Containers in Linux on z Systems: Docker. Utz Bacher STSM Linux and Containers on z Systems

Transcription

1 Containers in Linux on z Systems: Docker Utz Bacher <utz.bacher@de.ibm.com> STSM Linux and Containers on z Systems

2 A Message Brought To You By Our Lawyers Trademarks of International Business Machines Corporation in the United States, other countries, or both can be found on the World Wide Web at The following are trademarks or registered trademarks of other companies. Adobe, the Adobe logo, PostScript, and the PostScript logo are either registered trademarks or trademarks of Adobe Systems Incorporated in the United States, and/or other countries. IT Infrastructure Library is a registered trademark of the Central Computer and Telecommunications Agency which is now part of the Office of Government Commerce. Intel, Intel logo, Intel Inside, Intel Inside logo, Intel Centrino, Intel Centrino logo, Celeron, Intel Xeon, Intel SpeedStep, Itanium, and Pentium are trademarks or registered trademarks of Intel Corporation or its subsidiaries in the United States and other countries. Linux is a registered trademark of Linus Torvalds in the United States, other countries, or both. Microsoft, Windows, Windows NT, and the Windows logo are trademarks of Microsoft Corporation in the United States, other countries, or both. Windows Server and the Windows logo are trademarks of the Microsoft group of countries. ITIL is a registered trademark, and a registered community trademark of the Office of Government Commerce, and is registered in the U.S. Patent and Trademark Office. UNIX is a registered trademark of The Open Group in the United States and other countries. Java and all Java based trademarks and logos are trademarks or registered trademarks of Oracle and/or its affiliates. Cell Broadband Engine is a trademark of Sony Computer Entertainment, Inc. in the United States, other countries, or both and is used under license therefrom. Linear Tape-Open, LTO, the LTO Logo, Ultrium, and the Ultrium logo are trademarks of HP, IBM Corp. and Quantum in the U.S. and other countries. * Other product and service names might be trademarks of IBM or other companies. IBM Corporation All Rights Reserved. The information contained in this publication is provided for informational purposes only. While efforts were made to verify the completeness and accuracy of the information contained in this publication, it is provided AS IS without warranty of any kind, express or implied. In addition, this information is based on IBM s current product plans and strategy, which are subject to change by IBM without notice. IBM shall not be responsible for any damages arising out of the use of, or otherwise related to, this publication or any other materials. Nothing contained in this publication is intended to, nor shall have the effect of, creating any warranties or representations from IBM or its suppliers or licensors, or altering the terms and conditions of the applicable license agreement governing the use of IBM software. References in this presentation to IBM products, programs, or services do not imply that they will be available in all countries in which IBM operates. Product release dates and/or capabilities referenced in this presentation may change at any time at IBM s sole discretion based on market opportunities or other factors, and are not intended to be a commitment to future product or feature availability in any way. Nothing contained in these materials is intended to, nor shall have the effect of, stating or implying that any activities undertaken by you will result in any specific sales, revenue growth or other results. 2

3 Agenda Containers, Docker, and Microservices Docker Ecosystem Docker on z 3

4 Containers, Docker, and Microservices Docker Ecosystem Docker on z

5 What are Containers? Virtual environment within Linux OS instance So applications share OS kernel Only application is started, not entire Linux environment Efficiency: no virtualization overhead No full system or para-virtualization, but isolation only by the kernel Own file system tree via chroot environment Container separation of OS objects via name spaces Process IDs, network devices, mount points, users, and more 5

6 Docker: Build, Ship, and Run Any App, Anywhere One implementation of a container solution Powerful tool to build, modify, deploy, run, manage containers Extreme focus on efficiency, fast response times Stores incremental differences and caching whenever possible Registries serve as central places for images Efficient distribution, versioning Terminology image: a self contained set of files, base for a container container: runnable instance, based on an image Maintained by Docker, Inc. 6

7 Typical Container Attributes Self contained sets of files escape dependency hell, reduce test matrix Serve a single task Can build on top of each other Can be deployed simple and quickly Can easily be customized, re-packaged and versioned Can use synergies in the kernel, if images eventually base on the same libraries (same file in underlying images) without having to use KSM (Kernel Samepage Merging) 7

8 Typical Container Layering Images can build on top of on another Allows to build on common infrastructure Only differences are stored and pushed Memory efficiency and density Change in underlying layer requires rebuilding all depending images Will generate a new image (with new ID) for app A PostgreSQL app A Ubuntu (base image) node.js app B Having both versions of app a allows for simple migration and rollback 8

9 Docker Benefits 9 Facilitates portability and cross platform deployment through generic build description Develop applications on x86 and build for both x86 and z platforms, seamlessly deploy to x86 and z Systems Package applications without worrying about dependencies on other libraries and software If container app requires dependencies, creator of the container adds them to the container image Entirely independent of host software level Simple re-use of components One container image used to deploy same application many times by different people Supports micro-service architecture by simple deployment and management of components Large application consisting of several SW components can be broken down into multiple containers to allow for reuse of parts Large density through lightweight container isolation mechanism in Linux kernel Hundreds to thousands of virtual containers to run in one system Docker ties Dev and Ops together Consistent environment from Dev to Ops facilitates staging and avoids environmental errors

10 Virtualization vs. Containers 10 Infrastructure oriented: coming from servers, now virtualized virtual server resource management several applications per server isolation persistence Service oriented: application-centric application management solution decomposed DevOps dynamic

11 Virtualization and Containers Virtual machine separation between tenants Virtualization management for infrastructure Isolation Many containers within tenants Container efficiency Docker management and ecosystem 11

12 Microservice Deployment Types Scale up for maximum efficiency Isolation, QoS and scaling for tiers and tenants 12 Grouping microservices end-to-end allows for simple scaling and optimized local communication

13 Microservice Challenges: Latency Internal flow between microservices user request edge service A B C E D B F Network latencies add up in meshes of microservices z Systems: large complex with in-box networks reduces latencies 13

14 functional decomposition (microservices) Microservice Challenges: Scaling The Scale Cube (From Abbott & Fisher: The Art of Scalability ) z Systems: sometimes bigger is better starting point horizontal scale-out (cloning) massive scale Replication components is mostly simple Splitting applications into microservices can be hard Data partitioning is often hard Scaling stateful services can be complex e.g. transactional context across microservices z Systems can scale anywhere from horizontally to vertically, aligned scale-up can simplify solutions 14

15 Containers, Docker, and Microservices Docker Ecosystem Docker on z

16 Docker Ecosystem: Registry 17 Docker Hub: Public Registry with User and Organization Management Private areas available Contains ~100 official images of companies (Ubuntu, MongoDB, ) Automated builds possible On-premise Private Registry ( distribution ): Open Source Simple user management (No web UI) Docker Trusted Registry (DTR): Commercial Docker Offering User and organization management AD/LDAP authentication SUSE Portus: Open Source Authorization Service and Frontend for Private Registry Users and organization management LDAP authentication Sonatype Nexus 3: repository solution for various formats, including Docker Merge external and internal registries Free/OSS and commercial version available Multi-arch being added (it basically works, no GUI yet) Multi-arch works fine Runs on x86, but serves z nodes. No multi-arch yet Multi-arch to be verified Multi-arch to be verified

17 Docker Ecosystem: How It Plays Together PaaS Cloud Foundry OpenShift BlueMix Mesos frameworks (e.g. Marathon) Management Docker Universal Control Plane (UCP) IBM UrbanCode Deploy (UCD) IBM Spectrum Conductor or part of PaaS Mgmt Infrastructure Registry PaaS (or SaaS) Cluster Orchestration 19 Orchestration Docker swarm & compose Apache Mesos Google Kubernetes IBM fr8r Hashicorp Nomad Docker Engine Overlay networks Storage volumes

18 Docker Ecosystem: Management docker-machine converts a Cloud or on-prem Linux image into a docker/swarm host Docker Universal Control Plane Part of Docker Datacenter Manages pipeline from development to operations Manages swarm cluster and host resources like networks and volumes IBM UrbanCode Deploy Part of UrbanCode product suite for DevOps Manage deployment of applications on physical and virtual servers and containers Supports change management and audit trails 20

19 IBM Spectrum Conductor for Containers Multi-tenant container infrastructure and orchestration in a shared resource environment Support full life cycle of containerized application in clusters API/CLI and GUI Global shared access to data Sorage tiering RBAC Manage QoS per consumer Service discovery support Community and enterprise edition availale for x86 not yet finalized for s390x

20 IBM Spectrum Conductor Architecture Overview App Store Authentication Authorization GUI Workflow Persistent Volume Service Load Balance Troubleshooting Service Discovery Distributed Key-value Store Monitor Kubernetes K8s executor Session Scheduler Mesos Master Mesos Agent container HPC container Installer (Deploy, Reconfigure, HA, Scale, Rolling update) Network Topology Image registry pod pod pod container container From: Xu: EDGE_2016-SCL-2484-A Software Defined Scalable and Flexible Container Management EDGE 2016

21 Docker Ecosystem: Cluster Orchestration Docker swarm and compose Simple cluster framework fitted to run Docker containers Composite applications with compose Docker acquired makers of Mesos Aurora scheduling framework, for integration of Aurora parts into swarm Apache Mesos Large scale cluster project Marathon framework schedules containers Mesos intends to run containers natively (without additional framework) IBM intends to add value with Platform Computing scheduler (EGO) Google Kubernetes Large scale cluster manager/scheduler by Google Base for CNCF (Cloud Native Compute Foundation) orchestration Grouping and co-location of containers as pods, forming a service 23

22 Containers, Docker, and Microservices Docker Ecosystem Docker on z

23 Linux Your Way : Greater Flexibility and Choice Distributions Virtualization / Container Programming/ Languages Runtimes Management Misc Database Analytics vrealize Cloud Manager DB2

24 Docker on z: Support Overview SUSE: Docker engine provided as part of SLES 12. Additional components being added. Fully supported Canonical: Engine provided as part of universe for Additional components being added. Universe: community maintained, i.e. not officially supported Red Hat: Under discussions. Client requests can only help 26 3rd Party: Formal support by Docker, Inc.: being worked on. Details tbd. Roguewave: commercial support for Docker (and a lot of other Open Source packages) for z

25 Docker and Performance Docker containers mainly use namespaces for isolation and cgroups for resource control Starts workload and gets out of the way application runs directly on kernel Workload performance under Docker is defined through platform performance Docker has no direct impact on workload runtime behavior If you can run hundreds of applications in a Linux, you can run it under Docker with about the same performance SDN and SDS mechanisms chosen define networking and storage limitations Typically low overhead Scaling characteristics of z Systems allows for both scale-up and scale-out Hundreds to low thousands of containers in a large Linux system proof point: 10k containers (mix of heavy, medium and light workload) Hundreds of tenants with smaller to medium scale Linux instances proof point: several million containers on single physical footprint 27 Design environment according to your solution requirements, not according to your systems constraints!

26 container = KVM guest Ongoing Work: Isolated Containers Transparently use KVM to run Docker workload Improved isolation through hardware-based virtualization technology Smaller attack surface from untrusted container workload towards hosting environment Maintain Docker ecosystem and user experience KVM not visible to user, started under the covers Re-use of Docker images without any changes Currently engaging with Open Source community First measurements show ~55ms overhead to start up a KVM per container App OS kernel KVM hypervisor (Docker host)

27 Ongoing Work: Autoscaling Increase utilization in a large scale container environment While maintaining business goals Workload is associated to business importance Performance monitored across all layers Workloda instrumentation Container infrastructure Hypervisors Resources adjusted on these levels based on workload priorities Integrates with existing management and orchestration infrstructure Currently working on and evaluating a prototype with a large financial client

28 Docker on z Systems Summary and Outlook Docker and base ecosystem available with full functionality Based on identical source code z Systems is part of Docker s Continuous Integration pipeline Commercial support available/being extended Docker Hub Content (images) being added for most popular Open Source projects Docker today enables mixed architecture development and deployment Multi-arch support and Ubuntu further simplify portability Second level virtualization provides perfect tenant isolation with low overhead while providing Docker agility and efficiency 30 Docker performance inherits platform performance characteristics Allows both scale-up and scale-out in a box: structure solutions along client requirements, not environment-imposed restrictions

29 THANK YOU