►
From YouTube: Life of a Container - Indradhanush Gupta, Loodse
Description
Don't miss KubeCon + CloudNativeCon 2020 events in Amsterdam March 30 - April 2, Shanghai July 28-30 and Boston November 17-20! The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects - Learn more at https://kubecon.io
Life of a Container - Indradhanush Gupta, Loodse
What if I told you that there's no such thing as a container? Surprised? The first time I heard this I was taken aback as well. And when I started digging into the internals I found out that containers are nothing but a nicer UX for Linux namespaces and cgroups. If I wanted to run three instances of a web server serving traffic on port 80, do I need three separate machines? If you’re thinking yes, as no two processes can listen on the same port simultaneously, then the correct answer is no. Network namespaces make it possible to run them all under the same machine. And each of them can listen on the machine’s public network interface. In this talk you will find out what constitutes a container. The system calls invoked when a container is started, the resources used and their relation to the host OS and finally the teardown process when a container is deleted.
https://sched.co/YWJH
A
A
Much
simpler
right
and
that
begs
the
question
that
what
is
a
container
well
spoiler
alert.
There
is
no
such
thing
as
a
container
yeah.
There
is
no
such
thing
as
a
container
and
that's
pretty
much
the
end
of
the
talk.
So
that's
probably
the
shortest
talk
here.
So
thank
you
for
coming
to
my
talk.
I'll
be
hanging
outside
for
questions.
A
Okay,
I,
don't
know
if
you
bought
it
off
your
if
you,
if
you
plat
for
that
I.
Thank
you
for
that,
so
that
was
just
kidding
right
and
so
seriously.
What
really
is
a
container?
And
when
we
looked
around
it's
made
of
two
unique
concepts
called
namespaces
and
C
groups
are
control
groups.
We
look
into
each
of
these.
What
these
concepts
are,
but
before
that,
let's
just
try
to
understand
how
our
processes
created
in
a
Linux
box
or
a
UNIX
box,
and
they
start
you
will
have
something
like
a
parent
process.
A
This
parent
process
can
be
your
shell
terminal
or
your
application,
which
is
spawning
new
processes,
and
the
system
calls
to
create
a
new
process
is
called
a
fork
when
you
call
make
a
fork.
All
two
things
happen:
number
one:
a
child
process
comes
up
number
two.
The
parent
process
gets
a
child
PID
or
a
child
process
identifier.
A
So
now
that
we
understand
what
a
parent
process
and
how
a
child
process
interact
with
each
other
or
how
the
control
or
the
parent
process
control
this
child
process,
let's
try
understand
what
a
namespace
is,
but
quick
plug
I
wrote
a
detailed
blog
post
few
years
back
on
how
the
fork
works
exactly
so.
If
there's
a
much
detail
its
explanation
there,
if
you're
interested,
feel
free
to
check
this
link
out
and
in
the
meantime,
we'll
come
back
to
what
these
faces
are.
So
namespaces
are
an
isolation.
A
Primitive
for
resources
and
namespaces
are
isolating
seven
kinds
of
resources.
I
will
not
go
ahead
and
explain
each
of
them,
but
to
give
you
an
idea
of
what
they
do
is
if
you
have
a
network
namespace,
it
helps
you
isolate
your
network
resources,
so
in
a
way
it
simulates
two
different
computers
with
two
different
network
interfaces.
In
the
same
computer,
and
how
does
it
do
that,
so,
let's
go
ahead
quickly,
go
into
this
demo.
So
if
you
will,
please
pray
to
the
Democrats.
A
For
me,
what
I
have
on
my
terminal
here
is
two
independent
shell
processes.
This
command
gives
the
process
ID
of
the
shell
processes
that
I
am
running
and
to
start
a
new
process.
What
I
will
do
is
I
will
run
the
unshare
command
it
unshared
the
network.
It
ensures
the
namespace
from
the
host
namespace
there's
something
I
forgot
to
mention
is
that
when
our
system
starts
up,
it
has
all
the
default
hostname
spaces
already
set
up
for
you.
A
So
right
now,
both
the
shell
processes
are
running
on
the
exact
same
namespaces,
but
you
do
not
have
to
take
my
word
for
it.
You
can
just
verify
it
right
so
before
that,
let's
just
quickly
take
a
look
at
what
are
the
processes
running?
What
are
the
namespaces
of
these
processes
so
we'll
take
a
look
inside
the
proc
directory,
which
is
a
directory
that
keep
track
of
all
the
processes
currently
running
on
your
system
and
to
do
that.
A
We
do
this
and
this
lists
down
all
the
independent
processes
like
C,
Group,
IPC
e,
mount
net,
PID,
etc,
etc,
and
it
points
to
something
that
looks
like
a
weird
number
string
thing.
This
thing
is
your
namespace
ID,
and
this
is
unique
for
each
independent
namespace.
But
if
we
do
the
same
command
in
this
shell
that
I
have
in
the
lower
split,
we
will
see
that
it's
the
same
for
examples
for
C
group,
it's
for
0
to
6
whenever
any
in
183
5
right
so
quickly.
A
So
right
now,
they're
running
in
the
same
network
namespace,
which
is
the
host
network.
Namespace
I,
will
run
the
unshare
command
with
the
flag,
/
n,
and
that
will
create
a
new
network
namespace
and
once
again,
don't
take
my
word
for
it.
Let's
just
quickly
do
that
see,
there's
a
different
number
there
right
right
now,
right,
double
3
4!
This
is
a
new
namespace.
Now
there's
a
command
called
IP
net
NS
list
that
lists
down
all
the
network
namespaces
on
your
system,
but
it
doesn't
show
any
net
of
me
spaces
right
now.
A
We
just
created
one
right.
We
see
so
what
is
happening
here
like
what
what
what's
going
on
like
if
there's
an
uni
network
need
space,
and
it
does
show
up
that's
weird
right
now.
The
trick
to
this
is
the
IP
command
looks
for
namespaces
in
a
certain
directory
and
to
do
that
the
directory
would
be
var
net
NS,
let's
create
a
directory
called
child.
Now,
let's
run
the
command
again.
There's
an
error.
Demo
is
not
failing.
Yet
it
says
that
peer
net
NS
reference
is
invalid.
A
A
A
A
Not
that
child
directory
and
now
magically
it
finds
the
namespace,
and
there
is
no
error
now
there's
two
different
namespaces,
but
what
does
that
mean
if,
in
my
host
namespace,
if
I
pinged
this
this
would
work
right?
You
expect
this
to
work.
I
mean
this
is
the
fun
one
thing
you
always
expect
to
work,
but
doesn't
network
is
unreachable?
What
I
mean
what's
going
on?
So
let's
look
at
what
are
the
network
interfaces?
A
A
So,
let's
just
quickly
do
that
we
it
so
we
want
to
create
a
device
called
V
at
0
of
type
vs,
which
is
virtual
Ethernet
and
its
peers
name,
which
is
the
other
side
of
the
tunnel.
If
you,
if
Soviet,
is
called
vh1.
Now,
let's
took
a
like
take
a
look
at
the
devices
we
just
added.
We
have
two
virtual
Ethernet
devices
and
if
we
go
back
and
do
the
same
thing
here,
we
don't
really
have
it,
because
we
added
this
new
interface
in
the
hostname
space.
A
Now
we
want
to
put
this
interface
inside
the
child
namespace.
So
how
do
we
do
that?
To
do
that?
We
are
going
to
set
this
it's
one
device
into
the
net,
NS
called
child,
pretty
simple
IP
link
set
V
at
one
set
this
device
inside
the
specific
namespace,
and
if
you
look
for
it
again
now
we
have
both
the
independent
interfaces.
Wait
hold
on
a
second.
A
Yeah,
okay,
that
makes
it
easier
here
again
they
don't
have
any
address
associate
associated
with
it.
They
do
not
have
any.
This
state
is
also
down.
So
you
have
just
it's
if
you
think
about
the
computer's
you've
barely
just
plugged
in
your
network
interface
card,
and
it's
just
there-
you
haven't
yet
configured
it.
So,
let's
quickly
go
ahead
and
configure
it.
A
A
Oh
okay,
this
one
is
called
v81
naming
is
the
hardest
thing
folks
and
let's
just
ping
the
other
side
of
the
tunnel,
and
we
are
able
to
bring
it
and
from
the
other
side.
So
both
ends
are
now
sending
packets
to
each
other.
And
if
you
try
to
ping
to
something
like
10,
8.3
doesn't
exist,
there's
nothing
at
the
end
of
it
and
your
computer's
gonna
make
like
I
I,
don't
know
how
to
find
that
so
coming
back
to
the
slides.
What
we
just
did
can
be
very
well
explained
by
this
image.
A
It's
just
two
children,
literally
two
children
talking
over
each
other
with
the
string
telephone
and
you
can
think
of
the
children
as
the
network
namespaces
and
the
ten
canisters
that
they're
using
are
the
virtual
Ethernet
devices.
So
if
the
demo
was
too
hard
to
absorb
I,
get
it
it's
a
lot
to
get.
It
took
me
quite
some
time.
A
Maybe
I
hope
this
gives
a
better
understanding
of
what
we
just
did
with
two-night
name
networking
spaces.
In
technical
terms,
we
simulated
two
different
devices
on
the
same
computer.
So
now
you
can
run
two
different
processes
and
both
the
different
network
news
faces
and
they
can
talk
to
each
other
as
if
there
were
two
different
computers.
A
So
if
you're
testing
I,
don't
like
something
like
a
client-server
thing
and
you
want
them
to
have
different
addresses,
you
don't
need
to
go
and
like
provision
a
new
cloud
machine,
the
cloud
instance
you
can
just
create
an
unit
opening
space
test
it
out.
Moving
on
to
see
groups
while
network
namespaces
helps
you
isolate
the
resources.
What
see
groups
does
is
I
is
control,
how
much
of
those
resources
you
are
going
to
allocate,
which
is,
for
example,
CPU
our
memory
and
there
are
few
other
resources,
but
the
easiest
to
explain
our
CPU
and
memory.
A
A
So
you
can
look
at
what
are
the
available
C
groups
on
your
system,
usually
by
default
they're
mounted
on
your
system
if
they
are
not,
you'd
have
to
do
some
additional
work,
but
assuming
that
they're
already
mounted,
you
know
that.
Okay,
you
have
things
like
CPU,
you
have
things
like
memory
and
to
create
a
new
C
group.
It's
as
simple
as
creating
a
new
directory
stay
with
me.
A
So
I
want
to
create
a
new
C
group
for
memory,
so
I
will
create
a
new
directory
under
the
memory
path
and
let's
say:
let's
just
call
it
demo
right
and
we
just
created
it
and
if
we
look
inside
this
directory,
there's
a
host
of
fights
I
did
not
create
it
right.
I
did
not
create
these
files,
it
got
created
on
its
own.
So
what
C
group
does
is
the
moment
you
create
a
new
directory
under
whatever
controller
memory
memory
controller
you
want
to
create
what
it
did
is.
A
A
A
It
failed
because
I
don't
have
internet
right
now,
but
so
it
just
worked
in
a
way
if
I
had
internet.
This
would
have
worked
right.
But
how
do
I
get
this
namespace
or
get
this
process
to
be
limited
by
the
C
group
I
just
created
the?
Where
on
that
is
there
is
yet
another
file.
You'll
Alexis
all
files
I
had
a
difficult
time
understanding
that
previously,
but
it
gets
better
now
and
there's
this
file
and
the
contents
of
this
file
is
empty.
A
You
write
the
process
ID
of
the
process
that
you
want
to
be
limited
by
the
C
group
and
your
job
start.
So,
let's
just
echo
the
process
ID
into
this,
and
for
your
verification,
that's
six,
four
one,
six,
four,
four
six
and
you
have
to
process
the
process
IDs
right
now.
One
of
them
is
the
process.
Id
we
entered
the
other
is
the
cat
command.
We
ran
so
by
default
inside
a
namespace.
If
it's
already
part
of
C
group,
any
new
child
processes
will,
by
default,
get
added
on
to
the
C
group.
A
So
next
time,
if
you
run
this
command
again,
six
four
two
one
two
won't
be
there
in
this
two
one
three
so
moving
on
now
that
we've
added
the
process,
ID
ID
into
this
C
group
I,
would
expect
this
command
to
fail.
Please
feel
killed
right.
What
just
happened
like
what
just
happened
like?
Why
would
it
kill
it?
A
There
you're
not
allowed
more
memory
than
this
or
more
cpu
than
this,
and
just
stop
get
out
of
here
and
game
of
right,
and
so
now,
if
you
look
at
containers,
if
you
use
docker
Kocher,
how
many
of
you
use
docker
I,
suppose
pretty
how
many
of
you
use
docker?
How
many
of
you
have
tried
to
like
limit
memory
and
limit
CPUs
on
a
docker
container,
a
few
of
you,
so
what
it's
doing
behind
the
scenes?
Not
this
was
it's
doing
behind
the
scenes.
A
A
It
is,
of
course
challenging,
which
is
why
we
need
things
like
container
runtimes,
and
that
is
why
there's
there's
a
lot
of
things
and
there
are
few
more
things
which
I
do
not
have
enough
time
to
demo,
but
I
will
talk
about
them,
which
are
capabilities,
and
second
capabilities
helps
you
to
limit
your
route
privileges.
Now,
sometimes
you
might
want
to
run
an
application
with
a
privileged
with
some
privileged
extra
prep
privileges
right
and,
if
you
run
it
as
route.
The
problem
there
is
the
moment.
You're
running
are
processes
route.
A
It
has
all
the
power
of
wrecking
have
operator
system,
maybe
accidentally,
maybe
not
accidentally,
and
you
don't
want
that.
What
you
want
is
you
want
to
limit
they're
there,
whatever
they
can
do
bad
that
limit
it
like
you
need
only
network
operations,
that's
the
only
capability
you
are
going
to
have
you
don't
need
to
create
new
processes?
You
don't
need
to
manage
other
processes,
you're
not
going
to
have
that,
so
that
lets
you
do
with
Linux
lets
you
do
with
capabilities
and
cap
net
admin.
A
Here
as
one
of
the
example
you
give
this
capability,
it
gets
the
ability
to
manage
your
network
interfaces
and
other
network
related
operations,
and
the
second
one
is
second
or
secure
computing.
It
limits
the
use
of
system
calls
itself
so,
for
example,
unshared
kill
or
even
something
like
CPU
there's
something
okay,
I
forget,
but
unsure
and
Kayla
look
one
of
the
examples,
so
you
cannot
use
this
system
calls.
So
you
can
block
certain
system,
calls
to
me
your
environment,
more
secure
and
docker
or
other
container
and
times
they
have
this
ability
to.
A
You
implements
a
calm
and
in
a
way
this
helps.
You
form
an
isolated,
restricted
view
of
what
is
really
your
operating
system
and
it's
not
really
magic
at
all.
And
if
you
remember
this
diagram
from
earlier
in
the
presentation,
it
is
admittedly
slightly
incomplete.
There
is
one
more
thing
that
the
parent
process
does:
is
it
waits
for
the
child
process
to
terminate,
which
is
why
it
needs
the
child
PID
and
what
it
does
is
once
the
process
has
terminated.
A
It
makes
sure
the
parent
has
to
make
sure
that
the
child
processes,
the
resources
belonging
to
the
child
processes,
are
cleared
up
or
else
if
it
doesn't
wait
for
this
child
process
to
terminate
what
you
then
have
are
zombie
processes.
And
then
you
have
leaked
resources
on
your
system
that
are
not
being
used
by
anyone
that
are
not
being
allowed
to
be
used
by
anyone.
So
in
a
way
this
is
a
very
high
level
diagram
of
what
a
container
runtime
does
for
you.
A
It
starts
the
container
runtime
engine
or
whatever
the
term
is,
and
it
transmute
child
processes
with
our
containers
and
it
waits
for
them
to
terminate,
and
then
it
comes
back
and
cleans
up
and
and
then
you
are
able
to
run
containers
in
your
system,
and
that
is
all
so
we
will
do.
A
quick
recap
might
have
been
a
bit
too
much,
so
you
have
namespaces,
which
isolates
the
type
of
resources
see
groups
which
limits
the
resources.
This
is
one
of
the
most
confusing
things
that
I
had
I
was
struggling
with
when
I
started
out.
A
So
namespaces
is
the
type
of
resources
see
groups
is
the
amount
of
resources,
just
the
keyword
you
want
to
look
for,
and
then
you
have
capabilities
to
reduce
the
risk
of
misuse
of
root
privileges
and
say:
calm
is
to
block
unwanted
sis
cause
I
know,
wait,
that's
pretty
much
it
about
a
continual,
runtime
or
containers,
so
that
doesn't
seem
very
complicated
anymore.
Does
it
and
I
was
able
to
find
a
lot
of
information?
Why,
over
the
years
in
these
links,
the
first
one
is
namespaces
in
operation?
A
It's
an
amazing
series
of
blog
posts,
explains
all
the
all
the
namespaces
but
see
I.
Think
cgroups
was
not
there
when
this
series
was
published,
but
these
six
seven
articles,
it's
like
amazing,
take
your
time
read
through
it
and,
of
course,
Julian
says.
What
even
is
a
container
is
like
a
brilliant
explanation
and
there's
something
you
just
cannot
get
around.
Is
man
pages
when
in
doubt,
man,
page
and
with
that
we
come
to
the
end
of
this
talk
and
this
time
for
you.
Thank
you.