Containers in Controls Workshop Rémi Voirin - CERN Accelerator Controls (BE-CO)
[email protected] ICALEPCS 2019 - Brooklyn, NY Sunday 6th October, 2019 Containers in Controls Workshop 2 Outline Just a reminder... Defining containerisation Impacts of containerisation Hands-on Docker Container security Sunday 6th October, 2019 Containers in Controls Workshop 3 Table of Contents Just a reminder... Defining containerisation Impacts of containerisation Hands-on Docker Container security Sunday 6th October, 2019 Containers in Controls Workshop 4 Just a reminder... • This workshop is about sharing knowledge and ideas • Informal discussions • Something unclear or anything to add? Please ask questions during my presentations! Sunday 6th October, 2019 Containers in Controls Workshop 5 Table of Contents Just a reminder... Defining containerisation Impacts of containerisation Hands-on Docker Container security Sunday 6th October, 2019 Containers in Controls Workshop 6 Where we come from: Linux namespaces • Introduced in 2002 in kernel 2.4.19 • Goal: isolate processes - no interference with the rest of the system • The mount namespace came first (think chroot) • There are other namespaces including: • PID (CLONE_NEWPID) • network (CLONE_NEWNET) • cgroups (CLONE_NEWNS) Sunday 6th October, 2019 Containers in Controls Workshop 7 Where we come from: cgroups • Cap resource usage • CPU • Memory • Disk I/O • Create a rule in a config file ("not more than 200 MB of RAM"), and then apply it to a process Sunday 6th October, 2019 Containers in Controls Workshop 8