Тёмный

What Have Namespaces Done for You Lately? 

Подписаться
Просмотров 17 тыс.
% 380

Liz Rice - Technology Evangelist, Aqua Security
Containers are made with namespacing and cgroups, but what does that really mean? In this talk we'll write a container from scratch in Go, using bare system calls, and explore how the different namespaces affect the container's view of the world and the resources it has access to.

Наука

Опубликовано:

 

26 апр 2017

Поделиться:

Ссылка:

Скачать:

Готовим ссылку...

Добавить в:

Мой плейлист
Посмотреть позже
Комментарии : 9   
@xxzzyagf
@xxzzyagf 7 лет назад
This was amazing. Thank you Liz for the presentation and Docker to make it happen. Now I understand all behind the scene details of docker far more better.
@mickycampbell8565
@mickycampbell8565 7 лет назад
Fantastically salient coding demo that drives home some fundamentals of what a container is. Love the fork bomb to prove everything at the end! This was among the 8 best voted at DockerCon17 that I was fortunate enough to see last week in Austin.
@rewanthtammana
@rewanthtammana 3 года назад
The hands-on session is super informative. Learned a lot on system internals
@anothermaria6981
@anothermaria6981 Год назад
Amazing presentation!
@PrimephotoStudio
@PrimephotoStudio 7 лет назад
Very helpful, thank you for sharing it with us.
@odedpriva
@odedpriva 6 лет назад
I believe this is why you want to mount before you chroot: ( taken from here : yarchive.net/comp/linux/pivot_root.html ) '/' is special exactly the same way '.' is: one is shorthand for "current process' root", and the other is shorthand for "current process' cwd". So if you mount over '/', it won't actually do what you think it does: because when you open "/", it will continue to open the _old_ "/". Exactly the same way that mounting over somebody's cwd won't do what you think it does - because the root and the cwd have been looked-up earlier and are cached with the process. This is why we have "pivot_root()" and "chroot()", which can both be used to do what you want to do. You mount the new root somewhere else, and then you chroot (or pivot-root) to it. And THEN you do 'chdir("/")' to move the cwd into the new root too (and only at that point have you "lost" the old root - although you can actually get it back if you have some file descriptor open to it). Linus
@Ram_Malisetti
@Ram_Malisetti 7 лет назад
This was an excellent one.. very much useful .. Do we have the equivalent Linux commands to perform the same operations like invoking the system calls in the Linux shell instead from a GO program? I'm a beginner and trying to understand how to create the containers on my own. Regards, Ram
@triglav2214
@triglav2214 7 лет назад
Many syscalls are available via bash but are not really "parameterized". For instance exec 4 > file will call open("file", O_WRONLY|O_CREAT|O_APPEND, 0666) = 3; dup2(3, 4). You don't have to use go, you could use rust or even C.