Cloud Native Computing Foundation KubeCon + CloudNativeCon Europe 2019 (Barcelona), 23 May 2019

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Building Images Efficiently and Securely on Kubernetes with BuildKit - Akihiro Suda, NTT Corporation

Description

Join us for Kubernetes Forums Seoul, Sydney, Bengaluru and Delhi - learn more at kubecon.io

Don't miss KubeCon + CloudNativeCon 2020 events in Amsterdam March 30 - April 2, Shanghai July 28-30 and Boston November 17-20! Learn more at kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects

Building Images Efficiently and Securely on Kubernetes with BuildKit - Akihiro Suda, NTT Corporation

BuildKit is a modern container image builder that focuses on efficiency and security, mostly known as the backend of Docker 18.06+ and Jessie Frazelle's `img`. (But it is even useful as a standalone tool!) In this talk, Akihiro Suda, one of founding maintainers of BuildKit, shows practical tips for running BuildKit on Kubernetes clusters. His talk will contain: * Quick introduction to BuildKit * Why you should build images on your Kubernetes cluster * Load balancing and distributed caching * Deployment w/ and w/o Kubernetes Service * Rootless mode w/ and w/o Kubernetes securityContext/PSP * Build secret management (e.g. git and S3 credentials) * Comparison with other image builder tools * Buildpacks integration * Knative integration

https://sched.co/MPX5

A

Hi, thanks for coming to my sister I'm, a killer from software engineer at entity, so first of all, I'd like to as audiences some questions. So please raise your hand if you have heart or beauty before about 50%. Well, pochi. Please keep rates handy. If I, you were only using abuse gate, not so many keep pressing. Your hunch is already running a built on kubernetes, nobody yeah, so I hope. My talk will be useful for the brewing ability to on kubernetes as read through cuts introduction to build it first.

A

So brittle kicked its next-generation image builder, with focus on performance and security. So for performance you can build doctor why with much stages in parallel- and you can also do caching efficiently and built, it also focuses on security. So you can access to private assets or I'm a transitory or teach people privately using SSH, and it's also supports new syntax that can be repressed. Toka file, such as build parks and also periodically, doesn't require bullet prodigies on the host. So this is very secure and built.

A

It is already included in toka since version 18 point 0 6, but in this stroke I will focus on the sand or version of built it so bitter Tod. It's a demon and a build CTO, it's a cry, and so it doesn't depend on docker. So, even if you are running your cluster with cryo or you are using Padma are you can use built it and so a built? It is based on a real ruby, which is a new intermediate language. So you can consider a ruby is to do coke, while what Arabia is TC.

A

So just just like you compile see terror, beam, intermediate scored, you can compare, took awhile to it'll be or you can use another language that can be compiled to be and it will be, has Doug structure so weak analysis dependency, our Ettore, so we can do a casting very efficiently and we can also do concurrent execution for run instructions in toca 5h.

A

You can use merge this book on file for described edward to be graph. So in this example, we have three stages: stage: zero, one and two, and there is a copy instruction between 0 1, 2 2 and this another copy instruction between stage 1 and stage 2. So the graph can be illustrated right, goodies, so English graph, state, 0 and stage one can be executed in parallel and it shares some benchmark results so who this example without a built each it takes more than 5 minutes, but with delegate x6 residents 3 minutes.

A

So this is 2 times faster and when you have a church without build it it which takes 3.6 seconds, but with built it. It just takes a 0.5 seconds. So this is several 0.2 times faster and after you modify your source code, oops.

A

After you multiply source code with that Bill Gates it takes 6 seconds and which built it, it's 2.1 seconds looks like something else is breaking yeah, it's 2.5 times faster, and you can also push you a cache to a registry, so you can use docker build cash from for using a remote source. So, but with that built it, the remote cache was not by a hip tip, so it's tipped more than 5 seconds but which built it. It just takes 36 seconds. So this is 9 times faster and bill.

A

Kitsch also provides more advanced version of cash, so it can arrow preserving cast of compilers such as go compiler. So in this example, you can preserve the cache objects. Quick in thrush good result cache. We can also, of course, save cash for as long as compiles, and it also saves cash of up to gate that can be presented in stress versus cash-strapped.

A

Of course, we can also preserve as a cash right, yam or Mabel for Java. So this is a very acceptable. So in this example, without bills gates it takes 139 seconds and even with modern optimization. It takes 41 seconds and if you enable bills gate it takes 31 seconds and also you use run mount type cash. It just takes less than 4 seconds just 3.9 seconds so compared to the real estate docker built it's already more than Stratos 3 times faster. This is really awesome and built.

A

It also focuses on security and it has new instruction called run mount type secret. So in this example, you can access to your private astray bucket from your local file as security. So in Doka, while you specify run mount type secret and sis file, ID of secret file,.

A

Squeeze has disappeared.

A

Networks, so you can sit by the ID of the secret fire and this was first for a mounting secret, such as Russia to distress, dot, AWS credentials in this current use. Specify the I give the secret as well and uses flies pass to your critics for credential file on your client and in this example, credential is only visible from run container with mark type secret, so that a credential is not really into the final image.

A

When I referred to access, preppy polar mobile, you might think you can just copy the tradition while with a copy instruction, and you can just remove the file with Arabic month. But please do not do this because the traditional file is still weak is a intermediate layer surrogate. So the somebody with real access to your do. Cardistry can steal your credential and do not do this with so you can inject your producer with docker bill bill Eric, but this is not secure, because when you run docker history commands you can see.

A

Are you a producer of showing in your output of geocache, doing commands each built? It also has run mount type SSH. This is similar to mount type secret, but it's specific to SSH, and it can also support pathways so in to cough. While you specify Round, Top Mountain see SSH and you run a little on command for some.

A

Your ability to repo and O'brien side you're on SSH agent and edit, your private key in the integral password on keyboard, and you can do Bill citty active, build SSH, d4, equal SSH or soap so to your git command can access you credential is the mounted Sajid inch. Bills kicked also supports new languages instead of dockerfile. There are already 3 language, sofa builder packs in mocha file and guca file, which also create new, are all runways using ability to change area to be framework wrong. The new language is builder parks.

A

This was reported from hero in the quad foundry, and you can give describe your image in Yammer write this, and this also another builder box called project build parks. Currently we don't have support for a project, a tablet box, but I think a region's about planet build bugs as well easily and another language is mocha file. So you can write your app to get in llamo, so you can specifies repo and says Phi Z by Z key and specifies the packages to be installed like this, and you can also use google fire.

A

This is smear Tomoko fight but optimize for Warren. This is very simple, so you just need to specify your repo and press insert the repo and the version of your project.

A

The next part is how to deploy visited on kubernetes. So why do we want to build images on to volunteers? I think there are two different kinds of motivational: the first one is CI 3d.

A

So in this example, we were running some building ports in a cluster, and we have as a port that you can work as a billeted. Client center can be right, Tecton, pipeline or jinkies or just kubernetes, but joke vote I'd wait! Maybe a week you can have some webhook for triggering us the sed. This is a very common pattern and we I think it's also useful for developing experience. So you write you a quote on your laptop, but completely you know: pasta. You're, up top is poorer.

A

With regards to hardware resources such as CPU and memory, so it's not suitable for building images and your wife I might be flaky. So you cannot build image it with branch job after getting install and when you are working in coffee or somewhere, you don't have pasta prize.

A

So you don't want to build images on your laptop, but using ability and achievement is you can migrate your built to coaster, so you can just use your laptop is for HUD results in network and birth tree so previously to build images onto parent is a common Patera was to run docker, try and put with random and Boreum for thrush bus rush rush rush, polka dot sock took API circuit or an interpreter was to run docker Dean drunken in toca, continue with security-conscious, dot privileged, but apparently both are insecure.

A

So if you put got compromised, the attacker change ends brutally this on the host very easy, because attacker can now run docker testers previous.

A

So our solution is the route rest mode, which means running basically the demon as no root user on the host, and also you don't need to specify any extra security context, configuration right, security context or privileged. So even if, basically to hire some vulnerability, you can put you are host.

A

Here's some demo.

A

So Iran Cuba City area to put.

A

And country new, put with name BK, is running on my trust and.

A

In the spot, I'm running everything as normal to user named user with UID with you, the one zero zero zero. This is not root.

A

And you can build image with Bill city commands. You can satisfy the address to cube spot contrast, ratio PK, which is the name of the sport.

A

So we can build the image right place. I mean yes, yes, this finished just restaurant five seconds because we have cash and we can run a PK command from issuing packages with that with the privileges it inside the container. You can gain some fake route, so you can run any parties manager such as up to date or a DNF or whatever.

A

So in this example, is sort free, great command and I create a file named out with some favorite output, so it works.

A

But there was a lot of confusion and misunderstanding around the rulers month. What most misunderstanding is that it requires security college study reached. Actually it was true until ability to browse on 0.24, but in the latest version or barricades. You don't need security college privilege, but you need to disable persistent works, which means ensuring a PID, namespace and mark Pro prefers for containers used for right instructions. This is not for as ability to D container itself.

A

So to illustrate this, we need to a disabled, put a Santa box for a countenance for wrong instruction, but we still have process and about souls a demon, so worker culture can kill the demon, but it cannot kill the poses on the host, so the host is still protected. So you don't need to worry too much, but if we want to enable thunderbox, you need to specify security context dot the proc mount, but anyway you don't need to specify dot trilogy and, as miss was that you need to say comp and a perma.

A

You need to disable that. Actually. This is not miss at the moment because, but it's not problem, because sitcom is typically disabled by default when he burned days and aprama as well. Sometimes.

A

So you need to disable second probability demon, but you can still able second for worker continets will run instructions, so the worker county has still protected. So you don't need to worry worry too much about this user and in future we are considering supports a cobra range aprama using G browser, it's another little implementation in userspace by Google, and we have project based on G browser. It's wizard, it's Brazilian word: it's not really open its Brazil, it's reversible, Santa box project and such can be nested to in inside rusty containers.

A

So with boos, Earl and Randy, you don't really disable sitcoms and appear mark or Randy, and we can also mitigate potential vulnerability in the kernel or because we, which intercept all system, calls using Brazil but country. It doesn't work at this moment because she buys a doesn't implemented or Linux system course, and we are also rooting into possibility of using user model Linux.

A

This is similar to G wiser, but it's already 20 years old and provides almost a full compatibility with Linux, this kind of being forgotten, but it still arrived and it's also a project similar to Brutus ability. Its Kaneko about it different so Connie chorus as the built-in user, but it's unpledged, so you don't need to disable second and are perma. So there are some differences and koneko might be able to mitigate some variability that you just ability to connect me to do it and vice versa.

A

So if there is, there has some variability in corner brutaka, my to be weak and koneko might mitigate that. But if you had burner ability grants, the Keiko might be weak, so next topic is how to deploy.

A

So there are a branch of France such as deployment game estate, see the full state or job typical plan is to use accumulated deployment, but you can also choose using demons it it's better with regard to the pot placement because you can guarantee each other. Not each of the node has exactly one pot, but it's not always optimal, because it's all ready to hit demo local cache I mean that chess is a bit demon if you have a bunch of nodes.

A

So if your processor is version, your doctor has complex Damon said mightily not be optimal and you can also use stateful state, as you can make Tottenham's consistent. This is good for cautious hustling I would just I will discuss this to be greater.

A

And you can also deploy our ability to odd I call it demo report, so you can deploy visual city and cry and and the ability to demon in a single continent in a elevator put. So you don't need to manage the drive side of the demo and you are in a way.

A

You are build, request, a budget, it's the demon exists as well and who connecting to brilliantly the demons, the beautiful demon cameras on TCP and you can build a push in in just single gr, PC connection, so you can create a humorous service for nobility Deportes, maybe in deployment or demos it or a stateful sit.

A

That's right this and you don't need a real rule, the balance that you, you can just use a tourist service with dnas round-robin, and actually you don't necessarily need to create service, because bill city is CNY, shank, directly connected to a demon in the pod which our service it's implemented by using cube City music.

A

This is good when you are watching your project, you are wrapped up and you can use ability to in your cluster from here up top easily satellite this. So we can create put with Cuba city around and you specify the ability to host embarrassed by able to cube, put : sorceress be key and you can run velocities client and we also plan to add support for toka build X. It's the next generation of cry4, integrating Boudicca dog. It has a bunch of interesting features like building much architecture, images with remote machines.

A

It also has a new concept. It's called a big it's something similar to talk. A compost, build and docker built X will support collecting ability, demos running on kubernetes in the same lyrics as tok-san.

A

Expressed is trusting, so you can push your cash to a registry or you can also use some shared file system right, anyways for sharing your cash with other, basically instances. The residual cash is a very similar to classic dockable cash from, but it provides more chance of hitting cash, and we have also support one shared file system. This is good when you are building something judge: it's not a container and you verse 3. This is still bad deals gates for Billy the Kid, so that can be reckless.

A

You can use red story at the cash stretch as well as fire image switch, but remote cash might the base lower compared to the demo brokerage cash so, for example, from I what I shown is a part one without cash each took two meats and fifty fifty seconds and with the remote cash. You can build this image in 36 seconds, but this is still slow compared to the demo local cache, which just takes rather than a sequined.

A

So you can also cost using consistent hashing mode. So you can stick your build quests to a specific point put in a state for set. So you're building quest can always hit a demo local cache in support.

A

So we had some circular hash string space and we apprised same hashing function to put names and docker file names, so we can assign local files to support such a clockwise order, so the ability to D 0 has passed docker file and beauty to D. 1 has cooked docker file. Beauty to D, 2 has brought docker file with d3, has food, ok, fine, and even if we're looking to d3 has crashed bill.

A

Key to d0 can take over the few token file write this, and if we have some new talk of while each camp be assigned to somewhere in this circular hostile space English example be the key to d2. We handle the new docker file. A cube took a while, but coastal hosting is not the panacea. It was aiyoo. Overhead may concentrate, concentrate specific set of notes and some notes might not be used at all.

A

So if your cash register is first enough for you at dockerfile, I suggest using remote cash with some broader branding. But if your wrist is through or your doctor files is very complex, you can consider using consistent hashing and you can avoid transferring cash.

A

So last topic is C or D, so we see our D. We can use Yammer for everything and so a we can use coupon this API, whose entire workflow and some CRD projects for building images. The first project was continue. Builder interface, CBI and this dispositive had supported a bunch of image builders such as build kit, and it was to support it Kaneko or Google crowd, contributor and open safety, fewer and rotor or other builders, but it had very complex design with lot of micro services and it failed it's now being deprecated.

A

The second project is a creative, build, its tsipras NCBI in easily extensible, but there is also another project Tector, which is spun out from creative, it's much more simple and accessible, and it looks like Tek doum, a repressed, bigger component of creative, so which sector you can create a new object called task graph, and you can specify the builder kit as a task.

A

You can also specify other image builder tasks, such as builder from red, hot or a crank over Google and much so from uber justice for ssh credential is a secret and you can specifies you are deep triple right. This, it's called resources as a secret is associated with the service account, and similarly, you can also specify the register write list in the guest list. I understand credit in the secret associate with the service account.

A

That's all my talk to wrap up beta. It is first and secure, and it has some similar deployment plans with a demon or with a demon, if you the probability built it as a demo. For example, you can deploy like this, so you have demons it and you have headless service and you have bility to client that it can be managed by Tecton pipeline and we need more contributors. So if you are interested in contributing to build it, please join us. Our developer is a jicama stress, Mobius trust bitter treat thanks.