Docker & Kubernetes

What is a container?

uIt is not a virtual machine.

uIt has most of the benefits of a virtual machine, with few of the costs.

uLet’s forget containers for a minute and talk VM’s.

uImagine if…

uEvery single piece of software ran on its own virtual machine.

uYou could move a virtual machine from one physical machine to another easily.

uWhat would that look like?

Running everything in its own VM - Upsides

uVirtually no shared dependencies.  JDK, node.js, system libraries, Tomcat, etc.

uBlast radius contained.

uFully reproducible behavior

uGood partitioning of system resources by workload – for example, give lots of RAM to a RAM-hungry application without wasting RAM on software which does not need it.

Running everything in its own VM - Downsides

uRuntime overhead of a VM is extremely large.

u2 GB RAM overhead by OS for each VM

uHypervisor costs

uCPU scheduling time for kernel

uHow to ensure each VM is identical?  Manage a template and always rebuild VM’s from template.  Ouch!

uConfiguration changes have to be replicated to every VM.

uAdministrative time to setup and maintain a VM is too large.

uEach VM adds its own security risks.

Cotainers

uContainers run within a single operating system instance / VM / host

uThey use Linux cgroups feature and namespaces to isolate processes.

uThe process isolation is so strong that processes within a container can safely operate as if they are the world.

uEach container has its own copies of system libraries.  Only the kernel is shared between containers.

uContainers are ephemeral – they can come and go and move around easily.

uData is lost on shutdown unless a file system mount maps to the outside.

uGenerally configured via environment variables or mounting a directory with a configuration file.

uBenefits of VM’s, but without the downsides.

Kubernetes

uWhere do containers go?

uHow to map them to individual machines?

uConfiguration management?

All this is called container orchestration.