Cloud Native Computing Foundation KubeCon + CloudNativeCon China 2019 (Shanghai), 5 Jul 2019

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: containerd - Lantao Liu, Google & Wei Fu, Alibaba

Description

Join us for Kubernetes Forums Seoul, Sydney, Bengaluru and Delhi - learn more at kubecon.io

Don't miss KubeCon + CloudNativeCon 2020 events in Amsterdam March 30 - April 2, Shanghai July 28-30 and Boston November 17-20! Learn more at kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects

containerd - Lantao Liu, Google & Wei Fu, Alibaba

Join containerd maintainers to learn how to leverage containerd’s design and APIs to use, customize and enhance containerd’s capabilities. We’ll cover building custom snapshotters for special storage needs and integrating with custom runtimes for stronger isolation. Understanding containerd architecture and data flow is key to extending it’s functionality. In this talk, we’ll look at the internals of containerd (covering its components and dataflows) then dive into how external plugins work with containerd. We’ll go over using containerd’s smart client API and plugins to make new/custom integrations. We will demonstrate how various sandbox technologies can be integrated with containerd to work with Kubernetes, including Amazon’s Firecracker, Google’s gVisor etc. Attendees will leave the talk understanding how they can extend/modify containerd to support enhanced integrations for custom production deployments.

https://sched.co/NrqY

A

A

Minutes, low and I will speak 15 minutes each and then we will leave for five to seven minutes for.

B

A

The integration.

A

A

Provide some client-facing features, for example,.

B

A

Community, more.

C

Integrated into a.

A

Large system, so if you want to read from da co2.

C

D

A

Curtain DCI, you may need to understand its architecture and how.

B

C

A

D

Crazy seven container fun.

B

Architecture, this is.

D

A

Diagram there now a lot of cloud platforms adopt.

A

See that retainer D support.

A

A

Content from the.

A

C

A

B

A

Spacing it allows different clients.

D

Is the same continuity.

D

We are separated, in addition, cannot be also.

A

Very important function: snap, shorter.

A

Easy to approach.

B

A

Can use it to monitor.

B

Which can call image? Which.

D

Is a large edge.

D

A

A

Scientists can call the image.

A

D

A

D

A

Are clear boundaries between different modules, so the.

D

A

Do a lot of things on the client side, for example, if I want to change the position of Sakura to the process, you can do.

C

A

Changing the code in backhand, so it's very.

D

D

B

D

A

D

A

Course on service- and there are also a lot of work to be done for.

B

A

If I need a new format.

D

A

Container, such as, how do we.

D

Integrate that.

A

We come to just to maintain one person because they were leader to high maintenance processes.

A

So in container B any component, is it like English, so.

D

How do I understand this so.

A

I said the modules have clear boundaries, so they can be grouped into different parties.

D

A

In the code, library.

A

Say to be maintained so.

B

A

B

Of registration.

B

A

Flag aims and be defined.

D

Under extended.

D

D

A

And we support tool, settings noise, proxy.

D

A

Know will give you more details so.

D

First, proxy clogging simply.

A

Speaking container D can forward the request.

D

From upstream to the search of party.

D

A

Be more users for.

D

A

D

A

Content are supported, so it's a forward dating.

D

A

Look just implement.

D

Excise on such party lucky and.

A

Was this said their service information sent to contain the D, which is the red.

D

One I'm glad to connect to your server and.

A

Then the upstream, the quest is forwarded.

D

Into the search party server.

A

That means you don't have to change any code service.

A

So how was it used previously.

D

A

We integrate runtime.

A

Can use continuity to generate test shells for.

A

D

D

A

Through open container implementing API, it's okay and then API is finally, so your API should also follow the main name particles. So when you start your.

D

A

D

A

Or implement this API.

D

A

It looks like this I all contain that the I see that the.

C

A

Will be turning to contain machine.

B

A

See various they.

B

D

Seek for day.

A

D

A

This world into gradual to substitute.

D

A

Container, so that's about integration and I'll handle virtue.

A

D

C

Under every list, you.

B

Can have a lot a.

C

Lot of test cases- and most of them are red. If they are red, then darker and darker they're, also red.

B

C

You can see my desk.

B

C

Now it's a production, ready.

D

C

When we compare with previous integration with darker for Doc, you can see, there's no taco, shame we.

D

C

Have giblet and.

D

B

C

So in terms of stability and performance, it will improve.

D

C

Is a simple architecture.

D

C

Carbonaceous chose us: I want to pull image and serious. Tell us what I want to have poor image. Then we use continuity to go in the image and then let's want to start pod and we set up a part environment.

C

Network we use en I love e CR, okay,.

C

D

C

Is a comparison with.

D

Dakashin performance.

D

C

You can see, for example, 105 quad badge, step-up, startup, benchmark and also 105 odds management, overhead benchmark. Then we will see the components, research, resource usage, people, the reason for using 105 parts.

B

C

That, because the default to support part number is 105, the red one is continuity and red one is dakashin, basically all better.

D

C

Recommend that gradually we can shift it to CRI because dakashin dr support in our plan, we will remove from communities I, don't know whether we will duplicate or done.

B

D

We need someone to maintain it then.

C

How can we shift from dr. integration to.

B

C

Continuity, these kind of new CRI integration for continuity. It's very simple.

D

C

You have darker 18 0.05 installed in your machine. We already have continuity and say as long as you install docker, you already have container so why you start.

B

C

You can also enable urs TR, then you add the.

D

D

C

You should not talk with original talk regime, but with the continuity, and you should ensure that you have a.

B

C

Clogging and if ever since ready then it's done, then you already have continuity.

B

C

Actually we're still using docker, but a new version of docker.

D

C

Is an integration of continuity was kubernetes and we hope that you can gradually ship to your production environment into this one, because most of the functions will be here as appointed for docker. We.

B

Need someone to.

C

Maintain, if not, then a lot of new functions will not be there and for gk e JK is google. New kubernetes engine is hosted.

B

C

Service provided a bio cocoa cloud.

C

Container d 1.1 last year it was beta.

D

C

Not long ago we have, we have used continuity for master nodes.

D

C

I'm on vacation now so I children during my vacation and they can reach GA.

D

C

Probably at the end of this year or next year, we will use continuity for all the nodes for old notes. It will become in docker.

D

C

Now I talked about continuity and the kubernetes integration and continuity is used in GAE. Actually in gke, when we use continuity, we can do a lot of things.

D

C

Let me briefly introduce Jake a sandbox, as we all know also continues very convenient, but in terms of securities do there are some problems, so we use hosts Linux kernel. If there is a bug, then.

D

C

May escape from the container, then they will.

B

C

Your data or inference your production environment, so we already have a lot of pre previous problems.

D

C

Solve this problem, jke has done wrong thing that outside the container, we want to add another layer of protection. If you have strong just demand for isolation, you can have that we are based on G visor for G visor, a brief introduction, actually it's an open source by cocoa and it's a sandbox technology based on user space, kernel written in Co, and it is also OCI conformant, Rana C. So your application is in user space and Cisco is through it to have virtualization. So as a result, we cannot directly access to host kernel.

C

So, as a result, you can have two layers of.

B

C

D

C

Support the divisor in containers: we need to make sure that G Weiser.

D

C

Different from round see on the website as run see on the right side is divisor is different. You can see tree Weiser have its own kernel and in run C or container D.

D

C

Suppose your application is round on host kernel, so they made a replace and message to you for when you accept process you can directly observe it, but for tree visor or the container process is run on the G visor kernel. You cannot directly get this information from coast kernel, so you need to talk aways to revise your kernel for this information. So in this way for continuity, they need different behavior to treat tree visor and owner around scene. So we need to have a layer of abstract.

D

C

This abstract they can have.

D

C

Behavior to solve the problem, we have a discussion with continuty community how to solve it for the benefit of continuity. It has a lot of interface and we go through every interface and we find that shame is the right layer. So we decide in trim level, we have an abstract.

D

C

We have some b-24 tripAdvisor's any signal or monitor application exit.

C

Taking monitoring stats.

B

C

We cannot do it now. We can abstract it under Shem v2 and a 4G Visor. They can also use their own special implementation when we have Shem v2.

D

C

We can do the tree, visor integration, we have an intern ocean and all these behaviors that cannot be handled previously can be handled it now and now she v2 is now a standard phrase. Ample windows is doing so.

B

C

If you have your own runtime, you can also use it.

D

C

Is the continuity level to support divisor and other kubernetes side? We also need to make some changes when we start father, we need to tell carbonated so it will be wrong entry visor, and so we have API called runtime + and for different runtime. You can have defined a runtime class and then, when you start a party, you can use this runtime class, so we have a 3, bytes or runtime class and at the CR eye level we need to send this runtime info.

C

So we say this part is using this runtime and then we need to configure this. Runtime is correspondent to what shim.

D

C

We added this configure here whenever, since it's done, then we from kubernetes ATI to every interface to continuity, support all these are connected. Now.

B

C

Have an animation here anyway: it's not important, so you can see here.

D

C

To end user said, I want to create a pot and use tree, visor and cabinet, you can see it and they use gri create pod and they will use tree visor, and then we have a configuration here. If you want to try visor what you should do, then you need to use shrimp. Then we need to start the shame. Then she knows how to manage G visor container and how to communicate with them and the same method can support kata.

D

C

For gke sandbox.

B

C

Year it was alpha this year may beta and all we still can all users in China but anyway and if you use g-cloud, it's like this.

D

C

Have a quick recap.

D

C

Needs continuity. Integration is ready for production use. We recommend you to shift otherwise in the future, maybe two to three years later. If you have not shifted, you may have some problems because darker shame, a lot of functions will not be updated and you cannot have that security fix fix or you can ship the to others. Uri.

D

C

Check a container support is beta and in the future it will become default and all the notes will be continuity and gk. E sandbox is built on grenades, plus container and plus G visor, and the continuity is extensible.

C

We have a long list of interface, so, whatever you want to do just to look at the interface and you may find something that is suitable for you. That's all.

C

So we're just down time.

C

Well, you have five minutes to all questions.

C

Can you share with.

D

D

C

You shift from dr. Anton to continuity. What area shall we pay attention to I.

C

Guess you all heard the question: what we need to pay.

D

Attention to that, because.

C

All the things are in continuity, doctor itself, I have them all the container have status. Oh, oh, this is move to continuity, but then you cannot see it in God in talker and the image you cannot see it anymore, so docker and Cuba native well. They will just share underlying continuity. Communities do all the same and dr. well, no and whatever done in docker communities. Well, no! No, because dr. have different application scenario with kubernetes. We want.

B

C

But we don't want to have overlap, and now how can we know do the book.

D

C

Upstream, based on CRI, we have interface called see.

D

C

Similar to docker CRI, this is based on CRI, for example. Really, when you run docker PS, you can see a lot of container now and for kubernetes will also have some automatic operation and.

D

C

You run kubernetes, you can see a long list of containers and a way you can.

D

C

Omega theta, so you cannot know what the containers are for and then in continuity. All these containers are really redesigned.

D

C

Can clearly see the container name and also in what port they are.

C

Please use a microphone.

C

D

C

B

C

Have which is the change to create great.

D

C

D

C

They are using the same CR, AI interface,.

C

The cuban artists community there's another runtime policy. I is also compare compatible compared to continuity. What the advantages and disadvantages? How do you suggest the users to use continuity or CIO.

D

C

Your own choice.

D

C

Previously, when asked about other people, we were just to say: we hope that this one is not important to you in including crack kado. It's a standard, you use continuity or the same, so it was support both from time for kubernetes. You, sir, you don't need to care about whether it's considered a or cry or whether why you run or continue the okra or we hope.

D

C

Operators OST will decide, for example, GTE we will use continue my operating system. I know we were still used for run, hat or I, see I see they will use soprano. So we hope to reach a status that you can make your own decision. It's.

D

D

C

Two projects: elf, continuity, Google early, talker,.

D

C

At the end are maintaining it and.

B

C

All wrong hat is maintaining Intel; they also have a lot to. You can take a look by ourselves.

C

When we eliminate Daugherty, a lot of functions will be missing. For example, quota management, Rock locator.

D

A

Another important reason is gke, including the solutions around vm.

D

Each node nvm, if.

A

We use Carter now.

D

Then it means virtualization.

A

A

Embedding the machine.

A

So very good: it.

B

Doesn't need to chewing that.

C

Patrol machine.

B

A

Are different problems? Some don't need virtualization. So this is our ears place. Different vendors have different use cases. Of course we support cutter as well. We want to solve this issue of virtualization.

D

A

Again, poster useful.

A

Just to continually support, x86 and arm and how so, how long? Between its a commercialization.

D

A

B

B

A

Here to continue deep but Cheryl I'm, a high major internship.

B

There's a door choco.

B

A

Borneo to charge in talking Paradiso.

B

A

A Content ID joke lady: are you trying to get hired clear eating, Romano yo, Chico Jack? Why don't you truth.

A

Thank you very much.