Cloud Native Computing Foundation KubeCon + CloudNativeCon Europe 2020 - Virtual, 4 Sep 2020

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Sharing Is Caring! Push Your Cloud Application to an OCI Registry - Silvin Lubecki & Djordje Lukic

Description

Don’t miss out! Join us at our upcoming events: EnvoyCon Virtual on October 15 and KubeCon + CloudNativeCon North America 2020 Virtual from November 17-20. Learn more at https://kubecon.io. The conferences feature presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects.

Sharing Is Caring! Push Your Cloud Application to an OCI Registry - Silvin Lubecki & Djordje Lukic, Docker

Did you know that you can store anything into a container image registry? Did you ever wonder what black magic is behind multi-arch images? OCI Image specification is a standard purposely generic enough to enable use cases other than “just” container images. While working on the Cloud Native Application Bundle (CNAB) project, we built tooling to package whole applications as OCI Images so that they could be pushed to and pulled from registries. We learnt a lot doing this and would like to share with the community. During this talk, we will have a quick but in-depth view of: * The OCI Image specification and its future * How to push a multi service application to a registry * Our battle scars with the different interpretations of the OCI spec by the mainstream registries

https://sched.co/Zemr

A

Hello and welcome to this talk sharing is carrying push your cloud application to an audio registry. I am silva lubecki senior software engineer working at docker.

B

And my name is georgia lukic, and I am also a senior software engineer, working at docker.

A

So why this talk last year we worked a lot on synapse specifications and we were trying to figure how to share a cloud application without reinventing the wheel. The obvious answer was to reuse the container registry infrastructure.

A

We will share the knowledge required working on the synaptosci library to push and pull application artifact on the registry. Together, we will run through the following outline of this presentation.

A

We will first talk about container registries in 36, so you will know what really happens behind the docker push in a docker pool.

A

Then in a second part we will go deeper and decipher what we did on cnab, pushing a whole application to a registry.

A

So, first, let's talk about container registries and how they work.

A

So what is a container registry? It is an http rest server that stores and shares container images. They can be public like docker hub or you can run your own private registry like harbor.

A

The registry is follow the distribution specification protocol. We will see it briefly in a few slides.

B

So container registries are following the open container initiative specifications which are which were inspired by the docker registry protocol and it the specification is split into three different specifications.

B

There is the distribution one which focuses on the rest protocol itself. The image specification describes the objects that are stored in a registry and also how they link together and there's. Finally, the runtime specification that explains how to execute a container once all the objects have been have been pulled for the registry.

B

There is also the run c project, which is an implementation of this runtime specification, and this one is used by docker or container d.

B

So now, let's see what's an oci image. So a container image is the sum of an oci, manifest that you can see on the left on configuration objects and a set of layers.

B

The manifest is specific for an architecture and an operating system, and all it really does is just points to the configuration object and the layers using content digests.

B

So that way, a client knows what objects he needs to fetch from the registry. The layers contain the actual data of the container and they are stored as star gzip gloves inside registry.

B

The configuration object itself describes some metadata, like the author or the image creation date, and it also holds the execution parameters for the container like the exposed ports or the entry point of the container, and it also contains another list of layers.

B

So just a little note is that the manifest itself is used for the distribution part and the configuration object is used by the container runtime to execute the image. uh So, let's see how how does a manifest look like? So it's basically just a json object, and if you look closely at the objects for each layer in the configuration you can see that they are represented by the same object, and this is what we call a content. Descriptor and the content. Descriptor has different fields which are which are the media type.

B

Is the media type of the content it has its bite size of the raw content.

B

There's also a content identifier that we call digest and finally not shown here, but we will see briefly, is the platform for that content. Descriptor.

A

So now, let's see what happens when I pull an image. So when I put an image, so many things happens behind the scene.

A

First, we ask the registry to resolve the image reference which returns the descriptor, pointing to the manifest.

A

Then we can fetch and pass the manifest, which gives us references to the config objects and all the layers, and so we can download everything in parallel.

B

So now, let's see the other way around what happens when you push an image.

B

So when you push an image, you first need to push all the contents, so here I'm pushing my layer, the first layer, the second layer and every each time I clear the registry returns a descriptor.

B

Now once I pushed all the layers, I can push the configuration object too and once I've pushed everything I have all the other descriptors and I can finally push the manifest itself.

A

And now, let's see what is a multi-arch ocr image to run the same image on multiple platform like linux or windows or md64 and arm, we will need one manifest for each platform and we introduces oci indexes to address that.

A

An oci index provides a list of manifests for different platforms, and one platform is a couple os and architecture.

A

As seen before on the oci, manifest voicier index uses descriptors to reference other manifests, it adds the optional platform property, so the client knows which manifest it needs to pull for the the right platform.

A

A media image is basically just a collection of images, but this architecture is not restricted to unlimited images, and we can do much more with it.

B

And now, let's see, how does a registry store all these images, so a container registry store them inside the repository. Now, let's see how that works. So the repository can contain multiple different artifacts with multi with different media types.

B

So you can have configurations you can have layers or manifests or index and even just blobs. It also contains tags.

B

A tag can point to any any different context and also wanting to note a tag can also be overwritten. So it's not immutable.

B

For example, the latest tag is often used to to to point to the latest version of your of your image and note also that each artifact inside the repository has a digest and that's what we use to to point to the to the content itself and that's for.

A

Me and now, let's see uh what is an image reference, a tag or digest, there are multiple ways to reference: the same image you can use a short notation like, for example, the line, one for official images, for example nginx or you can see on line 2 for custom repository, and this is expanded to the full notation on the right, appending, docker.ios library and adding the latest tag by default.

A

The third line is pretty much the same as the first two ones except, but we are using a custom registry.

A

You can, as seen on i4, also set a specific tag, which is also called a fully qualified artifact reference.

A

As we said earlier, a tag is mutable, and sometimes you want to be sure to always get the same image or blob, and for that we use the digesting notation on line 5. You can see an example of such an addition.

A

A digestive notation can also include the tag, but that tag is ignore, ignored in this case, and only the digest is used. You can see that on my six, so usually you will use the digested notations when you want to bruise disability such as a prediction of the arrangement and if you sign the manifest with notary, it's a way to avoid someone tempering with the image contents.

A

But this is out of scope for this talk.

B

And now we are going to talk about a case study. So last year we managed to push a cnab application to a registry using only using the oci building blocks that we just saw.

B

So first, let's talk about a little bit about what's cnab, so cnab is the cloud native application bundle specification, it's not a tool it it's it's it's a specification to for a way to package and deploy your cloud native applications and specification handles the installation, the upgrades and the uninstallation of your application.

B

It can also have your application can also have parameters and credentials if needed. So seen, bundle is a set of service, see bridges which, which are the parts of your application. It has also an installer image and also a manifest, which is called the bundle.json and different tools implement this specification like the docker, app or porter from these labs and there's. There is also finally the duffel, which is the reference implementation, and thanks to this.

B

Thanks to this, we can now push and pull multi multi-service applications to a registry, and then we can use multiple tools to install or uninstall, and we put a link. So you can check out the specification if you want so here's um an example of a bundle json.

B

What you can see. It has some metadata like the name or the description of the application.

B

It has the invasion image, which is also called the installer image, because this is the image that will effectively install your application and then, finally, there are some images which are to your service images of the application, and so yeah, like I said before, the bundle can also define credentials and parameters which are injected in the installer container at runtime.

A

So now, let's see how we can push a bundle as an aussie index.

A

The first version of cena specification are the distribution part, but we quickly realized that we can leverage the oci specification, thanks to it being just a graph of content descriptors with different media types.

A

The ocr specification doesn't restrict the use of oc indexes to multi-arch images. You can store almost anything you want. As long as you meet the specification and it's quite open.

A

We use this openness to push the bundle.json, but also the invocation image of installer and the service images.

A

It pushes everything in the same repository, so one has a guarantee that when someone pulls her or his bundle, all the components can be pulled as well.

A

The structure of the synapse is like a multi-arch image, but it differs in that its components are not platform-specific images but different parts of the synapse. It contains descriptor that points to the blob where we store the original json of a bundle.

A

It then lists the invocation and service images of a bundle with this architecture. You can push store and share your wall application with multiple services as a single artifact to install a bundle. The signa brand time will fetch the ocr index, resolve the config, object, storing the bundle.json and then execute the installation as if the bundle was stored locally.

A

B

Time for demo now it's time for a small demo. So let me share my screen right. Can you see my screen?

B

I guess you can okay. So in this demo we are going to take a synap, a cinema application and then push it with one tool and then uh pull it with another and then run with the thread tool. So this is the application we are going to use so like before. Like I said, you can see some metadata with the name, the schema version, the version of the application, the description and everything else. So it has also the invocation image. This one is.

B

This is a small invocation image that was done, but the box that worked on cnub, which uh responds to each to the installation, but we'll just output, a message: it won't really install the image, the application, sorry and then you have the images we have one nginx and one redis. Here we put the the content digest and not the tag, because these are. These are multiplatform images, and my internet is not really great here, so I just wanted to push one image not for every platform over there.

B

So we are going first to push this application with the tool that we worked on with silva, which is called synaptosci.

B

So this is, let's just see, what's happening here, so we're calling we added some log level debug so that we can see closer what's happening. We want to push so I have so I forgot to show I have my hardware repository registry running locally and it's it doesn't have https.

B

So I need to tell to synaptic ci that hybrid.io is an insecure registry and I want to push my bundle.json.

B

uh So let's just talk a little bit about this flag, so the auto update bundle will tell the to the synaptoci tool to go over each of the images and the evocation images and resolve the digests. So these two images are already resolved, but the invocation image is not resolved, so it will go over and look at the at the content digest of this image and this is needed for um for for synaptic ci. So that way, when you push it, it knows exactly what to push when it pushes.

B

And finally, I just give it tag and let's go.

A

So what happened here? um First, we we have a fixing step where we need to resolve all the digested reference and update the cena bundle in memory with it before pushing it.

A

For that we copy all the images, the installer and the service images from the docker hub to the hardware instance inside the same repository and then retrieve the descriptors written by the registry.

A

Then the bundle is muted and now it's immutable. We don't need to imitate it again. It has every digested reference, updated and it's ready to be pushed. Then we push it as a config object.

A

We create a manifest a new, manifest pointing to the config object and push it to our bar.

A

Then we create the oci index, pointing to the c9 bundle manifest to the installer image manifest and to the service images manifest and all again, everything is in the same repository and in vn we get the digest of your ci index computed by the registry.

B

Right now, let's see what's going on over at the harbor. So if I refresh my page, I can see that we really did manage to push our application. So if you go over there now, one thing you can see is this little icon here, and this is the logo of this of the synap specification. So the hardware registry knows how to handle um knows. What's sorry.

A

Yeah, it knows it's in a media type.

B

It knows the scenar media type. Yes, thank you, uh and now, if we go and see what's in there, we can see that we have the our evocation image, our two service images, and this is uh our bundle that we pushed as it is adjacent. So, let's just compare that to what we pushed to this oci index that we pushed here.

B

So just a sec, I need to tell it it's json and if I format okay, so this is the ocr index that synaptosci pushed. So maybe I can show them like this, so you can see that there's there is the the configuration here. It's shy it's 96b, so we can hear we can see it over here. Then we have the invocation image with the shot, a a59 which is also over here and then the nginx component and the radius component.

B

So basically what we did here is we took this bundle json, which is the synap application, and then we converted it to this uh oci index.

B

Now, what can we do with this? This is great because we just managed to push an application, but it would be even more awesome if we could do something with it. So now we're going to use the tool made by dayslabs, which is called porter, so I can with potter. I can install this install this application uh same as before. I need to trade that this is an insecure registry.

B

I give the name for the installation and then I tell it what to install. So. If I, if I don't install what you can see, is that it it pulled, it pulled the application and then it executed the the invocation image which just printed out that this is the installation that was called now. We can also inspect inspect the application, and porter can see that it has one invocation image and then it has the nginx image and the redis one.

B

And finally, we can try to do the same like water install, but with docker up a docker app. This is called the run.

B

So if I do docker app run- and I give it then the name of my application- we can see that it executed the same invocation image and we can see the same output, which is the install action here and that's pretty much it for the.

A

Demo, great, thank you. um So um that's a theory of course. I know. Let's talk about the practical issues we had. um As you surely guessed, this doesn't work on all container registries. um Some like nexus. Don't support multi-arch images at all some registries, don't like the fact that we have custom media types and others don't like, but we are missing manifest lists and oci indexes.

A

Sorry lots of issues.

A

Fortunately, there's no conformance test to it that will help implementers to be more in line with the specifications.

A

Also. Last year, voci announced the artifacts project that will extend the reach of a single repository to encompass multiple artifacts, such as kubernetes deployment files, helm, charts and other evolving formats. Alongside.

A

Containers here are some tools and library, libraries uh we use for synaptic sei.

A

The first one is the docker distribution library, which is used by almost all registries. We also played a lot with container d libraries to play with container images.

A

We also have the google one, which is pretty good, there's, also a really good tool which is dive to check what's inside an image layer by layer and, of course, uh or synap io, slash, synaptoci library that we gave to the scenabilio organization this year.

A

Well, thank you for listening to this talk and let's now have a q, a section.

B

A