Containers: Under The Hood (Vincent Batts)

CONTAINERS:U N D E R T H E H O O D

Vincent Batts @vbatts

$> finger $(whoami)Login: vbatts Name: Vincent BattsDirectory: /home/vbatts Shell: /bin/bashSuch mail.Plan:OHMAN$> id -Gndevel opencontainers docker appc redhat golang slackware

H A N D S - O N :

capabilitiesSyscallsCopy-On-Write (CoW)ArchivesNamespaces

p.s. Don't forget to fill out the surveys!

S O,W H Y, C O N TA I N E R S ?

Single Application

Full System

But Not a VM

Except Maybe a VM

Pods of applications

Labels of services

Non-root

Desktop Applications

OMG AND CATS

https://www.flickr.com/photos/27549668@N03/

But Wait,What does "container" mean to you?

C A PA B I L I T I E S

(only on some versions of util-linux)capabilities(7)setpriv(1)capsh(1)proc(5)

DEMO

GOOD IDEA:

BAD IDEA:

whistling while you work

whistling while you eat

DEMO

SY S C A L L S

seccomp(2)proc(5)

GOOD IDEA:

BAD IDEA:

feeding a stray kitten in the park

feeding a stray kitten in the park to a bear

DEMO

N A M E S PAC E S

unshare(1)proc(5)lsns(8)

GOOD IDEA:

BAD IDEA:

playing catch with your grandpa

playing catch with your grandpa

DEMO

C O P Y- O N - W R I T E ( C O W )

lvmthin(7)btrfs-subvolume(8)overlayFS

GOOD IDEA:

BAD IDEA:

being served breakfast in bed

being served tennis balls in bed

F S * M AG I C *

shared subtree propogation

GOOD IDEA:

BAD IDEA:

ordering a chili dog to go

ordering a chili dog that makes you go

TA R A R C H I V E S

formattar-split

GOOD IDEA:

BAD IDEA:

Dressing up at Halloween as a pirate

Dressing up at Halloween as a piñata

T H A N K S !

V I N C E N T B AT T S

@ V B AT T S | V B AT T S @ R E D H AT.C O M