windows server and ker - the internals behind bringing containers to Ker容器引入Windows背后原理

WindowsServerandDockerTheInternalsBehindBringingDockerandContainerstoWindowsJohnStarks&

TaylorBrownPrincipalLeadsinWindowsBasicsArchitecturePortingDockerAgendaShallowdiveNamespacesFilesystemBaseimagesHyper-VContainersTwogreatthingsBettertogetherBacktobasicsDockeronWindowsNot“DockerforWindows”IntegrationcomingPortofDockerEngine(notafork)SameremoteAPI,sametoolsworkontop(Compose,Swarm,etc.)BuiltonnewnativecontainertechnologyinWindowsRunsonWindowsServer2016andonthelatestWindows10RunsWindowsServercontainersonWindowshostsDoesn'trunLinuxcontainersAvailabletotrynow

Demo!How?Newsystem-levelcontainercapabilitiesinWindowsNamespacesResourcecontrolsUnionfilesystemAdaptedDockertoWindowsAdaptedWindowstoDockerArchitectureInLinuxcontainerd+runcDockerEngineRESTInterfacelibcontainerdgraphlibnetworkpluginsOperatingSystemControlGroupscgroupsNamespacesPid,net,ipc,mnt,utsLayerCapabilitiesUnionFilesystemsAUFS,btrfs,vfs,zfs*,DeviceMapperOtherOSFunctionalityDockerClientDockerRegistryDockerComposeDockerSwarmArchitectureInWindowsDockerEngineRESTInterfacelibcontainerdgraphlibnetworkpluginsOperatingSystemControlGroupsJobobjectsNamespacesObjectNamespace,ProcessTable,NetworkingLayerCapabilitiesRegistry,UnionlikefilesystemextensionsOtherOSFunctionalityComputeServiceDockerClientDockerRegistryDockerComposeDockerSwarmComputeServicePublicinterfacetocontainersReplacescontainerdonWindowsManagesrunningcontainersAbstractslow-levelcapabilitiesLanguagebindingsavailableC#:

putevirtualizationGo:

hcsshimArchitectureWindowsServerContainersWindowsKernelHostUserModeContainerManagementWindowsServerContainersComputeServicesDockerEngineWindowsServerContainerSystemProcessesApplicationProcessesSystemProcessesSessionManagerLocalSecurityAuthorityEventManager…Etc…JobObjectNetInterfaceStorageRegistryWindowsServerContainerSystemProcessesApplicationProcessesJobObjectNetInterfaceStorageRegistryContainercontentsPublicWindowsAPIdeliveredviaDLLs,notsyscallsLotsofinterdependenciesHighlydependentonsystemservicesrunningRPCcallshiddeninWin32APIsAutomaticallystartssmssinitequivalentLaunchesavarietyofsystemservicesNo“FROMscratch”BaseimagesDistributedbyMicrosoftTwooptionswindowsservercore:large(huge?),highlycompatiblenanoserver:small,fast,smallerAPIsurfacedockerpullcomingsoon!microsoft/windowsservercoremicrosoft/nanoserverDemo!NamespacesSilo:extensiontoWindowsJobobjectSetofprocessesResourcecontrolsNew:setofnamespacesNewnamespacevirtualizationRegistryProcessIDs,sessionsObjectnamespaceFilesystemNetworkcompartmentsObjectnamespaceSystem-levelnamespace,hiddenfromusersC:\Windowsmapsto\DosDevices\C:\WindowsContainsalldeviceentrypoints\DosDevices\C:\Registry\Device\TcpSilocan"chroot"todifferentobjectroot\Silos\foo\DosDevices\C:\Silos\bar\DosDevices\C:Demo!FilesystemWindowsapplicationsexpectNTFSsemanticsTransactions,fileIDs,USNjournalBuildingafullunionFSwithNTFSsemanticsishardHybridmodelVirtualblockdevice+NTFSpartitionpercontainerSymlinkstolayersonhostFStokeepblockdevicessmallRegistry…WindowsRegistryBasicallyasimplefilesystemBuiltatrueunionFSSavescloningafullsetofregistryhivespercontainerArchitectureHyper-VContainersHyper-VContainersSomeworkloadsneedmoreisolationHostilemulti-tenancyRegulatedworkloadsSolution:transparentlyruneachcontainerinaVM!(Mostly)invisibletobothDockerandtheuserdockerrun--isolation=hypervHyper-VContainersarethedefaultonWindows10ImagesarethesameWindowsKernelHostUserModeContainerManagementWindowsServerContainersComputeServicesDockerEngineWindowsServerContainerSystemProcessesApplicationProcessesSystemProcessesSessionManagerLocalSecurityAuthorityEventManager…Etc…JobObjectNetInterfaceStorageRegistryWindowsServerContainerSystemProcessesApplicationProcessesJobObjectNetInterfaceStorageRegistryHyper-VContainersHostUserModeVirtualMachine

SpecificallyOptimizedToRunaContainerContainerManagementWindowsKernelComputeServicesDockerEngineSystemProcessesSessionManagerLocalSecurityAuthorityEventManager…Etc…Hyper-VHypervisorHyper-VContainerWindowsKernelGuestComputeServiceWindowsServerContainerSystemProcessesApplicationProcessesJobObjectNetInterfaceStorageRegistryBasicSystemProcessesMakingitworkSmall,stateless“utilityVM”SmallestWindowsyet?WritesnotpersistedStorageattached