The speed of containers, the security of VMs

Transcription

1 * The speed of containers, the security of VMs Xu Wang, Hyper Samuel Ortiz, Intel *Other names and brands may be claimed as the property of others.

2 Contents Project Overview Technical Details Get Involved

3 History Intel Clear Containers * May 2015 Dec 2017 *Other names and brands may be claimed as the property of others.

4 Technical Vision Light and fast VM-based containers Merge Intel Clear Containers and Hyper runv technologies Seamless integration with Kubernetes (CRI), Docker and Openstack Support multiple architectures (x86 today; others to come in the future) Support multiple hypervisors (KVM today; others to come in the future)

5 Intel Clear Containers Multi Architecture Multi Hypervisor Full Hotplug K8s Multi Tenancy VM templating Frakti native support Traffic Controller net Direct Device Assignment SRIOV NVDIMM Multi-OS KSM throttling CRI-O native support MacVTap, multi-queue net

6 Non-Technical Goals Open and vendor-neutral project All VM based containers, users and consumers under the same project Managed at the OpenStack Foundation* Independent from the OpenStack* software project *Other names and brands may be claimed as the property of others.

7 Containers in Cloud Container A Container B Container C App A App B App C Middleware A Middleware B Middleware C *Other names and brands may be claimed as the property of others. Linux* Kernel Virtual Machine Linux Kernel Server Hardware

8 Hypervisor Based Containers Container A Container B Container C App A App B App C Middleware A Middleware B Middleware C Linux Kernel A Linux Kernel B Linux Kernel C Virtual Machine Virtual Machine Virtual Machine Linux* Kernel Server Hardware Each container/pod is hypervisor isolated As secure as a VM As fast as a container Seamless integration with the container ecosystem and management layers *Other names and brands may be claimed as the property of others.

9 Isolation Speed

10 Technical Details

11 Virtual Machine I/O OCI cmd/spec Container Command Container Exec Shim Shim Runtime Container namespaces Agent grpc Proxy Hypervisor serial interface grpc grpc over Yamux *Other names and brands may be claimed as the property of others. Kernel Hypervisor

12 Virtual Machine I/O OCI cmd/spec Container Command Container Exec Container namespaces Shim Shim Runtime grpc Agent Kernel grpc Hypervisor Hypervisor VSOCK socket *Other names and brands may be claimed as the property of others.

13 Fast as a Container Create Start $ kubectl apply -f nginx.yml VM Boot Kernel Agent Start Prepare container Image Prepare Volumes hotplug

14 Small as a Container Minimize memory footprint Minimal rootfs Minimal kernel VM Template DAX/nvdimm De-duplicate memory across VMs KSM (with throttling)

15 Networking Kubernetes* Overlay Network veth pair MacVTAP Tap *Other names and brands may be claimed as the property of others. Virtual Machine Container networking namespace

16 Networking Kubernetes* Overlay Network veth pair tc mirror Tap *Other names and brands may be claimed as the property of others. Virtual Machine Container networking namespace

17 Storage 9pfs/virtio-blk 9pfs/virtio-blk Container 1 Rootfs Overlay Volume Container 2 Rootfs Overlay 9pfs/virtio-b lk Virtual Machine 9pfs/virtio-blk Volume

18 Multi-tenant Kubernetes* k8s k8s k8s container container container container container container container container VM VM VM VM VM VM VM VM VM VM VM VM IaaS *Other names and brands may be claimed as the property of others. CaaS

19 Demo: Stackube - K8S with Hard Multi-tenancy kubectl k8s Node k8s Master kube-apiserver Tenant (CRD) Network (CRD) Keystone (Tenant mgmt) Cinder (Persistent Volume) Neutron (L2 Isolated Network) kubelet frakti (runtime shim) CNI

20 What s Next? 1H 2018 Horizon 1.0 Release (parity with RunV and CC 3.0 with upgrade path) CRI integration: Frakti, CRI-O, containerd-cri OCI runtime spec support for hypervisor based containers OSV support Documented case studies

21 Get Involved

22 Contribute Code and documentation hosted on Major releases managed through Github* Projects Intel (Intel Clear Containers) & Hyper (runv) contributing initial IP Apache 2 license Slack: katacontainers.slack.com IRC: #kata-dev@freenode Mailing-list: kata-dev@lists.katacontainers.io *Other names and brands may be claimed as the property of others.

23 Where To Contribute? Role Language Upstream version Host/Guest Shim I/O and signal handling between the host and the VM Go N/A Host Proxy I/O and signal multiplexing (optional, serial connection) Go N/A Host Runtime OCI commands handling. VM, shim, and proxy startup Go N/A Host QEMU Hypervisor C 2.9 Host Agent Guest containers manager Go N/A Guest Guest Kernel Boot to systemd/boot initrd C Guest Guest image Minimal Linux root filesystem that starts the agent N/A Pick your image Guest

24 Open Governance Contributors At least one github contribution for the past 12 months Maintainers Active contributor, nominated by fellow maintainers Can merge code Architecture Committee Take high level architecture and roadmap decisions 5 seats, elected by contributors

25 Thank you!

26 Disclaimer Intel and the Intel logo are trademarks of Intel Corporation in the U.S. and/or other countries. *Other names and brands may be claimed as the property of others. Intel Corporation