Kata Containers The way to run virtualized containers. Sebastien Boeuf, Linux Software Engineer Intel Corporation

Transcription

1 Kata Containers The way to run virtualized containers Sebastien Boeuf, Linux Software Engineer Intel Corporation

2

3 Containers 101 Process Process Process namespaces namespaces namespaces Host Linux kernel CPU Memory Network Storage

4 Software is not enough! Process Process Process namespaces namespaces namespaces Host Linux kernel CPU Memory Network Storage

5

6 Manual isolation Process Process Process Process Process Process namespaces namespaces namespaces namespaces namespaces namespaces Linux kernel Linux kernel Baremetal server

7

8 Kata Containers legacy Intel Clear Containers * May 2015 Dec 2017 *Other names and brands may be claimed as the property of others.

9 Kata Containers 101 Process Process Process namespaces namespaces namespaces Guest Linux kernel Guest Linux kernel Guest Linux kernel HW virtualization HW virtualization HW virtualization Host Linux kernel

10

11 Container ecosystem OpenStack Docker OCI runc Process Container

12 Container ecosystem Kubernetes CRI OCI runc Process Container

13 Container ecosystem OpenStack Kubernetes Docker CRI OCI runc Process Container

14 Seamless integration OpenStack Kubernetes Docker CRI Process OCI kata-runtime Container Guest Linux kernel

15 Architecture OCI command I/O Shim Shim Runtime Agent proc proc ns ns Guest Linux kernel grpc grpc Proxy Hypervisor grpc over Yamux Hypervisor serial interface

16

17 Architecture over VSOCK I/O OCI command Shim Shim Runtime Agent proc proc ns ns Guest Linux kernel grpc grpc Hypervisor Hypervisor VSOCK interface

18 OCI lifecycle

19 OCI Lifecycle - run kata-runtime run Runtime

20 OCI Lifecycle - run Runtime Guest Linux kernel Start Hypervisor

21 OCI Lifecycle - run Runtime Agent Guest Linux kernel listen to serial Hypervisor

22 OCI Lifecycle - run Runtime Start proxy Proxy Agent Guest Linux kernel Hypervisor

23 OCI Lifecycle - run Runtime Agent Guest Linux kernel Proxy connect Hypervisor

24 OCI Lifecycle - run Runtime Agent Guest Linux kernel connection established Proxy Hypervisor

25 OCI Lifecycle - run proc Runtime run container Proxy Agent ns Guest Linux kernel Hypervisor

26 OCI Lifecycle - run proc Shim start shim Runtime Agent ns Guest Linux kernel Proxy Hypervisor

27 OCI Lifecycle - run I/O Signals proc Shim Agent ns Guest Linux kernel Proxy Hypervisor

28 OCI Lifecycle - exec I/O Signals kata-runtime exec proc Shim Runtime Agent ns Guest Linux kernel Proxy Hypervisor

29 OCI Lifecycle - exec I/O proc Shim Runtime Agent proc ns Guest Linux kernel exec process Proxy Hypervisor

30 OCI Lifecycle - exec I/O proc Shim Shim Runtime Agent proc ns start shim Guest Linux kernel Proxy Hypervisor

31 OCI Lifecycle - exec I/O proc Shim Shim Agent proc ns Guest Linux kernel Proxy Hypervisor

32 More than just OCI Native CRI frakti OCI runtime kata-runtime Kata API Hypervisor Qemu K Xen Network Device CNM CNI block MACV TAP TC mirror SR-IOV Storage vfio block 9p virtcontainers

33

34 OCI compatibility Agent kata-runtime OCI spec libcontainer

35 Lightweight - NVDIMM/DAX 1 2 Guest kernel Guest kernel DAX DAX NVDIMM NVDIMM Host Shared/RO ROOTFS

36 Lightweight - KSM Host Hypervisor 1 pages Merged pages KSM 2 pages

37 Fast - Templating Pool template template template Runtime Guest kernel 1 vcpu 128 MiB RAM

38 Fast - Hotplug Runtime Guest kernel 1 vcpu 128 MiB RAM

39 Fast - Hotplug Runtime Hotplug Guest kernel 3 vcpu 1024 MiB RAM PCI devices

40 Devices - virtio QEMU container Block device emulation /dev/sda Guest kernel virtio-scsi front-end virtio-scsi back-end Host Linux kernel

41 Devices - virtio container eth0 Guest kernel virtio-net front-end vhost-net back-end emulation Host Linux kernel

42 Devices - HW passthrough container eth0 Guest kernel ixgbe driver Host Linux kernel vfio-pci NIC

43 Devices - SR-IOV bonus 1 2 container container eth0 eth0 Guest kernel Guest kernel ixgbe driver ixgbe driver Host Linux kernel vfio-pci NIC PF VF1 VF2 VFN

44 Network - Macvtap Container netns vhost-net veth pair MACVTAP

45 Network - Traffic control Container netns vhost-net TAP veth pair TC mirroring

46 Storage - 9p Host Filesystem container rootfs volumes Guest kernel Coldplug virtio-9p

47 Storage - blk container Block device rootfs volumes Guest kernel Hotplug virtio-blk virtio-scsi

48 Host namespaces Network ns PID ns shim proc Agent shim proc ns Guest Linux kernel

49

50 Multi OS container container container linux GPU module linux-4.16 linux-3.14 Host Linux kernel GPU

51 Time to wrap up!

52 Time to wrap up!

53 Time to wrap up!

54 Play & contribute! Sources: Get started: loper-guide.md Slack: katacontainers.slack.com IRC: Mailing list: