►
From YouTube: Education as a Service: Containerization and Orchestration of CS50... Kareem Zidane & David J. Malan
Description
Join us for Kubernetes Forums Seoul, Sydney, Bengaluru and Delhi - learn more at kubecon.io
Don't miss KubeCon + CloudNativeCon 2020 events in Amsterdam March 30 - April 2, Shanghai July 28-30 and Boston November 17-20! Learn more at kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects
Education as a Service: Containerization and Orchestration of CS50 IDE - Kareem Zidane & David J. Malan, Harvard University
CS50 is Harvard University's introductory course in computer science, freely available as OpenCourseWare, with hundreds of students on campus and more than one million registrants online. So that students have a uniform environment with which to begin programming (without client-side technical difficulties in the way), the course provides CS50 IDE, a free, cloud-based solution. To minimize cost and avoid homegrown orchestration of VMs, the course transitioned to pods, one container per student. But the migration was not without challenges. How to provide users with ephemeral containers but persistent storage? How to proxy arbitrary ports to students' own web services? And, ultimately, how to provide students with the abstraction of their own machine, without k8s-specific implementation details clouding their own understanding thereof? In this talk, CS50's own solutions thereto.
https://sched.co/UaXy
A
So
indeed,
this
is
a
map
that
depicts
some
of
the
communities
that
this
course
has
built
up.
Over
the
past
few
years,
red
dots
represent
high
schools.
Blue
dots
represent
universities
and
nonprofits,
who
have
been
adapting
or
adopting
the
course
in
some
form
and
using
its
curriculum
and
in
turn
its
tools
to
teach
computer
science
locally,
so
that
the
course
is
not
strictly
a
MOOC
or
massive
open
online
course.
A
A
The
course
happens
to
be
primarily
in
C,
followed
by
a
bit
of
Python
at
the
end
of
the
semester.
So
the
first
thing
students
are
using
are
GCC
or
now
clang,
gdb
and
other
command-line
tools.
The
picture
that
they
see
when
they
log
in
is
just
this
a
black
and
whites
interactive
terminal
with
which
you
might
be
familiar
and
tapaa
topologically.
A
What
we
implement
it,
or
rather
what
Harvard
had
implemented
with
some
load
balancer
that
routed
traffic
across
a
bunch
of
systems
there,
but
unfortunately,
because
Harvard
the
University
was
running
this
we
didn't
have
administrative
or
pseudo
access
as
the
instructors.
This
made
it
hard
to
maintain
the
latest
versions
of
software
that
we
wanted.
A
There
was
pretty
much
just
ec2
and
a
couple
of
other
things,
and
so
we
had
to
build
ourselves
using
virtual
machines
that
same
topology,
but
in
the
cloud-
and
we
did
this
for
a
few
years-
the
picture
ended
up
being
pretty
much
exactly
the
same,
but
it
was
all
now
cloud
based
and
we
replicated
the
architecture
we
knew
well.
The
upsides
were
we
had
all
of
the
features
we
always
wanted.
The
downsides
were
that
we
suddenly
realized.
We
were
now
our
own
system
administrators,
which
was
not
without
its
challenges
as
well.
A
Human
costs,
particularly
since
our
primary
goal
is
to
teach
not
necessarily
to
administer
so
over
time.
We
considered
other
possibilities
and
we
evolved
ultimately
for
several
years
into
what
we
call
the
cs50
appliance,
a
downloadable
virtual
machine
running
Fedora,
initially
than
Ubuntu
that
students
could
run
on
their
own
Macs
and
PCs,
but
this
was
primarily
motivated
by
our
open
courseware
initiatives.
Even
though
we'd
made
all
of
the
courses
assignments
and
lectures
and
videos
and
PDFs
and
everything
freely
available
for
years,
it
was
still
a
pretty
passive
experience.
A
For
many
years,
students
could
try
to
figure
out
on
their
own
Macs
and
PCs
how
to
replicate
this
Linux
or
UNIX
like
environment
that
Harvard
students
had
access
to,
but
we
just
weren't
in
a
position
10
years
ago
to
give
everyone,
shell
counts
or
strangers.
No
less
shell
accounts
on
the
internet
to
do
with
it
as
they
see
fit.
So
we
instead
did
this
client-side
things
so
that
they
would
have
an
identical
environment
but
completely
sandbox
to
locally
this.
A
Of
course,
too,
was
not
without
its
challenges,
but
it
did
give
us
a
nice
graphical
user
interface
still
with
the
terminal
window
code
editor
and
the
like.
So
it
was
a
little
more
user
friendly,
but
technical
challenges
were
frankly
more
mostly
than
we
had
hoped
stupid
things
to
networking
adapters
on
Windows,
not
quite
working
between
the
virtual
host
and
the
local
machine
and
other
sort
of
headaches
like
that.
A
A
So
our
goal
to
be
clear,
was
not
to
have
a
sort
of
playground
type
environment
for
programming,
but
we
wanted
this
cloud-based
environment
to
be
as
representative
of
what
they
might
use
in
the
real
world
on
their
own
machines
and
then
a
file
browser
here
at
left.
But
there's
a
number
of
more
pedagogically
in
software
engineering
features
as
well.
A
On
the
right
hand,
side
is
a
collaborative
window
where
they
can
chats
if
they're
doing
peer
programming
or
if
we
have
a
student
halfway
across
the
world,
can
we
chat
with
them
interactively
along
the
top
if
they
enable
it
is
a
reversion
of
version
history.
So,
in
addition
to
any
command-line
tools
like
get
in
the
like,
they
can
literally
just
scroll
back
and
forth
in
time,
which
is
much
more
accessible
to
new
programmers
on
the
right-hand
side.
A
Thanks
to
our
team
and
Kareem,
there's
a
graphical
debugger
underneath
the
hood
it's
still
using
gdb,
but
it
wonderfully
lets
students
see
their
stack
and
variables
and
so
forth.
So
a
lot
more
user-friendly,
certainly
in
the
earliest
weeks
of
the
class.
And
all
of
this
is
thanks
to
what
was
previously
a
startup
cloud.
9,
some
friends
of
ours
there
with
an
open
source
SDK
on
top
of
which
we
started.
B
All
right,
thank
you
so
much
David.
So,
among
the
reasons
why
we
chose
cloud
9
early
on
was
that
it
was
nicely
extensible
in
a
way
that
allows
us
to
easily
customize
and
extends
the
user
interface
and
user
experience
to
make
it
hopefully
more
accessible
to
students
who
are
first
sort
of
encountering
something
like
this.
B
Now,
after
the
acquisition
by
a
divested
cloud
9,
they
decided
to
change
this
model
a
bit,
and
so
they
decided
to
back
the
compute
environments
of
this
cloud9
IDE
that
we
saw
a
moment
ago
by
ec2
instances
that
would
live
in
users
accounts
now.
I
could
see
at
least
two
reasons
why
this
is
not
ideal
for
our
use
case.
B
Now,
by
default
in
case
of
cloud
9,
this
compute
resource
happens
to
be
an
easy
to
innocence,
and
so
what
we
ended
up
doing
really
is,
since
cloud
9
decided
to
stop
doing
orchestration
is
we
have
to
implement
the
orchestration
on
our
own
and
so
the
straightforward
approach
that
we
went
to
to
use
easy
to
as
well
for
orchestration.
So
we
wrote
our
own
simple
orchestration
tool
that
orchestrates
easy
to
instances
and
uses
EBS
volumes
to
persist,
students,
files
and
folders,
so
things
like
their
assignment
files
and
project
files
and
so
on
and
so
forth.
B
And
so
we
started
out
by
having
a
warm
pool
of
ec2
instances
and
one
availability
zone.
And
this
is
just
to
make
things
faster,
I
mean
or
not
to
wait
for
the
ec2
instance
to
start
in
order
to
connect
the
IDE
to
it.
But
of
course,
there's
more
than
one
availability
zone
each
in
each
region
and
there's
even
more
than
one
region
that
we
want
to
operate
from
within.
And
so
you
can
imagine
that
this
got
pretty
complicated
very
quickly.
But
here
are
some
of
the
steps
that
we
would
do
in
order
to
create.
A
B
Or
like
a
redirect,
a
user
to
an
IDE
once
they
visit
IDE
to
see
a
scenario,
we
would
first
get
an
available
ec2
innocence
from
the
pool.
We
would
create
the
user's
EBS
volume
attach
it
to
the
ec2
innocence
format.
It's
create
a
file
system
on
a
mountain
on
the
innocence,
starter
docker
container
mount
the
volume
on
the
talker
container
exposed
some
of
the
pores
connect,
the
IDE
to
the
container,
that's
running
on
the
instance
and
then
finally
redirect
the
user
to
the
IDE
and
so
just
to
have
an
idea.
B
Here's
the
diagram
that
represents
how
this
would
look
like.
So
we
have
the
cloud9
IDE
from
10
connected
to
the
container
using
SSH,
which
is
quite
unusual,
I
know
through
the
ec2
innocence,
and
then
we
have
the
EBS
flowing
the
persist,
students,
files
and
folders,
and
so
what
are
some
of
the
challenges
that
we
had
with
this
approach
for
compute?
B
We
have
to
get
down
to
the
level
of
using
SSM,
which
is
another
Amazon
Web
Services,
that's
used
to
run,
commands
remotely
in
ec2
instances
to
do
things
like
starting
the
docker
container
and
so
on
and
so
forth.
We
had
to
allocate
an
entire
ec2
innocence
for
each
user,
even
if
the
users
not
really
does
not
really
need
the
entire
ec2
instance.
For
the
purpose
of
the
course
there's
not
read
the
entire
amount
of
resources.
That's
on
the
innocence.
After
the
session
ends,
we
have
to
do
some
cleaning
up.
We
had
to
terminate
the
innocence.
B
B
We
so,
since
we
terminate
the
innocence
after
each
session,
when
the
user
comes
back
again,
they
would
get
a
new
innocence
with
a
different
host
name,
which
made
things
a
bit
complicated
in
terms
of
this
age
connection,
because
now
this
H
parameters
are
different
and
also
students
working
on
web
projects.
Inside
of
it
or
IDs.
They
would
get
a
different
host
name
every
session,
which
was
quite
annoying.
We
had
to
remove
the
instances
temporarily
from
the
pool
to
optimize
for
the
storage
on
the
innocence
to
update
the
darker
image
on
this
innocence.
B
Alright,
these
are
also
some
of
the
challenges
that
we
had
with
EBS
for
persisting
students
files.
So,
in
the
same
for
the
same
reason,
we
also
had
to
allocate
an
entire
EBS
volume
for
each
user,
which
wasn't
quite
closed
effective
because
it's
not
necessarily
the
case
that
the
user
is
gonna,
use
the
entire
space
of
it
on
this
EBS
volume
and
we
had
to
assign
each
user
a
specific
availability
zone.
B
Okay,
so
we'll
come
back
to
the
compute
challenges
in
a
moment,
but
in
an
attempt
to
solve
some
of
the
storage
challenges
we
tried
out
as
three
instead,
so
we
would
create
a
prefix
or
a
folder
on
s3,
give
it
you
for
each
user
and
then
give
each
user
read
or
write
access
to
this
prefix
and
folder.
And
then,
when
the
user
would
come
in,
we
would
download
this
their
data
and
then
upload
it
periodically.
B
So
here's
here's
the
diagram
that
represents
something
like
this
pretty
similar
to
the
previous
diagram,
except
instead
of
EBS,
we
use
s3,
and
so
what
are
some
of
the
challenges
that
we
had
with
this
three
approach?
Well,
since
we're
creating
separate
folders
for
each
user
and
we're
granting
them
read
and
write
access
in
this
folder,
we
have
to
set
up
some
sort
of
credentials
to
grant
them
this
axis
and
we
have
to
refresh
those
credentials
between
sessions
as
well,
which
added
a
lot
of
complexity.
B
We
have
to
download
the
data
initially
like
I,
said
and
upload
it
periodically
to
sync
the
data
up,
and
then
there
was
no
really
by
design.
S3
was
really
designed
to
be
elastic,
so
there's
not
really
a
clean,
easy
way
to
sort
of
limit.
My
user
can
store
in
their
folder
okay,
so
we
started
considering
other
orchestration
tool
among
them
was
AWS
Fargate,
which
is
another
orchestration
service,
that's
offered
by
AWS,
but
unfortunately,
one
of
the
limitations
that
Fargate
has
it
doesn't
have
image.
B
Newer
tasks
seem
to
take
a
lot
longer,
which
wouldn't
play
nicely
in
our
use
case,
and
then
finally,
we
considered
kubernetes
for
orchestration,
and
so
these
are
some
of
the
steps
that
we
would
follow
right
now
to
create
a
user's
IDE.
So
we
create
a
namespace
per
user.
We
create
a
persistent
vow
in
flame,
to
request
some
storage
to
process
the
students,
files
and
folders.
We
create
a
single
container
pod
mount
the
PVC
on
it
mount
the
public
SSH
key
to
establish
a
stage
connection.
B
We
connect
the
IDE
to
the
container
and
then
we
really
like
redirect
the
user
to
the
IDE.
So
here
are
some
of
the
solutions.
Here
are
some
of
the
the
solutions
to
some
of
the
challenges
that
we
encounter.
That
kubernetes
helps
us
helped
us
with.
So
previously
we
had
to
maintain
pools
of
ec2
instances
like
I
mentioned,
but
now
cribben
is
really
manages
the
node
for
us
with
little
to
no
interference
from
us
at
all.
With
with
the
management
of
these
nodes,
we
used
to
get
down
to
the
level
of
running
SSM
commands
to
start.
B
We
used
to
remove
the
instances
temporarily
from
the
pool
to
update
the
docker
image,
but
now
we
actually
use
a
kubernetes
resource
called
the
daemon
set
to
basically
pull
the
image
on
every
worker
node
that
we
have
pretty
easily.
Okay
now
for
storage
challenges,
we
use
a
tool
called
port
works
and
port
works.
B
The
storage
capacity
that
we
have
optimizing
use
of
the
source
capacity
that
we
have,
and
so
here
are
some
of
the
challenges
that
we
face
with
with
ABS
before
and
how
port
works.
Help
us
solve
these
challenges.
So
we
use
the
provision
entire
EBS
volume
for
each
user,
but
now
port
works
helps
us
actually
thinly
provision,
this
storage.
So
it's
not
necessarily
that
you
say
I
want
a
one
gigabyte
volume
that
you're
necessarily
taking
one
gigabyte
from
the
capacity
until
the
user
is
actually
using
the
one
gigabyte
and
we
also
take
snapshots
the
s3.
B
Like
I
mentioned.
We
used
to
assign
availability
zones
to
each
to
each
user,
but
now
poor
works
actually
manages
the
EBS
volumes
for
us
and
manages
the
manages
a
provisioning
of
PBS
volume
as
well.
So
we
don't
really
have
to
worry
about
care
about
that.
With
the
s3
approach,
we
used
to
do
things
like
set
up
and
refresh
the
credentials,
download
and
upload
user
data,
and
there
was
no
easy
way
to
limit
the
size.
B
B
But
this
is
a
graph
from
our
Google
Analytics,
dashboard
and
I
chose
the
activity
of
how
many
sessions
we
get
per
day
and,
as
you
can
see,
since
the
start
of
semester,
we
get
about
8,000
to
8,500
users
per
day,
and
this
solution
seems
to
be
working
well
so
far.
Here's
some
of
the
future
work
that
we
have,
since
this
is
a
freely
available
tool
for
anyone
online.
B
Some
people
actually
misuse
this
tool
for
things
like
crypto,
mining
or
ddossing,
some
remote
hosts
or
sending
spam
email,
and
we
try
to
do
our
best
to
minimize
some
of
these
activities
and
prevent
them.
But
it's
not
an
easy
challenge.
As
you
may
know,
we
also
want
to
have
multiple
clusters
in
the
same
in
the
same,
maybe
region
or
available
in
the
same
regions,
or
even
maybe
maybe
even
in
different
regions,
and
we
want
to
be
able
to
give
multiple
IDs
for
each
user
to
simply
use.
B
You
know
different
IDs
for
different
courses
or
maybe
even
based
on
different
docker
images
and
so
yeah
that
was
it
I
highly
encourage
you
to
go
get
the
idea.
Try
the
ETS,
50
I/o
and
give
us
some
feedback
and
we're
gonna
stick
around
for
questions
and
if
you
want
to
reach
out
to
us,
there's
our
emails
right
there.
Thank
you
so
much.
B
So
the
question
is:
what
made
us
go
with
port
works?
We
looked
into
other
solutions
like
I
said,
like
we
try
to
be
asked
me
to
try
those
three
that
didn't
work
out
quite
well.
We
tried
very
briefly
storage
OS
as
well.
It
wasn't
as
easy
to
get
started
with,
and
so
port
works
seem
to
be
pretty
popular,
seem
to
have
a
good
community
around
it
and
they
have
been
amazing
support
wise
as
well.
Yes,
yes,.
B
That's
a
good
question:
we
have
so
port
works.
We
have
multiple.
What's
up,
oh
sorry,
be
requestion,
so
the
question
is:
what
is
the
maximum
of?
What
does
the
maximum
storage
look
like
for
us?
So
we
have
a
bunch
of
EBS
volumes
that
are
provisioned
and
managed
fully
by
port
works
for
us
and
I.
Think
the
total
size
of
these
is
something
like,
maybe
10,
terabytes
or
so
I
think
I'm,
not
quite
sure,
but
we
can
resize
this.
We
should
be
able
to
resize
this
pretty
easily
as
we
need
good
question.
Yes,.
B
That's
a
good
question.
So
what
was
the
impact
of
the
operational
cost
as
well
as
the
monetary
cost?
I?
Don't
have
exact
numbers
right
here,
but
I
can
I
can
maybe
speak
more
on
the
operational
side
of
things.
I
highlighted
some
of
the
some
of
the
challenges
that
we
had
with
the
previous
approach,
some
of
the
things
that
we
had
to
worry
about
and
implement,
and
now
just
using
the
kubernetes
api
to
like
create
the
resources
that
we
need.
It's
just
pretty
straightforward,
I,
don't
have
to
worry
about
as
many
sort
of
low-level
details.
B
A
Whereas
previously
what
every
student
would
have
one
ec2
instance,
albeit
a
small
one,
now
we
can
run
as
many
as
80
containers
on
one
instance
granted
a
bigger
container.
So
there's
some
wash
there
storage,
though
we've
been
more
compellingly
previously,
we
could
allocate
a
gigabyte
per
student's
minimally,
and
now
we
can
do
that
much
more
thinly.
As
Bree
noted.
B
Correct,
yes,
so
that
varies.
Unfortunately,
it
varies
manually,
though
so
we
have
to
scale
up
and
down
manually
right
now,
and
the
reason
is
because
our
compute
cluster
is
the
same,
is
the
same
cluster
as
the
storage
cluster,
but
we
have
one
of
the
one
of
the
things
on
our
to-do
list
is
to
basically
isolate
the
search
cluster
from
the
compute
cluster
to
be
able
to
dynamically
scale
up
or
down
the
compute
cluster,
as
we
please,
yes,
I.
B
That's
a
great
question:
the
question
is:
why
cloud
9
I
note
something
like
vs
code,
and
the
answer
is
that
we've
been
actually
using
cloud
9
for
a
few
years
now
and
so
most
of
the
extensions
most
of
the
plugins.
Most
of
our
ecosystem
is
actually
built
around
cloud
9
and
we
also
have
like
they
give
us
a
good
support
as
well
and.
A
Several
years
ago,
when
we
first
started,
we
don't
want
to
run
software
client-side
if
we
can
avoid
it
just
too
many
technical
support
headaches,
we
at
least
want
to
have
an
option
for
a
cloud-based
environment
for
new
students,
and
it's
recently
now
that
there's
like
on
lined
up
visual
studio
comm,
which
is
actually
getting
much
closer
to
this
kind
of
architecture.
Unfortunately,
that
one
too
is
still
tied
to
an
individual
users,
microsoft
account
and
credit
card,
and
the
like
and
there's
not
yet
the
abstraction
that
we
could
provide.
On
top
of
that.
B
B
C
B
B
B
The
question
is:
do
we
profiles
prioritize
students
over
external
customers,
we're
hoping
so
we
definitely
get
rid
of
the
students,
and
this
is
meant
to
be
a
very
specific
tool
to
be
used
with
with
the
class
and
that
has
its
upsides
and
downsides.
One
of
the
upsides
that
it
has
is
that
it
allows
us
it
gives
us
more
flexibility
in
terms
of
what
we
sort
of
can
enforce
and
implement
in
this
environment,
because
we
have
certain
expectations.
B
B
B
C
B
Okay
right,
so
this
question
is:
do
students
have
to
take
any
manual
action
to
push
their
code
somewhere
and
the
answer
is
no
port
works.
The
source
platform
that
we're
using
actually
manages
all
that
for
us
and
abstracts
away
all
these
details
so
there's
a
write,
failure
that
happens.
They
do
something
on
their
end
to
retry
this
and
if
there's
something
fatal,
then
obviously,
if
there
might
be
some
data
loss,
but
students
don't
have
to
do
anything
manual
to
do
that.
B
B
B
C
B
So
we
use
the
Cougar
okay.
What
do
we
used
to
launch
a
new
powder
deploy
a
new
pod?
That
is
our
saying?
Okay,
so
we
actually
used
the
Cougar,
the
Python
client
for
the
kubernetes
api
directly.
So
we
have
our
back
end
at
ided,
SATA
I/o,
and
we
simply
use
the
API
to
start
a
new
pod
as
simple
as
that,
we
don't
use
any
CC,
ICB
pipelines.
A
It's
a
good
question:
pedagogically
the
plugins
are
a
great
appeal,
the
question
being.
What
would
be
our
priorities
in
terms
of
open
sourcing
things,
the
catches
right
now,
Amazon
support
for
third-party
plugins
is
still
very
nascent,
and
so
they
wouldn't
necessarily
yet
be
that
useful,
so
I
think
we
would
nudge
them
down
on
the
list
and
then
really
as
cream
says,
we've
been
developing
the
backend
really
for
internal
use,
thus
far,
there's
no
reason
it's
not
yet
open
source
other
than
we
need
to
document
and
clean
up.