4 ms·

Announcing Intel Clear Containers V2.1.1

93 points by ah- 10y ago

phildougherty 10y ago
Pretty neat how nicely this integrates into an existing docker host setup. Definitely going to give it a try and see about integrating into containership. edit: typo
chatmasta 10y ago
I hadn't seen this project before. It looks really cool. I especially like the support for pushing network configuration at startup (via the "hyperstart" concept in v1 and systemd in v2). This is sorely lacking in Docker. You can accomplish it with pipework (which is just a wrapper around `ip exec` in the container netns), but then you need to write code in the container like "wait for interface XX to be up before running entry_point.sh" My use case is creating containers with multiple interfaces and custom routing rules for each interface. Currently I am using pipework.sh to setup the interfaces and routes, but it's a dirty hack and increases container boot time due to the need to poll for interfaces to be up before starting the application. It looks like this "hyperstart"/systemd approach to namespace isolation avoids that latency, which is nice. Unfortunately, according to these docs, each container interface requires a tap bridge in addition to the usual veth pair, due to qemu networking limitations. That's unfortunate, especially for containers with multiple interfaces, which is specifically my use-case. Does anyone have an idea of the overhead of creating many tap interfaces within a container?
- justincormack 10y ago
  Sounds like the networking model for containerd will suit you? See https://github.com/docker/containerd/issues/362#issuecomment-267188078 https://github.com/docker/containerd/issues/362#issuecomment... - you get as long as you like to set up networking before the process starts running.
- doublerebel 10y ago
  FWIW I just use Joyent Triton with SmartOS and docker containers, my VLANs exist on start and I can't imagine dealing with those issues. What SDN solution are you using that requires this kind of init process? Solaris solved the service dependency graph problem with SMF, which is nice.
  - chatmasta 10y ago
    I'm using out of the box docker container networking. I setup a bridge network (docker network create) for every external IP on the host. Each container needs multiple external IPs, so it joins multiple bridge networks and then sets up routing rules for the outbound traffic on each interface. When creating a container, you can only join it to one network. But once it's created you can run 'docker network attach' to join other networks (and get an interface for each). However the application is already running at that point. What I really want is to create and configure a network namespace using my own tools, and then launch a docker container into the existing namespace. I haven't figured out how to do this yet.
    - dlespiau 10y ago
      (Clear Containers dev here) I believe a "correct" way to do it would be to create a network plugin (or extend an existing one that does 80% of what you want) for docker doing what you want. Those are the ones responsible for setting up the network namespace at startup. A new CNM plugin, only if the current one isn't enough of course, a number of things can be done before container startup, eg. https://docs.docker.com/engine/userguide/networking/default_network/build-bridges/ https://docs.docker.com/engine/userguide/networking/default_.... The Clear containers OCI runtime doesn't add a feature to push network configuration in addition to what Docker already does today. It relies on a CNM plugin to setup the network namespace, as usual, then reads back the netns configuration to decide how to best interface between the container netns and the network stack within the VM. It's not exactly easy to get right and we have to juggle with all thid because we're trying to shoehorn a VM where netns are the de-facto interface. Work is going on to make all this simpler and integrated, but it will take some time. A current limitation is that only the netns configuration at startup time is taken into account and `docker network connect` on a running container doesn't work (we'd have to listen to changes in the netns and propagate the configuration to the VM). A bit more info there: https://github.com/01org/cc-oci-runtime/blob/master/documentation/architecture.md#networking https://github.com/01org/cc-oci-runtime/blob/master/document...
gtirloni 10y ago
Anyone using this in production and betting on the long term viability of this project?
alpb 10y ago
Here's a cool technical and short article about the Clear Containers by someone worked on the project to bring you up to speed with what is going on: https://lwn.net/Articles/644675/ https://lwn.net/Articles/644675/
tyingq 10y ago
Sounds similar to what http://hypercontainer.io http://hypercontainer.io is doing.
nimish 10y ago
Containers done right I wish the documentation was better for integrating with docker seamlessly
philips 10y ago
If you want to try out Clear Containers with rkt you can easily do it on a linux physical machine. First, install rkt via deb/rpm[1] or tarball[2] Then do: sudo rkt run --debug --insecure-options=image --stage1-name=coreos.com/rkt/stage1-kvm:1.25.0 docker://redis If you run into problem you can email rkt-dev[3]. [1] https://coreos.com/rkt/docs/latest/distributions.html#rpm-based https://coreos.com/rkt/docs/latest/distributions.html#rpm-ba... [2] https://github.com/coreos/rkt/releases/tag/v1.25.0 https://github.com/coreos/rkt/releases/tag/v1.25.0 [3] https://groups.google.com/forum/#!forum/rkt-dev https://groups.google.com/forum/#!forum/rkt-dev

93 points by ah- 10y ago

Pretty neat how nicely this integrates into an existing docker host setup. Definitely going to give it a try and see about integrating into containership. edit: typo

chatmasta 10y ago

I hadn't seen this project before. It looks really cool. I especially like the support for pushing network configuration at startup (via the "hyperstart" concept in v1 and systemd in v2). This is sorely lacking in Docker. You can accomplish it with pipework (which is just a wrapper around `ip exec` in the container netns), but then you need to write code in the container like "wait for interface XX to be up before running entry_point.sh" My use case is creating containers with multiple interfaces and custom routing rules for each interface. Currently I am using pipework.sh to setup the interfaces and routes, but it's a dirty hack and increases container boot time due to the need to poll for interfaces to be up before starting the application. It looks like this "hyperstart"/systemd approach to namespace isolation avoids that latency, which is nice. Unfortunately, according to these docs, each container interface requires a tap bridge in addition to the usual veth pair, due to qemu networking limitations. That's unfortunate, especially for containers with multiple interfaces, which is specifically my use-case. Does anyone have an idea of the overhead of creating many tap interfaces within a container?

justincormack 10y ago
Sounds like the networking model for containerd will suit you? See https://github.com/docker/containerd/issues/362#issuecomment-267188078 https://github.com/docker/containerd/issues/362#issuecomment... - you get as long as you like to set up networking before the process starts running.
doublerebel 10y ago
FWIW I just use Joyent Triton with SmartOS and docker containers, my VLANs exist on start and I can't imagine dealing with those issues. What SDN solution are you using that requires this kind of init process? Solaris solved the service dependency graph problem with SMF, which is nice.
- chatmasta 10y ago
  I'm using out of the box docker container networking. I setup a bridge network (docker network create) for every external IP on the host. Each container needs multiple external IPs, so it joins multiple bridge networks and then sets up routing rules for the outbound traffic on each interface. When creating a container, you can only join it to one network. But once it's created you can run 'docker network attach' to join other networks (and get an interface for each). However the application is already running at that point. What I really want is to create and configure a network namespace using my own tools, and then launch a docker container into the existing namespace. I haven't figured out how to do this yet.
  - dlespiau 10y ago
    (Clear Containers dev here) I believe a "correct" way to do it would be to create a network plugin (or extend an existing one that does 80% of what you want) for docker doing what you want. Those are the ones responsible for setting up the network namespace at startup. A new CNM plugin, only if the current one isn't enough of course, a number of things can be done before container startup, eg. https://docs.docker.com/engine/userguide/networking/default_network/build-bridges/ https://docs.docker.com/engine/userguide/networking/default_.... The Clear containers OCI runtime doesn't add a feature to push network configuration in addition to what Docker already does today. It relies on a CNM plugin to setup the network namespace, as usual, then reads back the netns configuration to decide how to best interface between the container netns and the network stack within the VM. It's not exactly easy to get right and we have to juggle with all thid because we're trying to shoehorn a VM where netns are the de-facto interface. Work is going on to make all this simpler and integrated, but it will take some time. A current limitation is that only the netns configuration at startup time is taken into account and `docker network connect` on a running container doesn't work (we'd have to listen to changes in the netns and propagate the configuration to the VM). A bit more info there: https://github.com/01org/cc-oci-runtime/blob/master/documentation/architecture.md#networking https://github.com/01org/cc-oci-runtime/blob/master/document...

gtirloni 10y ago

Anyone using this in production and betting on the long term viability of this project?

alpb 10y ago

Here's a cool technical and short article about the Clear Containers by someone worked on the project to bring you up to speed with what is going on: https://lwn.net/Articles/644675/ https://lwn.net/Articles/644675/

tyingq 10y ago

Sounds similar to what http://hypercontainer.io http://hypercontainer.io is doing.

nimish 10y ago

Containers done right I wish the documentation was better for integrating with docker seamlessly

philips 10y ago

If you want to try out Clear Containers with rkt you can easily do it on a linux physical machine. First, install rkt via deb/rpm[1] or tarball[2] Then do: sudo rkt run --debug --insecure-options=image --stage1-name=coreos.com/rkt/stage1-kvm:1.25.0 docker://redis If you run into problem you can email rkt-dev[3]. [1] https://coreos.com/rkt/docs/latest/distributions.html#rpm-based https://coreos.com/rkt/docs/latest/distributions.html#rpm-ba... [2] https://github.com/coreos/rkt/releases/tag/v1.25.0 https://github.com/coreos/rkt/releases/tag/v1.25.0 [3] https://groups.google.com/forum/#!forum/rkt-dev https://groups.google.com/forum/#!forum/rkt-dev