Artikel iki bakal ngrembug cara kerjane , lan uga bakal ana bagean praktis karo sambungan menyang Docker.
Babagan masalah umum karo Docker lan solusi sing wis ana , dina iki aku bakal njlèntrèhaké sedhela implementasine saka Kata Containers. Kata Containers minangka runtime wadhah sing aman adhedhasar mesin virtual sing entheng. Nggarap wong-wong mau padha karo wadhah liyane, nanging saliyane ana isolasi sing luwih dipercaya nggunakake teknologi virtualisasi hardware. project wiwit ing 2017, nalika masyarakat saka jeneng sing padha rampung gabungan saka gagasan paling apik saka Intel Clear Containers lan Hyper.sh RunV, sawise kang karya terus support kanggo macem-macem arsitektur, kalebu AMD64, ARM, IBM p- lan z. -seri. Kajaba iku, karya didhukung ing hypervisors QEMU, Firecracker, lan uga ana integrasi karo containerd. Kode kasedhiya ing miturut lisensi MIT.
Fitur utama
- Nggarap inti sing kapisah, saéngga nyedhiyakake jaringan, memori lan isolasi I / O, bisa meksa nggunakake isolasi hardware adhedhasar ekstensi virtualisasi.
- Dhukungan kanggo standar industri kalebu OCI (format kontainer), Kubernetes CRI
- Kinerja konsisten kontaner Linux biasa, tambah isolasi tanpa overhead kinerja VM biasa
- Ngilangi kabutuhan kanggo mbukak wadhah ing mesin virtual lengkap, antarmuka umum nyederhanakake integrasi lan diluncurake
Instalasi
Ana opsi instalasi, Aku bakal nimbang nginstal saka repositori, adhedhasar Centos 7 sistem operasi.
penting: Karya Kontainer Kata mung didhukung ing hardware, terusake virtualisasi uga ora bisa digunakake butuh dhukungan sse4.1 saka prosesor.
Nginstal Kata Containers cukup prasaja:
Instal utilitas kanggo nggarap repositori:
# yum -y install yum-utilsPateni Selinux (luwih bener kanggo ngatur, nanging kanggo gamblang aku mateni):
# setenforce 0
# sed -i 's/^SELINUX=enforcing$/SELINUX=permissive/' /etc/selinux/configKita nyambungake repositori lan nindakake instalasi
# source /etc/os-release
# ARCH=$(arch)
# BRANCH="${BRANCH:-stable-1.10}"
# yum-config-manager --add-repo "http://download.opensuse.org/repositories/home:/katacontainers:/releases:/${ARCH}:/${BRANCH}/CentOS_${VERSION_ID}/home:katacontainers:releases:${ARCH}:${BRANCH}.repo"
# yum -y install kata-runtime kata-proxy kata-shimimbuhan
Aku bakal nyetel kanggo nggarap docker, instalasi kasebut khas, aku ora bakal njlèntrèhaké kanthi luwih rinci:
# rpm -qa | grep docker
docker-ce-cli-19.03.6-3.el7.x86_64
docker-ce-19.03.6-3.el7.x86_64
# docker -v
Docker version 19.03.6, build 369ce74a3cKita nggawe owahan kanggo daemon.json:
# cat <<EOF > /etc/docker/daemon.json
{
"default-runtime": "kata-runtime",
"runtimes": {
"kata-runtime": {
"path": "/usr/bin/kata-runtime"
}
}
}
EOFWiwiti maneh docker:
# service docker restartTesting Fungsional
Yen sampeyan miwiti wadhah sadurunge miwiti maneh docker, sampeyan bisa ndeleng manawa uname bakal menehi versi kernel sing mlaku ing sistem utama:
# docker run busybox uname -a
Linux 19efd7188d06 3.10.0-1062.12.1.el7.x86_64 #1 SMP Tue Feb 4 23:02:59 UTC 2020 x86_64 GNU/LinuxSawise miwiti maneh, versi kernel katon kaya iki:
# docker run busybox uname -a
Linux 9dd1f30fe9d4 4.19.86-5.container #1 SMP Sat Feb 22 01:53:14 UTC 2020 x86_64 GNU/LinuxTim liyane!
# time docker run busybox mount
kataShared on / type 9p (rw,dirsync,nodev,relatime,mmap,access=client,trans=virtio)
proc on /proc type proc (rw,nosuid,nodev,noexec,relatime)
tmpfs on /dev type tmpfs (rw,nosuid,size=65536k,mode=755)
devpts on /dev/pts type devpts (rw,nosuid,noexec,relatime,gid=5,mode=620,ptmxmode=666)
sysfs on /sys type sysfs (ro,nosuid,nodev,noexec,relatime)
tmpfs on /sys/fs/cgroup type tmpfs (ro,nosuid,nodev,noexec,relatime,mode=755)
cgroup on /sys/fs/cgroup/systemd type cgroup (ro,nosuid,nodev,noexec,relatime,xattr,name=systemd)
cgroup on /sys/fs/cgroup/cpu,cpuacct type cgroup (ro,nosuid,nodev,noexec,relatime,cpu,cpuacct)
cgroup on /sys/fs/cgroup/blkio type cgroup (ro,nosuid,nodev,noexec,relatime,blkio)
cgroup on /sys/fs/cgroup/memory type cgroup (ro,nosuid,nodev,noexec,relatime,memory)
cgroup on /sys/fs/cgroup/devices type cgroup (ro,nosuid,nodev,noexec,relatime,devices)
cgroup on /sys/fs/cgroup/perf_event type cgroup (ro,nosuid,nodev,noexec,relatime,perf_event)
cgroup on /sys/fs/cgroup/net_cls,net_prio type cgroup (ro,nosuid,nodev,noexec,relatime,net_cls,net_prio)
cgroup on /sys/fs/cgroup/freezer type cgroup (ro,nosuid,nodev,noexec,relatime,freezer)
cgroup on /sys/fs/cgroup/pids type cgroup (ro,nosuid,nodev,noexec,relatime,pids)
cgroup on /sys/fs/cgroup/cpuset type cgroup (ro,nosuid,nodev,noexec,relatime,cpuset)
mqueue on /dev/mqueue type mqueue (rw,nosuid,nodev,noexec,relatime)
shm on /dev/shm type tmpfs (rw,nosuid,nodev,noexec,relatime,size=65536k)
kataShared on /etc/resolv.conf type 9p (rw,dirsync,nodev,relatime,mmap,access=client,trans=virtio)
kataShared on /etc/hostname type 9p (rw,dirsync,nodev,relatime,mmap,access=client,trans=virtio)
kataShared on /etc/hosts type 9p (rw,dirsync,nodev,relatime,mmap,access=client,trans=virtio)
proc on /proc/bus type proc (ro,relatime)
proc on /proc/fs type proc (ro,relatime)
proc on /proc/irq type proc (ro,relatime)
proc on /proc/sys type proc (ro,relatime)
tmpfs on /proc/acpi type tmpfs (ro,relatime)
tmpfs on /proc/timer_list type tmpfs (rw,nosuid,size=65536k,mode=755)
tmpfs on /sys/firmware type tmpfs (ro,relatime)
real 0m2.381s
user 0m0.066s
sys 0m0.039s# time docker run busybox free -m
total used free shared buff/cache available
Mem: 1993 30 1962 0 1 1946
Swap: 0 0 0
real 0m3.297s
user 0m0.086s
sys 0m0.050sTes beban cepet
Kanggo netepke losses saka virtualization - Aku mbukak sysbench, minangka conto utama .
Mlaku sysbench nggunakake Docker+containerd
Tes prosesor
sysbench 1.0: multi-threaded system evaluation benchmark
Running the test with following options:
Number of threads: 1
Initializing random number generator from current time
Prime numbers limit: 20000
Initializing worker threads...
Threads started!
General statistics:
total time: 36.7335s
total number of events: 10000
total time taken by event execution: 36.7173s
response time:
min: 3.43ms
avg: 3.67ms
max: 8.34ms
approx. 95 percentile: 3.79ms
Threads fairness:
events (avg/stddev): 10000.0000/0.00
execution time (avg/stddev): 36.7173/0.00tes RAM
sysbench 1.0: multi-threaded system evaluation benchmark
Running the test with following options:
Number of threads: 1
Initializing random number generator from current time
Initializing worker threads...
Threads started!
Operations performed: 104857600 (2172673.64 ops/sec)
102400.00 MiB transferred (2121.75 MiB/sec)
General statistics:
total time: 48.2620s
total number of events: 104857600
total time taken by event execution: 17.4161s
response time:
min: 0.00ms
avg: 0.00ms
max: 0.17ms
approx. 95 percentile: 0.00ms
Threads fairness:
events (avg/stddev): 104857600.0000/0.00
execution time (avg/stddev): 17.4161/0.00Mlaku sysbench nggunakake Docker + Kata Containers
Tes prosesor
sysbench 1.0: multi-threaded system evaluation benchmark
Running the test with following options:
Number of threads: 1
Initializing random number generator from current time
Prime numbers limit: 20000
Initializing worker threads...
Threads started!
General statistics:
total time: 36.5747s
total number of events: 10000
total time taken by event execution: 36.5594s
response time:
min: 3.43ms
avg: 3.66ms
max: 4.93ms
approx. 95 percentile: 3.77ms
Threads fairness:
events (avg/stddev): 10000.0000/0.00
execution time (avg/stddev): 36.5594/0.00tes RAM
sysbench 1.0: multi-threaded system evaluation benchmark
Running the test with following options:
Number of threads: 1
Initializing random number generator from current time
Initializing worker threads...
Threads started!
Operations performed: 104857600 (2450366.94 ops/sec)
102400.00 MiB transferred (2392.94 MiB/sec)
General statistics:
total time: 42.7926s
total number of events: 104857600
total time taken by event execution: 16.1512s
response time:
min: 0.00ms
avg: 0.00ms
max: 0.43ms
approx. 95 percentile: 0.00ms
Threads fairness:
events (avg/stddev): 104857600.0000/0.00
execution time (avg/stddev): 16.1512/0.00Ing asas, kahanan wis cetha, nanging luwih optimal kanggo nindakake tes kaping pirang-pirang, mbusak outliers lan rata-rata asil, supaya aku ora nindakake liyane tes.
temonan
Senadyan kasunyatan manawa kontaner kasebut butuh wektu kira-kira lima nganti sepuluh kaping luwih suwe kanggo diwiwiti (waktu kerja khas kanggo perintah sing padha nalika nggunakake containerd kurang saka sapratelo detik), dheweke isih bisa cepet banget yen njupuk wektu wiwitan mutlak (ana minangka conto ing ndhuwur, printah sing ditindakake kanthi rata-rata telung detik). Ya, asil tes cepet CPU lan RAM nuduhake asil sing meh padha, sing ora bisa nanging bungah, utamane amarga kasunyatan manawa isolasi diwenehake kanthi nggunakake mekanisme sing apik kaya kvm.
Pengumuman
Artikel kasebut minangka review, nanging menehi kesempatan kanggo ngrasakake runtime alternatif. Akeh area aplikasi sing ora dilindhungi, contone, situs kasebut nggambarake kemampuan kanggo mbukak Kubernetes ing ndhuwur Kontainer Kata. Kajaba iku, sampeyan uga bisa nglakokake seri tes sing fokus kanggo nemokake masalah keamanan, nyetel watesan, lan liyane sing menarik.
Aku njaluk kabeh sing wis maca lan mbaleni maneh kene kanggo melu survey, sing bakal gumantung ing publikasi ing topik iki.
Mung pangguna pangguna sing bisa melu survey. nggih.
Apa aku kudu terus nerbitake artikel babagan Kontainer Kata?
-
80,0%Wis, tulisen maneh!28
-
20,0%Ora, aja…7
35 pangguna milih. 7 kedhaftar abstained.
Source: www.habr.com