Introduction to virtualisation, hardware, cloud, containers, unikernels, microkernels. and everything else

Size: px

Start display at page:

Download "Introduction to virtualisation, hardware, cloud, containers, unikernels, microkernels. and everything else"

Tyrone Maxwell
6 years ago
Views:

2 Introduction to virtualisation, hardware, cloud, containers, unikernels, microkernels. and everything else

3 What s driving us? Smaller Faster Efficient Secure

4 Cloud, infrastructure and virtualisation Smaller, faster, efficient and secure needed Cloud era needed The hardware era The virtualisation era Operating Systems have remained constant

5 Containment and segregation (the start)

6 Micro-segmentation and immutable infrastructure (where we re heading)

7 Micro-segmentation and immutable infrastructure Containers Shared host kernel or operating system, includes many services and facilities by default Convenience of shared development and deployment environment on the same kernel Containers typically always share the same operating system (Linux or Windows containers) Compatible across most applications or pre-existing environments Uni-kernels Everything is off-by-default. Components only included as dependencies Can isolate down to the hypervisor level rather than kernel level Enables deep application specialisation and segmentation Duplication of functionality (such as networking) and no compatibility with operating systems

8 Introduction to Vorteil Eco System

9 The ultimate pretty good OS If there is no operating system what is left to secure? If the application can be available in less than 100 ms do we need to over-provision our resources? If the user interaction exists only once EVER what is left to hack? If we can run hundreds of tiny applications for a specific task at peak times why can t re-use our resources for something else? It supports every application our there in the world!!!! Fire this sales person

10 Introducing Vorteil eco system Public Cloud

11 Introducing Vorteil OS Sisa-tech developed operating system built from scratch Architected and developed for rapid deployment, scalability, efficiency and absolute security It s SMALL: minimum footprint of 8MB memory and 300KB of disk space It s SECURE: there is not user or kernel space and no shell! It s FAST: boots in <100ms It s EFFICIENT: Management platform to compile, build, deploy and scale manually / automatic

12 Introducing Vorteil OS It s the Fort Knox of secure operating systems: There is NO user access to Vorteil (no shell, no user space, no command space and no console) There is NO users, no user rights and no access management to breach There is NO user or kernel space In place updates using virtual memory re-mapping Vorteil OS has non-blocking memory access? So what?

13 Introducing Vorteil OS Shared storage capability / mountable storage capability Management, security auditing and SIEM via libvirt (collection of software that provides a convenient way to manage virtual machines and other virtualization functionality, such as storage and network interface management) or optional via SYSLOG, SNMP Traps

14 Introducing Vorteil Management Platform Compile, deploy, manage and revise Compile - fully integrated run-time compile and development environment Deployment to private via well-known element managers (vcenter) or directly into public cloud (AWS, Azure, Rackspace, Google) Manage scalability, performance and ongoing deployment from a single interface Revise, using built-in version control and in-place OS/firmware updates within the managed environment API driven management engine, fully supportive of a DevOps environment

15 Introducing Vorteil Management Platform 1. Install Vorteil CLI 2. Build a Go app 3. Create a virtual machine (VMDK) using Vorteil CLI 4. Deploy to Virtual Box (30 MB memory, 5. Start the virtual machine!!!

16 Introducing Vorteil Management Platform 1. Start Vorteil management platform 2. Import images built previously 3. Manage images in Vorteil management platform

17 Real-world application of Vorteil

18 Example 1: Hyper secure online banking Using Vorteil OS: User logon to online banking instantiates a Vorteil OS + online banking application instance (<100ms for OS startup) User interaction occurs, all audit and log files written to shared storage environment User disconnection / logoff - Vorteil OS and application destroyed after appropriate logging and SIEM

19 Example 1: Hyper secure online banking Common attack types: External: Session replay / hi-jack Negated using Vorteil OS: Online session no longer exists (technically the virtual machine does not exist)! Internal: OS services / open ports The Vorteil OS has no user access, rights or any /user/kernel space to access Internal: External OS libraries compromised Vorteil does not use any external libraries, all dependencies pre-compiled as part of the application (and even then there is not shell, user or kernel space to access)!! Only 3 examples there are MANY more

20 Example 2: High-volume transaction / trading Using Vorteil OS: At time of low volume, deployment of application on any infrastructure at low cost (no cost or resource overhead) At time of high volume, deployment of guaranteed Class of Service (CoS) on private infrastructure and best-effort on public infrastructure Ability to scale at cost (low memory overhead, low storage requirement and extremely fast scaling) When volumes and frequency dissipates - destroy the environment Guaranteed Remember, we talk about destroying the environment and reclaiming resources for other use not merely spinning down while resources still have to be reserved Best-effort

21 What the future holds

22 Next 6-12 months Open-source Vorteil OS end of June 2016 (build a community of developers and contributors) Up till this point a self-funded venture - seeking sponsorship and support to grow at pace Grow the team from 4 developers to 8 rapidly! Currently Sisa-tech has an head-start advantage, critical that this is not lost in the next 8 months (development time of a similar OS)

23 Sisa-tech In-depth Vorteil

24 Vorteil inside The important things to remember: Small footprint (consumes B MHz of processing power, C MBs of memory and D MBs of disk space) Deployment time (boots in A ms) Scalability (management ecosystem for rapid development and deployment across private and public cloud) Resource cost (reclaim resources when not in use) SECURITY (there is not OS to hack it s just an application stack)

25 Vorteil inside We built an OS from scratch on the unikernel concept multi CPU support in 64bit mode Non-blocking memory mechanism (12-20% gain on same hardware) Stateless and State full (supporting VMDK - mountable on other OS) Super secure (close to un-hackable - just because there is nothing to hack) Since we do not have kernel/user space and have multi-core, we implement mtcp natively (millions of connections per sec) Using current language(s) without deviating from the standard libraries

26 Vorteil: operating system / uni-kernel /? Private Cloud / Infrastructure Compiled as a VMDK (example) User applications Boot loader Operating System Memory Management Module ELF Loader Public Cloud / Infrastructure Kernel Network Driver Network Virtual File System Interrupt Handler External File System

Vorteil: management platform @Available @AppBundles 1. Image repository (applications and Vorteil) 2. Revision management 3. Application bundling 1. Availability monitoring 2.

27 Vorteil: 1. Image repository (applications and Vorteil) 2. Revision management 3. Application bundling 1. Availability monitoring 2. Performance monitoring 3. Master / slave / IP / DNS / proxy management + Vorteil build file Provisioning De-provisioning Gateway management Configuration store 1. Scaling Use vcli to build go app Boot loader Memory Management Module ELF Loader Kernel Operating Network Driver Virtual File System API gateways. Interrupt Handler

FIVE REASONS YOU SHOULD RUN CONTAINERS ON BARE METAL, NOT VMS

WHITE PAPER FIVE REASONS YOU SHOULD RUN CONTAINERS ON BARE METAL, NOT VMS Over the past 15 years, server virtualization has become the preferred method of application deployment in the enterprise datacenter.