分析案例站一

Container&MeaglithMaWhoamI—Meaglith Weibo :Senior CommunityInitiatorSAPFI/COConsultantITSMOpenSourceBeforeDocker–LXCDockerBorn–DockerGrow–CommunityDockerIsKing?ContainerEngineContainerOps–TheNextGenerationDevOpsBeforeDocker-LinuxOSchroot：chroot命令改变其当前 变为指定 则运行命令，也可以运行一个用户的交互式s 只提供有限的文件系 不安全， chrootNote:usernamespacesupportinupstreamkernel3.8+,butdistributionsrollingoutphasedsupport:MapLXCUID/GIDbetweencontainerandhostNon-rootLXCNamespace和cgroup在~2008NamespaceNetnamespaceUsernamespaceCgroupcpu:CFSthrottle、RTnet:Netclscgroup、netprioritycgroupblk:mem:支持sharedmemory、oomnotify、vmpressure、hugetlb…blkiocgroup支持buffered-未来考虑支持buffered-io的weightcgroupnamespacepidsKernel-basedCheckpointand作者：OrenLaadan 实现：100个patchCheckpointRestoreInUserspace（CRIU）作者：PavelEmelyanov等，ParallesLXC2008什么是LXC LXCisauserspaceinterfacefortheLinuxkernelcontainmentfeatures.ThroughapowerfulAPIandsimpletools,itletsLinuxuserseasilycreateandmanagesystemorapplicationcontainers.FromLXC(LinuXContainers)isanoperatingsystem–levelvirtualizationmethodforrunningmultipleisolatedLinuxsystems(containers)onasinglecontrolhost…LXCprovidesoperatingsystem-levelvirtualizationnotviaavirtualmachine,butratherprovidesavirtualenvironmentthathasitsownprocessandnetworkspace.什么是Container AgroupofprocessesonaLinuxhost,puttogetherinanisolatedLXCKernelnamespaces(ipc,uts,mount,pid,networkanduser)ApparmorandSELinuxprofilesppoliciesChroots(usingpivot_root)KernelcapabilitiesCGroups(controlgroups)为什么LXC没有普及?的ComponentsTheliblxclibrarySeverallanguagebindingsforthepython3(in-tree,longtermsupportinlua(intree,longtermsupportin1.0.x)GoPythonHaskellAsetofstandardtoolstocontroltheDistributioncontainer Dockerborn–AUFS&friendlyrestapiDocker诞生– Dockermount-taufs-obr=/base=ro:/data=rwnoneRESTAPI优于libxxxx/Docker 的RESTAPI接口比LXC 的liblxc更易用RESTAPI接口的程序，LXCBinding更Docker拉低了LiunxContainer 的易用性门槛，是它比LXC流行的根本原因，但不是Container 这一阶段Docker底层调度容器依旧使用LXC ，所以Docker对自己的定义是LXC VMVSLXCVSDockerGrow–CommunityPower0.9.0libcontainerDocker对自己的定义改为ContainerEngine–兼容所有的 技术 级应用Libcontainer–代表了Docker在Container技术的核DockerDockerCon–1.0(2014-Docker对自己的定义改为 tform–Build、Ship、RunApplicationForDevelopersAndSystemAdministrator。DockerIndexDockerContainerEngineDockerEngineDxxkor–“HeWhoMustNotBeNamed”DockerAportable,lightweightapplicationruntimeandpackagingtool

AcloudserviceforsharingapplicationsandautomatingworkflowsDocker依旧在代 Docker Docker Docker Docker的安全问 还是 的安全问题 Docker的安全问题在1.0之前得到了Redhat和Canonical 和AppAmorDocker的安全问题一定是在特定场景下进行内核的加固才能得到改善Containeros编排调度工具–Kubernetes 资源分配方案–Mesos （Mesosphere）DockerIsKingDockerCon14|EUDockerComposeDockerSwarmDockerMachineCoreosrelease dockercon2014|euApplicationContainerUbuntuContainer:TheLinuxcontainerhypervisor.WhatisBuildingonLXCIsLXDarealLinuxHyper-TheBestfromBothWorlds:VMandContainerHyper将任务提交给DVMDaemonDVMQemu/KVMDVMInitrdImageContainerWar@AppcontainerdesignDesignforfastdownloadsandstartsoftheEnsureimagesarecryptographicallyverifiableandhighly-cacheableDesignforcomposabilityandindependentUsecommon forcrypto,archive,compressionandUsetheDNSnamespacetonameanddiscovercontainerimagesAppContainerSpec AppContainerImage-ImageContainerops–thenextgenerationDevOpsNextMovement-Don’tBreakDevO