Cloud Native Computing Foundation KubeCon + CloudNativeCon Europe 2018 (Copenhagen), 14 Nov 2015

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Containerd, What Does it Mean for Me - Scott Coulton, Puppet (Any Skill Level)

Description

Want to view more sessions and keep the conversations going? Join us for KubeCon + CloudNativeCon North America in Seattle, December 11 - 13, 2018 (http://bit.ly/KCCNCNA18) or in Shanghai, November 14-15 (http://bit.ly/kccncchina18)

Containerd, What Does it Mean for Me - Scott Coulton, Puppet (Any Skill Level)

Containerd is the foundation for all container run times whether you use Docker, cri-conatinerd in Kubernetes. As a developer, what is containerd? What can I use containerd for? In this talk, we will look into containerd's internals, walk through the relationship with cri-containerd. Then we will take the knowledge we just learned and look at how as a developer we can build applications and tooling interfacing with containerd via grpc but also on top of containerd itself by creating containerised applications only using containerd and runc

About Scott
Scott Coulton is a platform engineering lead and Docker captain with 10 years of experience in the managed services and hosting space. He has extensive experience in architecture and rolling out systems and network solutions for national and multinational companies with a wide variety of technologies, including AWS, Puppet, Docker, Cisco, VMware, Microsoft, and Linux. His design strengths are in cloud computing, automation, and the security space.
Join us for KubeCon + CloudNativeCon in Barcelona May 20 - 23, Shanghai June 24 - 26, and San Diego November 18 - 21! Learn more at https://kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy and all of the other CNCF-hosted projects.

A

Thanks, first of all, for coming out to this talk, so we're gonna be talking about container D and what does it mean for me? We're going to be looking at container D from a slightly different use case, so we're going to look at how to build applications on top of container day and how you can actually consume container d.

A

So we're going to absolutely look at it from a consumption point of view, not necessarily a functional point of view, but still functional, because you're going to use a functions, but it's going to be more from end users container D point of view we're going to delve into some things like cry and creeping EDS at the end and we're gonna tie it all together. There's gonna be a free live demos, so hopefully everything goes well a little bit about me. I'm from Sydney Australia, I work for puppet I'm.

A

Also, a darker captain I've contributed to the Linux kit and some other things on the mobi project.

A

My primary role at puppet is looking at the future of why what configuration management means and what does that mean in the world where everything's becoming developer focused so building companies, platforms, container native applications service and things like that, so we're not going to mention puppet server at all or PE, or anything like that today.

A

I, don't really have anything to do with that, except my team is a core maintainer for the Koopa needy, / docker modules, and that's because my team's, the only one that's got the knowledge of how to maintain those two things in the company, but primarily we build tooling around the Newton, the newest stuff. Coming up in this talk, we're gonna have a look at what is container D I mean, and the last talk was really good on that, so I'll skip to that fairly quickly. What upstream projects use container D?

A

Well, the one thing the last talk talked about at a docker and container D. Together they are loosely coupled, but they are, they can be run separately, they're, not mutually tied together and we'll look at tying everything, we've done into a real-world application and that will take us into some of the stuff that we're working in at puppet.

A

So that should be what is a container D? So I've made a spelling mistake already. What is a container um Thank You Dana? This is taken from the container D the continuity website. It's basically saying that it's a robust, simple way to run containers. It hasn't, got all the bells and whistles of things like docker does so it doesn't have things like the image build. It has got to see a lie, but that's only for like development purposes.

A

It doesn't have things like orchestration built into it. It's just a low-level foreign relieves that you need to run a container pull the container and create a namespace manipulate, a manipulate, a namespace talk to the cry, plug-in talk to run, C and also storage or networking plugins that you need so we'll break it down. There is you get with container D if you just install container B by itself, you get c CTR, which is the CLI.

A

You get daemon, exposing a GE RPC in API of a unique socket and you get protobuf specs between the components. So it's it's it's pretty low level stuff, but it gives you the capabilities to do primitives with containers so to break it down a little bit further from, like the architecture point of view, you can see there that you've got your storage, which is your snapshot, which creates the filesystem, which the container tasks will then use. You've got things like content and diff. There.

A

You've got your images, your containers, you got tasks and events, tasks and exact in container D and don't necessarily map to what they do in docker, even though the naming is similar. So if you want to learn about that, well, I'll talk about that as we go in, because we're gonna run a few exact tasks to have a look at that is it's actually the running process not actually exacting into a process. That's already running so there's a few little like stuff in the naming.

A

That's a bit confusing, but we'll go through all that and you can see over there. You get your runtime, so I believe that at the moment run C support it and there's gonna be future ones coming in the roadmap with eternity I saw last week and you can run it on any OS that you want besides Windows at the moment, I think and Mac.

A

So this is the latest version of the CLI. As you can see now the 1.10 release was released last week or the week before you can see there. That cry is built into it now and the CLI you can see that you've got soft light. You can look at what plugins you've got. You can see the virgins. You can look at the containers running. You can look at what namespaces are available to you. You can manipulate namespaces. You can take a snapshot of what is running and there's a whole heap of stuff.

A

You can do tasks and that so we'll just quickly before we do that and container gate D gives us. It gives us a CI image. Spect support through run C, which is quite good. It gives this image push and pull support, network, primitive creation, modification and deletion of interfaces that, in the kubernetes world, is talking to see and eye management of network namespaces for containers to join an existing names faces. So if there's already, you already created namespaces and things like that, you can control them in container D.

A

You might be wondering why I'm talking so much about namespace creation and stuff.

A

That's usually something that's really abstract it from like end-user and why I want to do it when I get to the end of what I, what we actually are doing at puppet of building kubernetes distribution, we're actually going to be using container D as an orchestration method between namespaces to build 1580s there's also another application called bootstrap, which is G RPC service, that kind of mimics what a Cooper needies operator does, but it sits outside of kubernetes and it talks to container D and the G. Rpc interfaces.

A

Talk to the multiple version entity to get the community's cluster up and running so yeah. That's why I'm talking so much about namespaces, because I'm going to get into namespace security afterwards, which was super important for what we were trying to build.

A

So, let's see a demo of just basically, what contain D can give you I was on a plane for 30 hours, so I've actually um like got all this this here, cached in case I did typos. um So we'll just do as you can see what CGR and there's my identity CLI we'll just do a quick pull and we're just pulled ret Redis I've cache this. So it's it's quicker and then we will just run Redis and there you go. You can see straight away.

A

We've got container D running with food, Redis we're running Redis now so, as you can see, there, we've got a basic example of just running an application pre-built from docker hub on top of eternity. That's how simple it was. I just used the pool and then I ran it and that's it and, as you can see, with the only if I wanted to, I could go and exactly into it and and many play processes and things like that yeah.

A

So that's it! So it's it's it's out of the box. That's basically just container D installed from from the build and it's up and running as a daemon, and then you can start working with it. That's fairly straightforward.

A

So, let's look at what upstream project protected continuity now we've seen like some continuity primitives and how it can work and how you can use it to pull containers and things like that.

A

So this is how other projects interact with container D. This is old, I haven't updated at CROI. Container D is actually in container D now, and so I need to update this slide as of last week. But you can see that there's OS storage faster some runtimes they can all integrate easily with container D and he's a really old photo of all the stuff that employed integrates with container D. So you've got all the major players in the in the cloud ecosystem. The container ecosystem and the underline of our essence.

A

So container T is basically used at the moment in moby moby, a linux kit which I'm going to get to in its own. Like section coupang e DS now and alcohol, which is Linux containers on windows, there's a really really good talk from dr. Connery. You I forget the gentleman's name now, but you'll find it from Linux containers on Windows, where he starts to talk about container D. How Microsoft are using container D seem to use Linux on top of container D, and it's a really really good talk.

A

So if you're interested in Windows and and running Linux containers on Windows I definitely would check out that talk for him. Dr. Connie you so there may be project a project that I'm close to I love, they're, all good people there. The mobi project is made up of a whole heap of of actual things to make docker. So there's the engine itself swamp kit is the orchestration layer. You've got hyper key twitches like docker for max virtualization project. You've got run C and Linux kit, which I'll talk about separately.

A

So all these things are the movie project per container. D is kind of the cornerstone of all those things being built together, so the docker engine can exist without container D suam key talks to container D. Also hyper kid doesn't doesn't matter because it's just the doctor for Mac virtualization product run the-- again. Input implement integrates with container D, so all these things container D is the cornerstone of the mobi project and it's been broken out now and in CN CF. For what to be able.

A

This is this is like an older diagram again, but you can see there what it's trying to do. The GRP C API execution supervisor over the shim overrun C host storage was creating the Fox filesystem for the container to run in you've, got then TAS, which is the execution of the process within the the file system, and you've got network and interface management, which would be depending on what you're doing it would be most likely CI at this conference, how its container D different from docker.

A

So, as you can see, container D is actually built out. All the other pieces of docker actually talk to container D. It's like the cornerstone, as I said before, and you can see, there's all the different like parts and mobi. So things like the docker api dhaka, CLI docker compose build all that stuff is not actually in container d, but it can talk to contain the d.

A

So if you have a look at one of the newer projects coming out a movie which is build kit, which is super awesome being able to asynchronous build it, it needs to contain a day and run C. It doesn't need the docker engine so that that's that's another project coming out a movie that container D is like the cornerstone of and it and actually need the docker engine itself. You can do build without docker and I really really like that project as well. So, let's see this in action.

A

I'm gonna do a little bit of inception here and actually run docker on top of container D running container D, so I'm actually running, as you can see, a slightly older version of docker I know a teens out near 1803, but my demo didn't have time to update it. So, as you can see here, I'm actually running container D inside container D, I'm running a container, that's running docker, that's running continued D and why I'm showing you?

A

This is like it's a really cool way to show an application that everyone knows on top of container D before we go into too complex stuff like poop in 80s. It it like is a fully working version of docker as well um I'll just do it on a run.

A

They actually I went to him in the background where it is I think it's Redis for.

A

Ya so, as you can see now, it's this docker, it's actually running on top of container D, which is running continuity, which is running, run C, it's really inception, but when you talk about signing to build applications on top of the container D, yes, question.

A

Sorry driver I'm using AF AF us in this particular one. So there you can see it's running, it's ready to accept connections in Redis. So, as you can see, it's a it's a fully working version of docker.

A

It's not like something that I've hacked in there and when you have to start to have a look if you're building applications now and you want to be container native and you might not need a full full runtime, you can start to look at container D to build your applications on top of, because there's a really rich G, RPC interface there and there's a lot of stuff, you can do so yeah. That's that's! Just a quick demo to show you docker running on topic.

A

Eternity we've contained they already running again, but it's all process segmentation in namespaces. So this is why it's different to virtualization and it allows you to do things like this and when you start thinking about this from an architectural point of view, when you're building applications, it gives you the freedom to do so much so so much, and this is one of the things that we're working on internally. Looking at how we can make our applications run more efficiently by taking up these, this lot of architecture.

A

So why we actually started to look at this, was we were blown away by this at Dhaka Kahn in Austin linetsky, which seems really weird because we're a company that looks after configuration, management that looks after nudes, but that's not gonna last forever, so we need to look at something new. What we have to look at is if we wanted to send out applications or newer things like our product like discovery onto an on-prem.

A

How can we do that without having to install a whole heap of containers like the other compose file or or something like that? How could we, how can we do wrap it up into like a the same way across all cloud providers? So someone can just go and purchase that there's an ami? How do we look at security because we're shipping stuff right? We did test testing building PE using PAC are using Debian, which I love Debian.

A

So this is not a bad thing about Debian and it took three hours because we had to install it in sloppy. Then do all these security stuff to lock it down, check for vulnerabilities and there's a whole heap of stuff there that we weren't using so we're installing something onto an OS where we don't need all that stuff. Basically, what we need. It was a kernel, I retain a runtime, and then we could start building stuff on scratch and then running in on top of that, that's all we need it right.

A

So, instead of shipping, this, like three four gig image to the cloud we could have got that under like seven hundred Meg's. If all we had was the kernel and a runtime- and this is where Linux head is so so powerful- it actually has got the 414 kernel in stable now, so I have to make I made a mistake again on that. It's a super lean OS as talking about it is just a kernel, a few things in in it and then contain a date by default.

A

It allows any runtime you want, so if you can put it in a container and you can put it in scratch and it works on Alpine or Alpine. Sorry, April bit with this kernel, the batteries are included that can be replaced and everything's built. Also, this is the containers. So, if you're looking at everything to be Cana native- and you want to build an OS, this is definitely what I would look at from a security point of view. Smaller attack service.

A

So if you're building something and you're only running containers bite, you don't need SSH, you don't need a whole heap of stuff anymore.

A

You can make it immutable, so you can make it so that only the the folders that you want are mutable things like logging or things where customers data is so when you started looking at building applications on top of Linux kit, you can actually build like one of the applications we're looking at bootstrap if it's on AWS will actually create an EBS volume on the Linux keyed image and the customer data lives there.

A

When we do the upgrade that in bluemix, linux get image gets removed and you want gets there at remounts EBS volume because it understands which volume was there before all the same box system. Services are sandbox. So if you want to start applying stuff like stack bomb and then control groups, anything like that and the kernel level, this will allow you to do it. You can do specialized patches in the configuration.

A

So if you run to run the new kernel or some sort of patched kernel, then you just have to put it in the container then, when it could could take it. You have full control over the build. One of the things that really stood out to me this morning was talking about CDs and see I've. What happens if you could build your own OS in City and see what and it was like seven hundred Meg's and you could shoot between and clout. You can do that. It's right here, it's it's now!

A

This has been used for a long time. So this is originally what Doppler 4 map was built on, but now you can build like a kubernetes install all the configurations in yam. Also, you don't need to learn anything new. Everyone knows yeah more! So that's your init system you got in. It runs eternity and CA stew. Goods.

A

Every demo I've done today has been running on Linux here um when I originally wrote. This talk a while back, I actually had a Mac, so running container D on a Mac is like not that easy to get working. You have to run in the container anyway, so I ran everything in Linux here and since they are not being running everything on Linux kit, we use order a lot in in puppet in my team for things like CDs and build process. So yeah it's it's, it's really rock solid.

A

It's one of the projects I really like and, as I said, we only fell into this because we wanted to run stuff on top a container, D, container D and a kernel. That's all we needed in the OS. We didn't need all this stuff. We basically need it just like in NTV and C HTTP, and some really base level stuff that the OS gives you.

A

We also were really really conscious of security, so we wanted to remove the attack, vector and shipping software I think that's super super important for your customers that you should be thinking about security before you ship, so yeah. It's all magic in Linux here, I think so so we're at coupon right. So how does Cooper needies fall into all of this? Well container. D and Cooper Nidhi's interact like this, so this is a new new thing that I stole from docker. So thank you.

A

Whoever done this, this diagram I think it was I'm, not sure actually, but it was on there, maybe blog last week, so you can see there coup black cry. Plugging identity run see gentlemen's before spoke about a lot of services. There's not that anymore. There is actually a container D and that's it there's some other things you can put in there. But that's like cry CTL. If you want to interface with cry itself to have a look at what cry is running, you can do that in container D as well.

A

There's there's a few other bits and pieces there, but this that you don't need any other anything else, but the the stable release from cry it will download and install container D well, it has contended a ship with it and the version of run C. So it's super easy to get and install and it all works just straight from github. You just have to start at or follow this project. I I'm a big fan of this project.

A

When, when why we started to use this project, was we wanted to look at the leanest OS type? We could to ship our Linux kid image. So one of the things that we wanted to look at is how could we get it the smallest possible that we could in just running kubernetes, so with the daka engine as the run time it was about 1.25 gigs, with cry as the run time. It's like 700 mix that sweet kublai installed and it's got to pull down the control line after that.

A

But it only takes a couple of minutes and it's really. It was really more powerful. One of the one of the things that we we tried to do in the in the modules then was we support it cry natively and when it was in alpha it's something that we wanted to do personally, so we could support it. So, if you're, a peer user, I am speaking about PE now, but if you're, a PE user, niece or Cooper natives with the module, you have a cry run time available to you.

A

It will it's fully supported in our support module there. That was some work. We've done out of our team yeah, we will that's out. This is our preferred method of run time for kubernetes is contended in cry.

A

So let's look at a real world example and I alluded to it a bit throughout this talk. If you don't know, cream cream was something we built last year when we built the Cooper needies module and basically it seems out vagrant and Kate's. A three node cluster cream stands for Cooper Nidhi's rules, everything around me. So if there's any routing fans out there, we stole it. Yes, we did.

A

But basically this is the. This is the the newer version of it, so there's no, no puppet. It's all going now and the cream client acts as what would be an upstream application consuming the platform. It sends a blob over G RPC of what the kubernetes cluster needs to look like.

A

Bootstrap then gets that and looks at what it needs to pass on its peaks sick eternity over a gr, PC socket, and then it spits to the coup black container and passes the information as a process exec into kublai and configures it once that that information being configured the GRP C flat, then part G on bootstrap then looks at qu black and says: I'll call your configure. It then starts a gr PC process with the next node and in the cream. Client there'll be a white list of IP addresses that is expecting.

A

So just no one can hop on at that time of creation and then and we'll talk to the next address and configure the cluster and make sure Koopa needies is all up and running boots up. Also, this is highly in development. At the moment. It also speaks to AWS and understands about EBS volume to be able to map to do upgrade process and things like that around the day to of management of kubernetes.

A

So we have a product of public or pipelines for city pipelines for containers which at the moment, can install kubernetes only on GK. This looks like it will be a solution that we could install kubernetes on for our customers on any cloud platform. If the if the customer doesn't want to use a hosted solution and prefers to use an image that they can put inside of EPC instead of using something like aks or the hosted version of kubernetes, so it gives him gives him.

A

It gives them a lot of different options if they want to use it. This also we're testing it on VMware, depending on what VMware host you have and things like, storage, speed and like that, you can have some bad performance or you can. If you've got a really high-end kid, it actually works fairly well, but yeah. So this is. This is where we are.

A

This is what we got so the whole point of everything we went through was: can we build a kubernetes distribution that we can ship to our customers and look after things like security upgrades a whole heap of stuff like that that an end-user cares about the whole cornerstone of everything that this is built on is container D.

A

So we kind of stole the the operator model from kubernetes and then we've kind of built, our own G RPC interfaces between bootstrap and it's the same sort of ethos that the operator has except we're using container D as the orchestration method yep, because it's got all the prim noobs. We need the logics in the bootstrap application, so I can show you a free demo, as I said, this is, is in heavy development at the moment.

A

So I'll just show you like Linux kit again so, as you can see that there's kubernetes running 110, oh and where you can get all the pods, so I need to do all namespaces. They can go it's just running, so you can see there. So the other thing that bootstraps can I'm going to be doing that. It's not doing now is handle things like CD configuration across the host 4-h, a and and a few other things like that, but yeah.

A

So this is what all this talk of building applications on top of container D was going to like. How could we build our own communities distribution and how could we August rate kubernetes when Cooper needy is not there yet and container D was what we looked at and we build an application that replicates what what as I said, what an operator does, but it uses container D and then once that the clusters seen is stable and it's it's. It's up and running bootstrap actually rips itself down.

A

So it doesn't run anymore because it has access to things like security credentials. It has access to other things inside couplet, and so once it deems itself as the clusters in the stable state and set up compared to the blob that was sent to it. Originally, with the cluster configuration it no longer exists, which again was something that we wanted to do, because we wanted to be security, focused.

A

And I think with all that, just a light bit of topic in demo running through container day I have questions. If anyone wants to awesome yep, just what we just wait for the we'll just wait for the microphone gentleman's coming.

A

Check-Check, how is loose could different from quois, for example, I'm. So like Horowitz I, don't have the the I, don't have the tools to build it from scratch, so I'm still still got a whole stuff, not saying that chorus is bad, but I put it quite a green circles. Red Hat bought it. No, we love right out. We do it was um so yeah, so Cora OS was like the first iteration of what this looks like, but this gives me the the so I can build this from scratch like completely from scratch.

A

So if I need to add something to the OS or remove it at time of CD, I can I can add it in there. So it's like fully completely from scratch. One building OS, that's the freedom that it gives me. It also allows me to build the OS in CD, which we seen this morning was spoken so highly about. So we've got continuous integration and continuous delivery of our oasis.

A

So if you had a look at the talk this morning, all those lines of code and we've reduced that by a whole heap, because we've only got in what we need and then our code and coupe and then so the hopefully the customer can trust that OS more because one there's less the attack vector is smaller and we're taking it through all the the security orders and needs to go to before we can ship it. As I said at the moment, this is in alpha. It's something me and my team were working on.

A

I, don't have a release date for it yet, but yeah we just wanted to show. We thought. Coupon was a good place to talk about it and it's something completely different to what people expect from puppet. So any other questions.

A

Cool all right, well, people thank you for coming out. I mean it was a long flight from Australia to get here, but it was worth it and I hope you have a good coupons. Thank you.

A

Oh actually, one thing before I go I'd, just like to thank a few people that, like as I, was a consumer, so it's Steve and Dave Phil, let's just in McCormick's Italy from wave there's a whole heap of people that actually done the work. The hard work to build this stuff, I've just been consuming in and building some tooling around. It there's some guys on the cria project that I like to thank all those guys. Thank you because, like all this wouldn't be possible.

A

Without them, they did the odd work I'm just a consumer and bolting it all together. So thanks those guys as well.