際際滷

際際滷Share a Scribd company logo
Docker Internals
Docker Meetup, Mountain View
Rohit Jnagal
jnagal@
Containers @ Google
Containers at scale.
Resource Isolation.
lmctfy cAdvisor
libcontainer Kubernetes
Docker 101
Build Once, Configure Once.
Deploy Everything*
Everywhere*
Reliably & Consistently
Efficiently
Cheaply
Docker Components
Docker Daemon
Libcontainer
cgroups namespaces
AUFS
BTRFS
dm-thinp
VFS
KernelUserSpace
Docker Components
Docker Grounds up: Filesystem
File-system Isolation:
Building a rootfs dir and chroot into it.
With mount namespace, use pivot-root.
Features:
Layering, CoW, Caching, Diffing
Solutions:
UnionFS, Snapshotting FS, VFS
AUFS in action
Filesystem
Layer 2
Layer 1
Base Image
Writable Layer
Container
Layer 1
Base Image
Writable Layer
Container
Snapshot
Container A Container B
Writable Layer
A
Writable Layer
B
Layer 2 (e.g. Configuration)
Layer 1 (e.g. MySQL)
Base Image (e.g. Ubuntu)
S
h
a
r
e
d
P
r
i
v
Docker Grounds up: Filesystem
From: J辿r担me Petazzoni
Docker Grounds up: Namespaces
 Process trees.
 Mounts.
 Network.
 User accounts.
 Hostnames.
 Inter-process
communication.
pid_t pid = clone(..., flags, ...)
CLONE_NEWUTS hostname, domainname
CLONE_NEWIPC IPC objects
CLONE_NEWPID Process IDs
CLONE_NEWNET Network configuration
CLONE_NEWNS File system mounts
CLONE_NEWUSER User and Group IDs
setns(int fd, int nstype)
CLONE_NEWIPC
CLONE_NEWNET
CLONE_NEWUTS
Also: unshare(flags)
Docker Grounds up: Resource Isolation
Cgroups : Isolation and accounting
 cpu
 memory
 block i/o
 devices
 network
 numa
 freezer
image credit: mairin
Docker Grounds up: Add Security
Security Layers
 Linux Capabilities.
 User namespaces: Unprivileged users.
 nosuid & ro mounts.
 Seccomp-bpf
 GRSEC and PAX
 Device cgroups
 Access Control: SELinux & AppArmor
 Future: Namespace aware sys/proc
image credit: Leo Reynolds
Questions
Thanks,
jnagal@google
@jnagal

More Related Content

What's hot (20)

Dockerfile
Dockerfile Dockerfile
Dockerfile
Jeffrey Ellin
Introduction lint辿gration continue avec Jenkins
Introduction  lint辿gration continue avec JenkinsIntroduction  lint辿gration continue avec Jenkins
Introduction lint辿gration continue avec Jenkins
Eric Hogue
What Is A Docker Container? | Docker Container Tutorial For Beginners| Docker...
What Is A Docker Container? | Docker Container Tutorial For Beginners| Docker...What Is A Docker Container? | Docker Container Tutorial For Beginners| Docker...
What Is A Docker Container? | Docker Container Tutorial For Beginners| Docker...
Simplilearn
Kvm and libvirt
Kvm and libvirtKvm and libvirt
Kvm and libvirt
plarsen67
Kubernetes 101
Kubernetes 101Kubernetes 101
Kubernetes 101
Crevise Technologies
Kubernetes Introduction
Kubernetes IntroductionKubernetes Introduction
Kubernetes Introduction
Eric Gustafson
K8s in 3h - Kubernetes Fundamentals Training
K8s in 3h - Kubernetes Fundamentals TrainingK8s in 3h - Kubernetes Fundamentals Training
K8s in 3h - Kubernetes Fundamentals Training
Piotr Perzyna
An Introduction to Kubernetes
An Introduction to KubernetesAn Introduction to Kubernetes
An Introduction to Kubernetes
Imesh Gunaratne
Docker introduction & benefits
Docker introduction & benefitsDocker introduction & benefits
Docker introduction & benefits
Amit Manwade
Dockers and kubernetes
Dockers and kubernetesDockers and kubernetes
Dockers and kubernetes
Dr Ganesh Iyer
Why Docker
Why DockerWhy Docker
Why Docker
dotCloud
Docker Architecture (v1.3)
Docker Architecture (v1.3)Docker Architecture (v1.3)
Docker Architecture (v1.3)
rajdeep
Monitoring with Prometheus
Monitoring with PrometheusMonitoring with Prometheus
Monitoring with Prometheus
Shiao-An Yuan
Docker, LinuX Container
Docker, LinuX ContainerDocker, LinuX Container
Docker, LinuX Container
Araf Karsh Hamid
presentation on Docker
presentation on Dockerpresentation on Docker
presentation on Docker
Virendra Ruhela
Introduction to Kubernetes Workshop
Introduction to Kubernetes WorkshopIntroduction to Kubernetes Workshop
Introduction to Kubernetes Workshop
Bob Killen
Docker
DockerDocker
Docker
A.K.M. Ahsrafuzzaman
Kubernetes a comprehensive overview
Kubernetes   a comprehensive overviewKubernetes   a comprehensive overview
Kubernetes a comprehensive overview
Gabriel Carro
Docker Basics
Docker BasicsDocker Basics
Docker Basics
DuckDuckGo
Monitoring kubernetes with prometheus
Monitoring kubernetes with prometheusMonitoring kubernetes with prometheus
Monitoring kubernetes with prometheus
Brice Fernandes
Introduction lint辿gration continue avec Jenkins
Introduction  lint辿gration continue avec JenkinsIntroduction  lint辿gration continue avec Jenkins
Introduction lint辿gration continue avec Jenkins
Eric Hogue
What Is A Docker Container? | Docker Container Tutorial For Beginners| Docker...
What Is A Docker Container? | Docker Container Tutorial For Beginners| Docker...What Is A Docker Container? | Docker Container Tutorial For Beginners| Docker...
What Is A Docker Container? | Docker Container Tutorial For Beginners| Docker...
Simplilearn
Kvm and libvirt
Kvm and libvirtKvm and libvirt
Kvm and libvirt
plarsen67
Kubernetes Introduction
Kubernetes IntroductionKubernetes Introduction
Kubernetes Introduction
Eric Gustafson
K8s in 3h - Kubernetes Fundamentals Training
K8s in 3h - Kubernetes Fundamentals TrainingK8s in 3h - Kubernetes Fundamentals Training
K8s in 3h - Kubernetes Fundamentals Training
Piotr Perzyna
An Introduction to Kubernetes
An Introduction to KubernetesAn Introduction to Kubernetes
An Introduction to Kubernetes
Imesh Gunaratne
Docker introduction & benefits
Docker introduction & benefitsDocker introduction & benefits
Docker introduction & benefits
Amit Manwade
Dockers and kubernetes
Dockers and kubernetesDockers and kubernetes
Dockers and kubernetes
Dr Ganesh Iyer
Why Docker
Why DockerWhy Docker
Why Docker
dotCloud
Docker Architecture (v1.3)
Docker Architecture (v1.3)Docker Architecture (v1.3)
Docker Architecture (v1.3)
rajdeep
Monitoring with Prometheus
Monitoring with PrometheusMonitoring with Prometheus
Monitoring with Prometheus
Shiao-An Yuan
Docker, LinuX Container
Docker, LinuX ContainerDocker, LinuX Container
Docker, LinuX Container
Araf Karsh Hamid
presentation on Docker
presentation on Dockerpresentation on Docker
presentation on Docker
Virendra Ruhela
Introduction to Kubernetes Workshop
Introduction to Kubernetes WorkshopIntroduction to Kubernetes Workshop
Introduction to Kubernetes Workshop
Bob Killen
Kubernetes a comprehensive overview
Kubernetes   a comprehensive overviewKubernetes   a comprehensive overview
Kubernetes a comprehensive overview
Gabriel Carro
Docker Basics
Docker BasicsDocker Basics
Docker Basics
DuckDuckGo
Monitoring kubernetes with prometheus
Monitoring kubernetes with prometheusMonitoring kubernetes with prometheus
Monitoring kubernetes with prometheus
Brice Fernandes

Similar to Docker internals (20)

Docker Ecosystem on Azure
Docker Ecosystem on AzureDocker Ecosystem on Azure
Docker Ecosystem on Azure
Patrick Chanezon
Linux containers & Devops
Linux containers & DevopsLinux containers & Devops
Linux containers & Devops
Maciej Lasyk
Introduction to Docker
Introduction  to DockerIntroduction  to Docker
Introduction to Docker
Jian Wu
Dev opsec dockerimage_patch_n_lifecyclemanagement_2019
Dev opsec dockerimage_patch_n_lifecyclemanagement_2019Dev opsec dockerimage_patch_n_lifecyclemanagement_2019
Dev opsec dockerimage_patch_n_lifecyclemanagement_2019
kanedafromparis
Cloud Native Computing - Part III - Containers
Cloud Native Computing - Part III - ContainersCloud Native Computing - Part III - Containers
Cloud Native Computing - Part III - Containers
Linjith Kunnon
codemotion-docker-2014
codemotion-docker-2014codemotion-docker-2014
codemotion-docker-2014
Carlo Bonamico
Introduction to Docker storage, volume and image
Introduction to Docker storage, volume and imageIntroduction to Docker storage, volume and image
Introduction to Docker storage, volume and image
ejlp12
Why everyone is excited about Docker (and you should too...) - Carlo Bonamic...
Why everyone is excited about Docker (and you should too...) -  Carlo Bonamic...Why everyone is excited about Docker (and you should too...) -  Carlo Bonamic...
Why everyone is excited about Docker (and you should too...) - Carlo Bonamic...
Codemotion
Containerize! Between Docker and Jube.
Containerize! Between Docker and Jube.Containerize! Between Docker and Jube.
Containerize! Between Docker and Jube.
Henryk Konsek
Real-World Docker: 10 Things We've Learned
Real-World Docker: 10 Things We've Learned  Real-World Docker: 10 Things We've Learned
Real-World Docker: 10 Things We've Learned
RightScale
Docker dDessi november 2015
Docker dDessi november 2015Docker dDessi november 2015
Docker dDessi november 2015
Massimiliano Dess狸
How Secure Is Your Container? ContainerCon Berlin 2016
How Secure Is Your Container? ContainerCon Berlin 2016How Secure Is Your Container? ContainerCon Berlin 2016
How Secure Is Your Container? ContainerCon Berlin 2016
Phil Estes
Docker: Please contain your excitement
Docker: Please contain your excitementDocker: Please contain your excitement
Docker: Please contain your excitement
johnnnl
Dockers & kubernetes detailed - Beginners to Geek
Dockers & kubernetes detailed - Beginners to GeekDockers & kubernetes detailed - Beginners to Geek
Dockers & kubernetes detailed - Beginners to Geek
wiTTyMinds1
Docker navjot kaur
Docker navjot kaurDocker navjot kaur
Docker navjot kaur
Navjot Kaur
Docker and containers - Presentation 際際滷s by Priyadarshini Anand
Docker and containers - Presentation 際際滷s by Priyadarshini AnandDocker and containers - Presentation 際際滷s by Priyadarshini Anand
Docker and containers - Presentation 際際滷s by Priyadarshini Anand
PRIYADARSHINI ANAND
Hands on introduction to docker security for docker newbies
Hands on introduction to docker security for docker newbiesHands on introduction to docker security for docker newbies
Hands on introduction to docker security for docker newbies
Yigal Elefant
Docker training
Docker trainingDocker training
Docker training
Kiran Kumar
Docker for mere mortals
Docker for mere mortalsDocker for mere mortals
Docker for mere mortals
Henryk Konsek
Docker London: Container Security
Docker London: Container SecurityDocker London: Container Security
Docker London: Container Security
Phil Estes
Docker Ecosystem on Azure
Docker Ecosystem on AzureDocker Ecosystem on Azure
Docker Ecosystem on Azure
Patrick Chanezon
Linux containers & Devops
Linux containers & DevopsLinux containers & Devops
Linux containers & Devops
Maciej Lasyk
Introduction to Docker
Introduction  to DockerIntroduction  to Docker
Introduction to Docker
Jian Wu
Dev opsec dockerimage_patch_n_lifecyclemanagement_2019
Dev opsec dockerimage_patch_n_lifecyclemanagement_2019Dev opsec dockerimage_patch_n_lifecyclemanagement_2019
Dev opsec dockerimage_patch_n_lifecyclemanagement_2019
kanedafromparis
Cloud Native Computing - Part III - Containers
Cloud Native Computing - Part III - ContainersCloud Native Computing - Part III - Containers
Cloud Native Computing - Part III - Containers
Linjith Kunnon
codemotion-docker-2014
codemotion-docker-2014codemotion-docker-2014
codemotion-docker-2014
Carlo Bonamico
Introduction to Docker storage, volume and image
Introduction to Docker storage, volume and imageIntroduction to Docker storage, volume and image
Introduction to Docker storage, volume and image
ejlp12
Why everyone is excited about Docker (and you should too...) - Carlo Bonamic...
Why everyone is excited about Docker (and you should too...) -  Carlo Bonamic...Why everyone is excited about Docker (and you should too...) -  Carlo Bonamic...
Why everyone is excited about Docker (and you should too...) - Carlo Bonamic...
Codemotion
Containerize! Between Docker and Jube.
Containerize! Between Docker and Jube.Containerize! Between Docker and Jube.
Containerize! Between Docker and Jube.
Henryk Konsek
Real-World Docker: 10 Things We've Learned
Real-World Docker: 10 Things We've Learned  Real-World Docker: 10 Things We've Learned
Real-World Docker: 10 Things We've Learned
RightScale
How Secure Is Your Container? ContainerCon Berlin 2016
How Secure Is Your Container? ContainerCon Berlin 2016How Secure Is Your Container? ContainerCon Berlin 2016
How Secure Is Your Container? ContainerCon Berlin 2016
Phil Estes
Docker: Please contain your excitement
Docker: Please contain your excitementDocker: Please contain your excitement
Docker: Please contain your excitement
johnnnl
Dockers & kubernetes detailed - Beginners to Geek
Dockers & kubernetes detailed - Beginners to GeekDockers & kubernetes detailed - Beginners to Geek
Dockers & kubernetes detailed - Beginners to Geek
wiTTyMinds1
Docker navjot kaur
Docker navjot kaurDocker navjot kaur
Docker navjot kaur
Navjot Kaur
Docker and containers - Presentation 際際滷s by Priyadarshini Anand
Docker and containers - Presentation 際際滷s by Priyadarshini AnandDocker and containers - Presentation 際際滷s by Priyadarshini Anand
Docker and containers - Presentation 際際滷s by Priyadarshini Anand
PRIYADARSHINI ANAND
Hands on introduction to docker security for docker newbies
Hands on introduction to docker security for docker newbiesHands on introduction to docker security for docker newbies
Hands on introduction to docker security for docker newbies
Yigal Elefant
Docker training
Docker trainingDocker training
Docker training
Kiran Kumar
Docker for mere mortals
Docker for mere mortalsDocker for mere mortals
Docker for mere mortals
Henryk Konsek
Docker London: Container Security
Docker London: Container SecurityDocker London: Container Security
Docker London: Container Security
Phil Estes

More from Rohit Jnagal (7)

Task migration using CRIU
Task migration using CRIUTask migration using CRIU
Task migration using CRIU
Rohit Jnagal
Memory Bandwidth QoS
Memory Bandwidth QoSMemory Bandwidth QoS
Memory Bandwidth QoS
Rohit Jnagal
Cat @ scale
Cat @ scaleCat @ scale
Cat @ scale
Rohit Jnagal
Native container monitoring
Native container monitoringNative container monitoring
Native container monitoring
Rohit Jnagal
Kubernetes intro public - kubernetes meetup 4-21-2015
Kubernetes intro   public - kubernetes meetup 4-21-2015Kubernetes intro   public - kubernetes meetup 4-21-2015
Kubernetes intro public - kubernetes meetup 4-21-2015
Rohit Jnagal
Docker n co
Docker n coDocker n co
Docker n co
Rohit Jnagal
Docker Overview
Docker OverviewDocker Overview
Docker Overview
Rohit Jnagal
Task migration using CRIU
Task migration using CRIUTask migration using CRIU
Task migration using CRIU
Rohit Jnagal
Memory Bandwidth QoS
Memory Bandwidth QoSMemory Bandwidth QoS
Memory Bandwidth QoS
Rohit Jnagal
Native container monitoring
Native container monitoringNative container monitoring
Native container monitoring
Rohit Jnagal
Kubernetes intro public - kubernetes meetup 4-21-2015
Kubernetes intro   public - kubernetes meetup 4-21-2015Kubernetes intro   public - kubernetes meetup 4-21-2015
Kubernetes intro public - kubernetes meetup 4-21-2015
Rohit Jnagal
Docker Overview
Docker OverviewDocker Overview
Docker Overview
Rohit Jnagal

Recently uploaded (20)

2. KONSEP EKONOMI TEKNIK & PERANCANGAN TEKNIK.pdf
2. KONSEP EKONOMI TEKNIK & PERANCANGAN TEKNIK.pdf2. KONSEP EKONOMI TEKNIK & PERANCANGAN TEKNIK.pdf
2. KONSEP EKONOMI TEKNIK & PERANCANGAN TEKNIK.pdf
MuhammadToyeb
b29e51b5-c830-4877-a978-a6b308ea8c5f.ppt
b29e51b5-c830-4877-a978-a6b308ea8c5f.pptb29e51b5-c830-4877-a978-a6b308ea8c5f.ppt
b29e51b5-c830-4877-a978-a6b308ea8c5f.ppt
dashrimi0
How to start and then move forward in IT
How to start and then move forward in ITHow to start and then move forward in IT
How to start and then move forward in IT
Marian Marinov
optical fibres ppt on its full details.pptx
optical fibres ppt on its full details.pptxoptical fibres ppt on its full details.pptx
optical fibres ppt on its full details.pptx
sashiP
iot into applns advapplicatinns vva.pptx
iot into applns advapplicatinns vva.pptxiot into applns advapplicatinns vva.pptx
iot into applns advapplicatinns vva.pptx
sravanece1
Fault_Detection_Using_ANNs_Presentation.pptx
Fault_Detection_Using_ANNs_Presentation.pptxFault_Detection_Using_ANNs_Presentation.pptx
Fault_Detection_Using_ANNs_Presentation.pptx
JeveshMagnani
lec2cct computational cmplexity theory.pptx
lec2cct computational cmplexity theory.pptxlec2cct computational cmplexity theory.pptx
lec2cct computational cmplexity theory.pptx
Rajesh481733
CE324-Module-6-Linear Equations-Week.pptx
CE324-Module-6-Linear Equations-Week.pptxCE324-Module-6-Linear Equations-Week.pptx
CE324-Module-6-Linear Equations-Week.pptx
HannahPil2
Construction Methods and Project Management
Construction Methods and Project ManagementConstruction Methods and Project Management
Construction Methods and Project Management
HannahPil2
b29e51b5-c830-4877-a978-a6b308ea8c5f.ppt
b29e51b5-c830-4877-a978-a6b308ea8c5f.pptb29e51b5-c830-4877-a978-a6b308ea8c5f.ppt
b29e51b5-c830-4877-a978-a6b308ea8c5f.ppt
dashrimi0
Amazon Web Services (AWS) : Fundamentals
Amazon Web Services (AWS) : FundamentalsAmazon Web Services (AWS) : Fundamentals
Amazon Web Services (AWS) : Fundamentals
Hitesh Mohapatra
Engineering mini project - voice controller
Engineering mini project - voice controllerEngineering mini project - voice controller
Engineering mini project - voice controller
NRohini1
lec1.pptx smartgrid fundamental datas presentation
lec1.pptx smartgrid fundamental datas presentationlec1.pptx smartgrid fundamental datas presentation
lec1.pptx smartgrid fundamental datas presentation
PandyselviBalasubram
Development of Economical Dye Sensitized Solar Cell by Characterizing Polymer...
Development of Economical Dye Sensitized Solar Cell by Characterizing Polymer...Development of Economical Dye Sensitized Solar Cell by Characterizing Polymer...
Development of Economical Dye Sensitized Solar Cell by Characterizing Polymer...
OsamaButt23
Application of Artificial Neural Network.pptx
Application of Artificial Neural Network.pptxApplication of Artificial Neural Network.pptx
Application of Artificial Neural Network.pptx
JeveshMagnani
Material Handling : Scope , Importance, Objectives, Principles, Classificatio...
Material Handling : Scope , Importance, Objectives, Principles, Classificatio...Material Handling : Scope , Importance, Objectives, Principles, Classificatio...
Material Handling : Scope , Importance, Objectives, Principles, Classificatio...
VirajPasare
Application of Artificial Neural Networks.pdf
Application of Artificial Neural Networks.pdfApplication of Artificial Neural Networks.pdf
Application of Artificial Neural Networks.pdf
JeveshMagnani
Environmental impact assessments ppt.doc
Environmental impact assessments ppt.docEnvironmental impact assessments ppt.doc
Environmental impact assessments ppt.doc
BonsaHailu
Chapter 2.pdf Smith Chart and Impedance Matching
Chapter 2.pdf Smith Chart and Impedance MatchingChapter 2.pdf Smith Chart and Impedance Matching
Chapter 2.pdf Smith Chart and Impedance Matching
dathoang3243
Faizal E Ayyoob - Architectural and Finishing QA/QC Inspector for high end lu...
Faizal E Ayyoob - Architectural and Finishing QA/QC Inspector for high end lu...Faizal E Ayyoob - Architectural and Finishing QA/QC Inspector for high end lu...
Faizal E Ayyoob - Architectural and Finishing QA/QC Inspector for high end lu...
Faizal Ayyoob
2. KONSEP EKONOMI TEKNIK & PERANCANGAN TEKNIK.pdf
2. KONSEP EKONOMI TEKNIK & PERANCANGAN TEKNIK.pdf2. KONSEP EKONOMI TEKNIK & PERANCANGAN TEKNIK.pdf
2. KONSEP EKONOMI TEKNIK & PERANCANGAN TEKNIK.pdf
MuhammadToyeb
b29e51b5-c830-4877-a978-a6b308ea8c5f.ppt
b29e51b5-c830-4877-a978-a6b308ea8c5f.pptb29e51b5-c830-4877-a978-a6b308ea8c5f.ppt
b29e51b5-c830-4877-a978-a6b308ea8c5f.ppt
dashrimi0
How to start and then move forward in IT
How to start and then move forward in ITHow to start and then move forward in IT
How to start and then move forward in IT
Marian Marinov
optical fibres ppt on its full details.pptx
optical fibres ppt on its full details.pptxoptical fibres ppt on its full details.pptx
optical fibres ppt on its full details.pptx
sashiP
iot into applns advapplicatinns vva.pptx
iot into applns advapplicatinns vva.pptxiot into applns advapplicatinns vva.pptx
iot into applns advapplicatinns vva.pptx
sravanece1
Fault_Detection_Using_ANNs_Presentation.pptx
Fault_Detection_Using_ANNs_Presentation.pptxFault_Detection_Using_ANNs_Presentation.pptx
Fault_Detection_Using_ANNs_Presentation.pptx
JeveshMagnani
lec2cct computational cmplexity theory.pptx
lec2cct computational cmplexity theory.pptxlec2cct computational cmplexity theory.pptx
lec2cct computational cmplexity theory.pptx
Rajesh481733
CE324-Module-6-Linear Equations-Week.pptx
CE324-Module-6-Linear Equations-Week.pptxCE324-Module-6-Linear Equations-Week.pptx
CE324-Module-6-Linear Equations-Week.pptx
HannahPil2
Construction Methods and Project Management
Construction Methods and Project ManagementConstruction Methods and Project Management
Construction Methods and Project Management
HannahPil2
b29e51b5-c830-4877-a978-a6b308ea8c5f.ppt
b29e51b5-c830-4877-a978-a6b308ea8c5f.pptb29e51b5-c830-4877-a978-a6b308ea8c5f.ppt
b29e51b5-c830-4877-a978-a6b308ea8c5f.ppt
dashrimi0
Amazon Web Services (AWS) : Fundamentals
Amazon Web Services (AWS) : FundamentalsAmazon Web Services (AWS) : Fundamentals
Amazon Web Services (AWS) : Fundamentals
Hitesh Mohapatra
Engineering mini project - voice controller
Engineering mini project - voice controllerEngineering mini project - voice controller
Engineering mini project - voice controller
NRohini1
lec1.pptx smartgrid fundamental datas presentation
lec1.pptx smartgrid fundamental datas presentationlec1.pptx smartgrid fundamental datas presentation
lec1.pptx smartgrid fundamental datas presentation
PandyselviBalasubram
Development of Economical Dye Sensitized Solar Cell by Characterizing Polymer...
Development of Economical Dye Sensitized Solar Cell by Characterizing Polymer...Development of Economical Dye Sensitized Solar Cell by Characterizing Polymer...
Development of Economical Dye Sensitized Solar Cell by Characterizing Polymer...
OsamaButt23
Application of Artificial Neural Network.pptx
Application of Artificial Neural Network.pptxApplication of Artificial Neural Network.pptx
Application of Artificial Neural Network.pptx
JeveshMagnani
Material Handling : Scope , Importance, Objectives, Principles, Classificatio...
Material Handling : Scope , Importance, Objectives, Principles, Classificatio...Material Handling : Scope , Importance, Objectives, Principles, Classificatio...
Material Handling : Scope , Importance, Objectives, Principles, Classificatio...
VirajPasare
Application of Artificial Neural Networks.pdf
Application of Artificial Neural Networks.pdfApplication of Artificial Neural Networks.pdf
Application of Artificial Neural Networks.pdf
JeveshMagnani
Environmental impact assessments ppt.doc
Environmental impact assessments ppt.docEnvironmental impact assessments ppt.doc
Environmental impact assessments ppt.doc
BonsaHailu
Chapter 2.pdf Smith Chart and Impedance Matching
Chapter 2.pdf Smith Chart and Impedance MatchingChapter 2.pdf Smith Chart and Impedance Matching
Chapter 2.pdf Smith Chart and Impedance Matching
dathoang3243
Faizal E Ayyoob - Architectural and Finishing QA/QC Inspector for high end lu...
Faizal E Ayyoob - Architectural and Finishing QA/QC Inspector for high end lu...Faizal E Ayyoob - Architectural and Finishing QA/QC Inspector for high end lu...
Faizal E Ayyoob - Architectural and Finishing QA/QC Inspector for high end lu...
Faizal Ayyoob

Docker internals

  • 1. Docker Internals Docker Meetup, Mountain View Rohit Jnagal
  • 2. jnagal@ Containers @ Google Containers at scale. Resource Isolation. lmctfy cAdvisor libcontainer Kubernetes
  • 3. Docker 101 Build Once, Configure Once. Deploy Everything* Everywhere* Reliably & Consistently Efficiently Cheaply
  • 4. Docker Components Docker Daemon Libcontainer cgroups namespaces AUFS BTRFS dm-thinp VFS KernelUserSpace
  • 6. Docker Grounds up: Filesystem File-system Isolation: Building a rootfs dir and chroot into it. With mount namespace, use pivot-root. Features: Layering, CoW, Caching, Diffing Solutions: UnionFS, Snapshotting FS, VFS AUFS in action
  • 7. Filesystem Layer 2 Layer 1 Base Image Writable Layer Container Layer 1 Base Image Writable Layer Container Snapshot Container A Container B Writable Layer A Writable Layer B Layer 2 (e.g. Configuration) Layer 1 (e.g. MySQL) Base Image (e.g. Ubuntu) S h a r e d P r i v
  • 8. Docker Grounds up: Filesystem From: J辿r担me Petazzoni
  • 9. Docker Grounds up: Namespaces Process trees. Mounts. Network. User accounts. Hostnames. Inter-process communication. pid_t pid = clone(..., flags, ...) CLONE_NEWUTS hostname, domainname CLONE_NEWIPC IPC objects CLONE_NEWPID Process IDs CLONE_NEWNET Network configuration CLONE_NEWNS File system mounts CLONE_NEWUSER User and Group IDs setns(int fd, int nstype) CLONE_NEWIPC CLONE_NEWNET CLONE_NEWUTS Also: unshare(flags)
  • 10. Docker Grounds up: Resource Isolation Cgroups : Isolation and accounting cpu memory block i/o devices network numa freezer image credit: mairin
  • 11. Docker Grounds up: Add Security Security Layers Linux Capabilities. User namespaces: Unprivileged users. nosuid & ro mounts. Seccomp-bpf GRSEC and PAX Device cgroups Access Control: SELinux & AppArmor Future: Namespace aware sys/proc image credit: Leo Reynolds