Linux Containers Overview & Roadmap Bhavna Sarathy Senior Product Manager, Red Hat Dan Walsh Senior Principal Software Engineer, Red Hat June 12 2013

Key elements of Linux Containers Process Isolation Resource Management Security Bhavna: Linux containers can just be thought of as a collection of processes, separated from the main host processes via a set of resource namespaces and constrained via control groups resource tunables. Now, lets look into the key elements of Linux containers. The 4 tenets of Linux Containers are: - Process Isolation - Resource Management - Security - Management or Tooling Process Isolation is achieved through kernel namespaces which provides a simulated environment for the various kernel capabilities such as process ID, mount, network, UTS, and user ID. Resource management is achieved using process control groups or cgroups to allocate, and manage the host CPU, system memory, disk I/O, and network resources. Security is provided using SELinux, which applies security labels to Linux containers and their resources. In addition, SELinux policies are applied to containers. Management tooling is provided using the libvirt API which provides a collection of services (virt-sandbox-service, virt-sandbox) to support application sandboxing capabilities. Management

Linux Container Architecture

Red Hat Enterprise Linux Container Architecture Linux Kernel Hardware (Intel, AMD)

Red Hat Enterprise Linux Container Architecture Linux Kernel Hardware (Intel, AMD) Namespaces

Namespaces Process Isolation Mount : mounting/unmounting filesystems UTS : hostname, domainname IPC : SysV message queues, semaphore/shared memory segments Network: IPv4/IPv6 stacks, routing, firewall PID: Private /proc, multiple pid 1's User: (UID) Just showing up in the Kernel now. Not planning on supporting in RHEL7. Bhavna: Linux containers can just be thought of as a collection of processes, separated from the main host processes via a set of resource namespaces and constrained via control groups resource tunables. Now, lets look into the key elements of Linux containers. The 4 tenets of Linux Containers are: - Process Isolation - Resource Management - Security - Management or Tooling Process Isolation is achieved through kernel namespaces which provides a simulated environment for the various kernel capabilities such as process ID, mount, network, UTS, and user ID. Resource management is achieved using process control groups or cgroups to allocate, and manage the host CPU, system memory, disk I/O, and network resources. Security is provided using SELinux, which applies security labels to Linux containers and their resources. In addition, SELinux policies are applied to containers. Management tooling is provided using the libvirt API which provides a collection of services (virt-sandbox-service, virt-sandbox) to support application sandboxing capabilities.

Namespace Use Process Isolation pam_namespace - RHEL5/6 SELinux sandbox - RHEL6 SystemD - Fedora 17 UnitFile: PrivateTmp, PrivateNetwork Openshift - RHEL6 Pam_namespace : Private /tmp

Red Hat Enterprise Linux Container Architecture Linux Kernel Hardware (Intel, AMD) Namespaces Cgroups

Resource Management with Cgroups Network Memory CPU Block IO Linux Kernel Namespaces Cgroups Hardware (Intel, AMD)

Cgroup Use Resource Management Libvirt/qemu – RHEL6 OpenShift - RHEL6 SystemD - Fedora 18 UnitFile: ControlGroup* Red Hat Storage Service Gluster - RHEL6

Red Hat Enterprise Linux Container Architecture Linux Kernel Hardware (Intel, AMD) Namespaces Cgroups SELinux

SELinux Use Security Targeted - RHEL4 MLS – RHEL5 Targeted/MCS - RHEL6 sVirt OpenShift sandbox -X

Red Hat Enterprise Linux Container Architecture Linux Kernel Hardware (Intel, AMD) Namespaces Cgroups SELinux Libvirt Drivers

Red Hat Enterprise Linux Container Architecture Linux Kernel Hardware (Intel, AMD) Namespaces Cgroups SELinux Libvirt Drivers

Red Hat Enterprise Linux Container Architecture Linux Kernel Hardware (Intel, AMD) Namespaces Cgroups SELinux Libvirt Containers Containers Drivers

Libvirt Use Libvirt - RHEL5, RHEL6 Launch Virtual Machines Libvirt-lxc – RHEL6.4 Launch Containers Management

Linux Container Use Cases Process Isolation Resource Management Security Bhavna: Linux containers can just be thought of as a collection of processes, separated from the main host processes via a set of resource namespaces and constrained via control groups resource tunables. Now, lets look into the key elements of Linux containers. The 4 tenets of Linux Containers are: - Process Isolation - Resource Management - Security - Management or Tooling Process Isolation is achieved through kernel namespaces which provides a simulated environment for the various kernel capabilities such as process ID, mount, network, UTS, and user ID. Resource management is achieved using process control groups or cgroups to allocate, and manage the host CPU, system memory, disk I/O, and network resources. Security is provided using SELinux, which applies security labels to Linux containers and their resources. In addition, SELinux policies are applied to containers. Management tooling is provided using the libvirt API which provides a collection of services (virt-sandbox-service, virt-sandbox) to support application sandboxing capabilities. Management

Shared RHEL Host Software Containers use cases Shared RHEL Host Software Generic Application Container Systemd Application Container Generic Application container Start any application Shared /usr Systemd Application Container launch container and persist across reboots Interactive : invoke from virt-sandbox CLI Chroot on steroids Ability to run different application stacks in containers This is where the rubber meets the road! OS containers – Not Supported Boot guest OSes inside a container Use full featured KVM Virtualization!

Shared RHEL Host Software Containers use cases Shared RHEL Host Software Generic Application Container Systemd Application Container Unshared OS Software Chroot Application Container Booted OS Container Generic Application container Start any application Shared /usr Systemd Application Container launch container and persist across reboots Interactive : invoke from virt-sandbox CLI Chroot on steroids Ability to run different application stacks in containers This is where the rubber meets the road! OS containers – Not Supported Boot guest OSes inside a container Use full featured KVM Virtualization!

Generic Application Container virt-sandbox-service Libvirt libvirt-lxc Any command

Systemd Application Container virt-sandbox-service Libvirt libvirt-lxc Unit file

Chroot Application Container virt-sandbox-service Libvirt libvirt-lxc Any Command In Chroot

virt-sandbox-service Booted OS Container virt-sandbox-service Libvirt libvirt-lxc /sbin/init

virt-sandbox-service Booted OS Containers Not supported!!! Use KVM virt-sandbox-service Libvirt libvirt-lxc /sbin/init

Containers vs KVM Virtualization When should I use containers and when should I use KVM?

Containers vs KVM Virtualization Startup and shutdown speed Ease of Maintainance Easy to create System-wide changes visible in each container For RHEL Shared OS Containers Scalability: Number of containers Process Memory Sharing

KVM Virtualization vs Containers Boot multiple Different Operating Systems Including Windows Separate kernel Better Security Kernel crash does not take down host Guest Isolation from host changes Full Separation Features such as live migration, live storage migration

Linux Containers : Scalability How many containers can you run? Theoritical Scales to 6000 containers and 12000 bind mounts of root filesystem directories Practical Running real workloads, containers doing work in parallel

Future Seccomp – Linux syscall restriction Better audit support/logging support Working UnionFS. What's going to break?????

Related Summit Sessions Managing SELinux in the Enterprise Wed 4:50 pm, Rm 312 Secure Development Practices Thu 1:20 pm, Rm 306 Under the Hood of OpenShift, Turbocharged by RHEL Thu 3:40 pm, Rm 304 KVM Hypervisor Roadmap & Technology Update Thu 10:40am, Rm 304 Hypervisor Technology Comparison & Migration Fri 9:45am, Rm 313

Contact Info Dan Walsh Email: dwalsh@redhat.com Blog: danwalsh.livejournal.com Twitter: @rhatdan Bhavna Sarathy Email: bsarathy@redhat.com

Questions?