael Crosby

1. Wifi: DockerGuest Password: containyourself

2. Containerd Internals

3. What is containerd? • It is a runc multiplexer • Manages container lifecycle operations – signal – pause/resume – events 3

4. Why build it? • Decouple container lifecycle/execution management from Docker • Small and fast • runc integration 4

5. How is it built? 5 • Lock-free Events – start – signal – exit – SIGCHLD

6. How is it built? 6 • Concurrency – 200 containers + 200 workers = 54.5/s – 200 containers + 10 workers = 71.2/s

7. How is it built? 7 • containerd-shim – daemonless containers – 1 shim per container – report exit status • fifos for STDIO • reparent to system init

8. Docker 1.11 … and a glimpse of the future

9. Docker 1.11 • Relies entirely on containerd / runC for execution – No more direct dependency on libcontainer – Docker alone isn’t capable of running containers anymore ¯_(ツ)_/¯ • What does it mean for the user? – Short answer: right now, nothing – Still pretty cool! 9

10. Docker 1.11 10 Docker Engine > _ containerd runC shim runC shim runC shim runC shim

11. Docker 1.11 • Focus on correctness – No regressions on the runtime – Without performance degradation • Introduce the new binaries • A first look at the new features this will enable 11 # ls -lah /usr/local/bin/docker* -rwxr-xr-x 1 root root 34M Apr 23 03:13 /usr/bin/docker -rwxr-xr-x 1 root root 14M Apr 23 03:12 /usr/bin/docker-containerd -rwxr-xr-x 1 root root 11M Apr 23 03:12 /usr/bin/docker-containerd-ctr -rwxr-xr-x 1 root root 7.0M Apr 23 03:12 /usr/bin/docker-containerd-shim -rwxr-xr-x 1 root root 9.1M Apr 23 03:11 /usr/bin/docker-runc

12. Choosing your execution backend • Before: Docker had a hardcoded set of supported “execution drivers” • Future plans – Specify your execution backend on a per-container basis – E.g., `docker run --exec-driver=custom redis` • A whole ecosystem of OCI-compliant backends – runV, a hypervisor-based runtime – runZ, an ongoing effort from Oracle based on Solaris Zones – Clear Containers, an Intel project based on a lightweight hypervisor 12

13. Choosing your execution backend 13 Docker Engine > _ containerd runC shim runX shim runY shim runZ shim

14. Resilience • Container lifecycle should be independent of the daemon – Ultimate goal: Docker should never decide on stopping a container • Not there yet, but we’re getting closer! 14

15. Resilience 15 Docker Engine > _ containerd runC shim runC shim runC shim runC shim

16. Resilience 16 > _ containerd runC shim runC shim runC shim runC shim Docker Engine

17. Resilience 17 Docker Engine > _ runC shim runC shim runC shim runC shim containerd

18. THANK YOU