Cloud Native Computing Foundation Cloud Native Telco Day NA 2022, 2 Nov 2022

Previous Meeting

Next Meeting

⏯

youtube image

►

From YouTube: Lightning Talk: What Are MicroVMs? And Why Should I Care? - Richard Case, SUSE

Description

Don’t miss out! Join us at our upcoming event: KubeCon + CloudNativeCon Europe 2023 in Amsterdam, The Netherlands from April 17-21. Learn more at https://kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects.

Lightning Talk: What Are MicroVMs? And Why Should I Care? - Richard Case, SUSE

Have you heard the word “microVMs” and wondered what they are? Or perhaps it's a new term to you? The word itself implies that they are tiny virtual machines but is this true, and what really is microVM technology? MicroVM technology is used by AWS as a core building block for some of its services. So, it's got to be pretty good, right? Are there reasons, as a Service Provider or software vendor, that I should be considering this technology? Can you take advantage of NIC/Hardware acceleration? In this session, you’ll be taken on a tour of what microVMs are, their use cases and some current microVM open-source implementations. You’ll hopefully come away understanding what microVMs are and why they might be useful to you.

A

Welcome everyone. Thank you for coming to this talk on what micro VMS and why should I care? My name is Richard I'm, a principal engineer at Susa I did work previously at weaveworks, where I created an open source project called liquid metal and that's around uh running kubernetes clusters in micro VMS.

A

So what we'll be covering um so we're going to cover what our micro VMS first and foremost, then we're going to cover um how you know. Why should you care about microvims, and maybe you don't, but you might care depending on the use cases, then we're going to talk about?

A

How do you actually use the micro VMS so we'll cover a couple of Open Source implementations and then we were going to have a demo if we had time but now I'm not on my laptop, we won't be able to have a demo, but if anyone's interested uh you know grab me afterwards.

A

So let me talk I'm sure my age here, but we're going to be a bit like Road, Runner and I'm going to talk quickly, so apologies in advance, so a quick show of hands um who has heard of micro, VMS nice cool Has. Anyone used micro VMS one good.

A

um What did you use? uh Firecracker hypervisor yeah cool?

A

Well, that's that's more than normal. So what actually are micro, VMS, so I'm going to start with the word micro VM, so that that implies a lot of things so with the first part, uh the micro part that that sort of indicates something very small and people when people see that that they make certain assumptions about you know this thing is very, very small and it's an adjective. So if we're talking about English, you know it's a modifier word it. It indicates something about a noun. So the thing that follows it.

A

So what we're saying here is the noun is the VM part. So everyone knows that is an acronym for virtual machine, so virtualize or emulated computer system. So when we take these two things together, it's a question for everyone. Does a micro VM equal, a very small virtualized or emulated compute system?

A

The word implies it, um and actually the answer is not necessarily so. This is where a lot of people you know, think uh the thing that goes wrong. So this was actually pointed out to me um helpfully on Twitter uh when I posted something about micro VMS. Whilst I don't agree with both of the comments there.

A

I actually agree with the sentiment of the first comment: if I'm running the kubernetes node in a micro VM, is it actually micro, probably not, um but I much prefer someone else's comment that, like and liquid metal to the T-1000, so that you know that was a lot better for me.

A

So I've said you know what micro VMS are not so they're, not very small, lightweight virtual machines. So what actually are they?

A

First and foremost, if you take one thing away from this talk, it's just lightweight virtualization, that's all it is, and what this really means is it's the minimal minimal vmm that utilizes KVM, and when we talk about microvm implementations, they normally focus on or prioritize three areas in their implementation.

A

So the first is security: they want a smaller attack surface, so there's less vulnerabilities and depending on your implementation, this this may include things like c groups set comp filters and things like that.

A

Secondly, they're designed to be fast now, if you look into micro, VMS you'll see all sorts of numbers published. You know this one here that is quoted about firecracker less than 125 milliseconds to launch. You know that sounds really really good. um You know if I saw that yeah, that's amazing and that's to Launch the firecracker process that is not to boot, your guest OS.

A

That is on top of this, so it's so take those numbers with a pinch of salt, but they are designed to launch hundreds of these micro VMS every second per host and there's reasons for that.

A

The third area they prioritized is efficiency and scalability. Now what this really means is the resource overhead per VM should be minimal and in most implementations currently out there. This is less than five megabytes per VM, so they try and minimize that.

A

So moving on to the devices, so what does this virtualization support? So it's limited, that's where this micro aspect comes into it, so it supports a limited set of devices or a limited device model.

A

It doesn't try to emulate all the things and be a general virtualization solution. It's not that it uses power virtualization. So the guests are aware that they're running within a virtual environment. Essentially you know, depending on your implementation, there may be varying levels of the oi device types implemented there.

A

But what this all means is there is less bloat less hypervisor bloat is how it's it's commonly termed. It has a faster startup time and because there are less devices supported, you know, there's less uh code in there and less attack service, essentially.

A

So all of the microvm implementations have a concept of volumes. You have to have a root volume to boot to boot the uh the micro VM.

A

These are all implemented as raw file system files or block devices, and these can be really really cumbersome to work with if you've ever had to use those. So this is where overlay file systems come in or or Dev mapper some implementations. Some solutions are built on top of micro VMS go so far as to take a container image. Do some magic behind the scenes and present that as a block device to to the micro VM implementation, so it sort of takes away some of the pain of dealing with those those raw file systems.

A

Now also, depending on your implementation, there may be no bios and no bootloader the micro VM implementation. Such a firecracker will start executing the kernel directly. It will go to magic entry point and then it will start executing from there, so that also increases the startup time or improves the startup time.

A

Most implementations come with an API server built into them, and now this is a per instance API server and it's usually accessible via socket. Now what this allows you to do is perform configuration against your micro VM. So add a you know, network interface or a volume, but it also allows you to perform operations now. The operations that you can perform depend on the implementation you're using. So it could be start. Stop your VM or take a snapshot.

A

Also depends on the implementation: they might have a metadata service built in now. This is super useful, so this allows you to place information in from the host into the metadata service and have that information available in the guest. Now this is commonly used for things like cloud in it, so you can put your cloud in it from the host and get it to boot or use it with during the boot process of that micro VM.

A

A lot of people also use it to pass in things like secrets. So if, depending on your use case, you might need a secret within that guest VM, so you can use the metadata service to to do that now. Moving on to. Why should you care about micro, VMS, so I, guess fundamentally it allows you to do more with the same amount of tin. So if we have a bare metal machine here and I want to run a a VM on there, so there's two parts to it.

A

So there's the resources required for the guest and then there's an overhead per VM.

A

Now, if I'm using the micro VM implementation, the resource requirements for the guests are the same, but the overhead is less so that basically means you know, I can do. I can run more on that machine and then, if you think about Edge and far Edge, where the amount of compute is limited, this really really makes a difference because it allows you to run more things on that machine.

A

So some of the use cases, the big one that is always talked about- is workload isolation. So this is essentially because you're running with a virtual machine, um it's more isolated than a container, and now you might want to do that for regulatory, operational or data privacy issues.

A

So I spoke to someone that was developing a data pipeline as a service solution and they wanted to allow customers to run their own custom steps, but they didn't want to expose the rest of the pipeline to that code that came from the customer, so they decided to run that individual step within a micro VM and isolate it from the rest of the process.

A

You know this is close to my heart, so this is what we did. We essentially run kubernetes clusters or the nodes within micro VMS, and that allows us to essentially have lots lots of smaller clusters and potentially give one to every customer or one to every team instead of having you know a smaller number of large clusters- and there are lots of other examples out there in the wild.

A

Some of the most interesting ones are, you know, using micro, VMS to run isolated, build pipelines, there's a really good video of something called Alex Ellis who's using it to run GitHub Runners uh locally. uh You know compiled kernels and stuff like that that take forever in normal GitHub actions runners you can use it to create because because of the the speed and the resource requirements is a really good solution to creating test testing environments and preview environments on pull requests. So you can just spin up these environments very lightweight.

A

So how do you use microvms?

A

So essentially, there's there's two main implementations that I think about as micro VMS there's firecracker and there is cloud hypervisor.

A

They both have a similar Heritage they've. Both started out for across VM, they both use the uh rust vmm crate, but depending on their use cases, they have now diverged slightly.

A

There are other Solutions now, so there is the community micro, but there's disappeared after firecracker and Cloud hypervisor.

A

Both support, x86 and arm, and essentially what you have to do is create an instance of firecracker or Cloud hypervisor per VM, so essentially a process per the. um So if I move on to firecrackers specifically so this was used well, this is used and developed by AWS. It underpins AWS services so specifically Lambda and Fargo.

A

Now what this also means is it's designed for a very specific use case in mind, which is a femoral compute and that drives the features that are within firecracker, and this really translates into a reduced device model. So there is no PCI pass-through. For example, um there is no Mac vtap support because it's not required to run in AWS, so the features are driven essentially by that, but what it does have it does have a metadata service.

A

So I can use that to you know, do cloud in it if I want to on boot, but because it's a femoral nature, it has no no concept to pause or reboot. So you know it's just a start or a stop, so you need to be a wary of that. If you're going to use firecracker, you can increase the security of the firecracker process.

A

You can start firecracker by something that they call the jailer and that essentially then forces the firecracker process to be started uh within the network namespace uh using second filters as well, for the system calls and um C group to limit the resource usage. So you can really really lock the firecracker process down. One thing to note is only you can only use it for Linux guests.

A

Secondly, there is cloud hypervisor now this is a project started by Intel Alibaba and a few other companies, and it's a more generalized virtualization solution and it's a bit more feature. Rich As, a result of this. The device model it supports is is greater than firecracker, so it has a lot more virtio device type supported, specifically things like vdpa, if you're interested in that it supports PCI pass-through.

A

So if you have machine learning workloads you want to run in your micro. Vm is great um also if you use an sriiv as well. This is an option for you, which firecracker is not if you're interested in Secure, compute and enclaves. It also supports TDX and sgx as well, which firecracker doesn't and it supports magnetab out the box. So I should caveat that firecracker does have a featured branch open with Mac V tap support as well.

A

There is no metadata service in Cloud hypervisor, so if you want to get information in and out of your guest VM you're going to have to use something else, so you can attach the volume if you want to do that.

A

This is a whether it's a good thing or a bad thing. It supports Linux and windows as guest operating systems.

A

So there would be a demo if I was on my laptop now, but that's probably about 10 minutes. So thank you. If you have any questions, let me know.

A

Okay, did we have a question um if anyone has questions all right, perfect.

A

Are there any run times which are using micro, VMS.

A

Any run times is in yeah like if we can yes yeah. So there is something called uh firecracker containerdy. um So you can. You can start up containers within an individual instance. There are other companies that are doing other things with it, but not specifically container run times.

A

I haven't seen that working with kubernetes, though I've just seen that individually.

A

Okay, I think over time.