MesosCon Qian Zhang (IBM China), Jie Yu (Mesosphere) OCI Support in Mesos Mesosphere, Inc. All Rights Reserved. 1

What is OCI (Open Container Initiative) Launched on June 22, 2015 by Docker, CoreOS and other leaders in the container industry, 43 members now. A lightweight, open governance project formed under the Linux Foundation. Focus on creating open industry standards around container formats and runtime. https://www.opencontainers.org https://github.com/opencontainers 2016 Mesosphere, Inc. All Rights Reserved. 4

OCI Specs Runtime spec Specify the configuration, execution environment, and lifecycle of a container. Define a filesystem bundle which contains all the information needed to load and run a container by a container runtime. config.json - platform - env - user - hostname - root... + rootfs / bin/ etc/ home/ opt/... Container Runtime Container Filesystem Bundle 2016 Mesosphere, Inc. All Rights Reserved. 5

OCI Specs Image spec Define an OCI image. More details in the next a few pages High level workflow for an OCI runtime (Similar UX with docker run ) Download an OCI Image Unpack the image into an OCI runtime filesystem bundle Run the OCI runtime bundle as a container. In Mesos, our focus is OCI image spec rather than runtime spec because: We d like to support any OCI compliant images no matter which tools are used to create the images. OCI runtime spec config are pretty low level, it doesn't make sense to directly expose to the end user. 2016 Mesosphere, Inc. All Rights Reserved. 6

OCI Image Spec Contents Image Manifest Image Configuration Image Layer Image Index Description A JSON document pointing to a configuration and set of layers for a single container image for a specific architecture and operating system. A JSON document describing the configuration of the image. A changeset that describes a container's filesystem, one or more layers are applied on top of each other to create a complete filesystem for container. A JSON document pointing to specific image manifests for one or more platforms. 2016 Mesosphere, Inc. All Rights Reserved. 7

OCI Image Layout $ tree nginx/ nginx/ blobs/ sha256/ 1258c3edee850f5f4b1aa35f7daf... 961dd3f5d83608982f3294cf921f... a80b5f000ec0152b73d6d5d3lk2... b05436c68d6ab7af7016dcd3plo... ff3d52d8f55fb0b74ea0a2413snc... index.json oci-layout Image index Image manifest Image layers Image configuration 2016 Mesosphere, Inc. All Rights Reserved. 9

OCI Store in Mesos Introduced two new agent flags --oci_default_locator { "type": "PREFIX", "prefix": { "value": "/tmp/oci/images" } } Locator is the solution that we abstract the way to discover OCI images, currently we support file:// and http://, will support more in future. --oci_store_dir /var/lib/mesos/store/oci configs/ layers/ default/ overlay/ manifests/ staging/ storedimages 2016 Mesosphere, Inc. All Rights Reserved. 11

OCI Store in Mesos Overall workflow to fetch an OCI image Fetch the index.json file based on image name and tag. Parse index.json to get the ID of the image manifest matching the current platform. Fetch the image manifest. Parse the image manifest to get the IDs of image configuration and image layers Fetch the image configuration. Fetch the image layers. 2016 Mesosphere, Inc. All Rights Reserved. 12

OCI Runtime Isolator in Mesos We decided to extend the existing docker/runtime isolator to handle both Docker image and OCI image. docker/runtime isolator is responsible for merging runtime configuration specified by user and Docker/OCI image configuration. Environment variable Command Working directory User 2016 Mesosphere, Inc. All Rights Reserved. 13

Demo Time!!

Questions? @qianzhangxa @jieyu