High Performance Containers. Convergence of Hyperscale, Big Data and Big Compute

Transcription

1 High Performance Containers Convergence of Hyperscale, Big Data and Big Compute

2 Christian Kniep Technical Account Manager, Docker

3 Brief Recap of Container Technology

4 Brief History of Container Technology FreeBSD Jails expand on Unix chroot to isolate files 2001 Solaris Zones bring the concept of snapshots VServer Jails cgroups Zones Linux-VServer ports kernel isolation, but requires recompilation RedHat adds user namespaces, limiting root access in containers LXC Namespaces Google introduces Process Containers, merged as cgroups Container Runtime and Image Format Standards, Jeff Borek, Stephen Walli, KubeCon Dec/ Docker provides simple user tools and images. Containers go mainstream Docker IBM creates LXC providing user tools for cgroups and namespaces 2013

5 Linux Namespaces 101 Short Recap

6 Example PID Processes Isolation host sees all processes with real PID from the Kernels perspective first process within PID namespace gets PID=1 Host cnt0 cnt1 cnt2 ps -ef start.sh start.sh java -jar.. java -jar.. health.sh

7 Resource Isolation of Process Groups 7 as of Kernel MNT: Controls mount points 2. PID: Individual process table 3. NET: Network resources (IPs, routing,...) 4. IPC: Prevents the use of shared memory between processes 5. UTS: Individual host- and domain name 6. USR: Maps container UID to a different UID of the host 7. CGRP: Hides system cgroup hierarchy from container

8 Container Namespaces A starting container gets his own namespaces. But can share namespaces with other containers or even the host Host cnt0 MNT PID cnt1 NET IPC UTS cnt2 USR CGRP

9 All In When using all host namespaces - we are on the host (almost like ssh). $ docker run -ti --rm \ --privileged \ --security-opt=seccomp=unconfined \ --pid=host \ --uts=host \ --ipc=host \ --net=host \ -v /:/host \ ubuntu bash root@linuxkit :/# chroot /host / # ash /# Host cnt0 MNT PID NET IPC UTS USR CGRP

10 CGroups While namespaces isolate, Control Groups constraint resources.

11 CGroups / Filesystem Layering Short Recap [cont]

12 Overlay Filesystem Compose a FS from multiple pieces appa.jar:1.1 openjre:9-b114 ubuntu:16.04 ARG FROM openjre:9-b114 COPY appa.jar appb.jar /usr/local/bin/ CMD [ java, -jar, /usr/local/bin/appa.jar ] /usr/local/bin/appb.jar ] appb.jar FROM ubuntu:16.04 openjre:9-b117 ARG JRE_VER=9~b114-0ubuntu1 RUN apt-get update \ && apt-get install -y openjdk-9-jre-headless=${jre_ver} \ && java -version

13 Stacked View VM2 Services1 Services2 Userland Userland Kernel Kernel Userland Host Kernel Hardware Traditional Virtualization (PVM, pci-passthrough) Hypervisor VM-shortcuts Services VM1 Cnt1 Cnt2 Services appb appc Userland Userland Userland Host Kernel Hardware os-virtualization

14 Interface View From Application to Kernel lib-calls application libs application syscalls 102 kernel hypervisor libs container hypercalls 101 hw-calls kernel kernel hardware hardware Traditional Virtualization os-virtualization

15 Why apply Containers to HPC?

16 SciOps Researcher Workstation Peer Review + Collaboration HPC Compute Nodes

17 Bridging the Technology Gap Containers removing barriers of entry: Hardware Expertise Software Expertise Workflow/System Integration CapEx / OpEx

18 How are containers used in HPC today?

19 Current Solutions Lack of HPC focus gave birth to HPC workarounds. Build Ship HPC Runtimes Development Build hub.docker.com Extract File-System Store on /share Pull Image chroot /container

20 Scientific Environments Scientific end-users expect the environment to be set up for them, without prior knowledge about the specifics of the cluster. /home/ /proj/ Storage Service Cluster rank0 rank1 rank2 AI Engine Engine Engine Engine Compute Cluster

21 Service vs Batch Scheduling Traditionally container workloads are scheduled in a descriptive manner, as tasks (pods) on worker nodes. HPC schedules a workloads as a batch job on multiple nodes. manager SWARM Kubernetes Docker Engine process1 controller process2 Shared System node0 noden agent agent job-process2 job-process2 Shared System Distributed Process

22 HPC Workload Scheduler DEMO!

23 Current Solutions [cont] HPC-specific workaround + Drop-in replacement as it wraps the job - Not OCI compliance - No integration with upstream container ecosystem - hard to combine with new workloads manager controller node0 noden agent agent job-process2 job-process2 Shared System HPC-runtime

24 HPC Challenges

25 Kernel-bypassing Devices To achieve the highest performance possible the kernel got squeezed out of the equation for performance-critical parts. Application libnet Userland TCP/IP OS Kernel ETH Hardware CUDA OFED GPU IB

26 --device=/dev/nvidia0 The Stack "Devices": [{ "PathOnHost": "/dev/nvidia0", "PathInContainer": "/dev/nvidia0", Client "CgroupPermissions": "rwm" }], Engine "devices": [{ "path": "/dev/nvidia0", "type": "c", containerd "major": 195, "minor": 0,"fileMode": 8630, "uid": 0, "gid": 0 runc }, "hooks": { "prestart": [ {"path": /usr/local/bin/nvidia.sh"}]}

27 Houdini Plugin

28 Houdini Plugin [cont] DEMO!

29 HPC Opportunities

30 Leveraging HPC in the Enterprise / Enterprise in HPC HPC Workloads Security scan & sign Image Registry Traditional docker store Third Party Control Plane

31 What s next?

32 Complexity Convergence of AI and HPC non-gpu Single node, Local Storage Single Node, Shared Storage Multi Node, Shared Storage beginner intermediate advanced MPI shared file-system device passthrough a.k.a. HPC! Maturity

33 Evidence for AI/DL trends

34 Steps Low-hanging and high hanging fruit Device Passthrough Rather simple Shared File-System get UID:GID(s) from somewhere MPI enablement Engine vs. Orchestrator vs. Workload Manager: Who is in charge? including PMIx into the engine? simple batch scheduling in SWARM? Docker Ecosystem Goodies Secure Supply Chain Reproducible, OS idenpenced science

35 Docker for Science