ProHoster > Blog > Administrasi > Tinjauan ringkes sareng setelan tina Wadah Kata

Tinjauan ringkes sareng setelan tina Wadah Kata

Tinjauan ringkes sareng setelan tina Wadah Kata
Artikel ieu bakal ngabahas kumaha gawéna Wadah Kata, sarta bakal aya ogé bagian praktis kalawan sambungan maranéhna pikeun Docker.

Ngeunaan masalah umum sareng Docker sareng solusi na ieu ditulis, Dinten ieu kuring bakal ngajelaskeun sakeudeung palaksanaan tina Wadah Kata. Kata Containers mangrupikeun runtime wadah anu aman dumasar kana mesin virtual anu hampang. Gawé sareng aranjeunna sami sareng wadah anu sanés, tapi salian aya isolasi anu langkung dipercaya nganggo téknologi virtualisasi hardware. proyék nu dimimitian dina 2017, nalika komunitas nu ngaranna sarua réngsé ngahiji tina gagasan pangalusna ti Intel Hapus Wadahna sarta Hyper.sh RunV, nu satutasna karya dituluykeun dina rojongan pikeun sagala rupa arsitéktur, kaasup AMD64, ARM, IBM p- sarta z. -seri. Salaku tambahan, karya dirojong di jero hypervisors QEMU, Firecracker, sareng aya ogé integrasi sareng containerd. Kodeu sayogi di GitHub handapeun lisénsi MIT.

Fitur utama

  • Gawé sareng inti anu misah, sahingga nyayogikeun jaringan, mémori sareng isolasi I / O, kamungkinan pikeun maksakeun panggunaan isolasi hardware dumasar kana ekstensi virtualisasi.
  • Rojongan pikeun standar industri kaasup OCI (format wadahna), Kubernetes CRI
  • Kinerja wadah konvensional anu stabil Linux, ningkatkeun isolasi tanpa overhead anu mangaruhan kinerja mesin virtual biasa
  • Ngaleungitkeun kabutuhan pikeun ngajalankeun peti di jero mesin virtual pinuh, antarmuka umum nyederhanakeun integrasi sareng peluncuran

setting

aya sakumpulan pilihan pamasangan, kuring bakal mertimbangkeun pamasangan tina repositori, dumasar kana sistem operasi Centos 7.
penting: Karya Wadah Kata dirojong ukur dina hardware, diteruskeun virtualisasi henteu salawasna jalan ogé peryogi rojongan sse4.1 ti prosésor.

Masang Wadah Kata cukup saderhana:

Pasang utilitas pikeun damel sareng repositori:

# yum -y install yum-utils

Pareuman Selinux (langkung leres pikeun ngonpigurasikeun, tapi pikeun kesederhanaan kuring mareuman):

# setenforce 0
# sed -i 's/^SELINUX=enforcing$/SELINUX=permissive/' /etc/selinux/config

Urang sambungkeun Repository jeung ngalakukeun pamasangan

# source /etc/os-release
# ARCH=$(arch)
# BRANCH="${BRANCH:-stable-1.10}"
# yum-config-manager --add-repo "http://download.opensuse.org/repositories/home:/katacontainers:/releases:/${ARCH}:/${BRANCH}/CentOS_${VERSION_ID}/home:katacontainers:releases:${ARCH}:${BRANCH}.repo"
# yum -y install kata-runtime kata-proxy kata-shim

carana ngatur

Kuring bakal nyetél pikeun damel sareng docker, pamasanganna khas, kuring moal ngajelaskeun langkung rinci:

# rpm -qa | grep docker
docker-ce-cli-19.03.6-3.el7.x86_64
docker-ce-19.03.6-3.el7.x86_64
# docker -v
Docker version 19.03.6, build 369ce74a3c

Urang nyieun parobahan ka daemon.json:

# cat <<EOF > /etc/docker/daemon.json
{
  "default-runtime": "kata-runtime",
  "runtimes": {
    "kata-runtime": {
      "path": "/usr/bin/kata-runtime"
    }
  }
}
EOF

Balikan deui docker:

# service docker restart

Pariksa Kaséhatan

Upami anjeun ngamimitian wadahna sateuacan ngamimitian deui docker, anjeun tiasa ningali yén uname bakal masihan versi kernel anu dijalankeun dina sistem utama:

# docker run busybox uname -a
Linux 19efd7188d06 3.10.0-1062.12.1.el7.x86_64 #1 SMP Tue Feb 4 23:02:59 UTC 2020 x86_64 GNU/Linux

Saatos balikan deui, versi kernel sapertos kieu:

# docker run busybox uname -a
Linux 9dd1f30fe9d4 4.19.86-5.container #1 SMP Sat Feb 22 01:53:14 UTC 2020 x86_64 GNU/Linux

Langkung tim!

# time docker run busybox mount
kataShared on / type 9p (rw,dirsync,nodev,relatime,mmap,access=client,trans=virtio)
proc on /proc type proc (rw,nosuid,nodev,noexec,relatime)
tmpfs on /dev type tmpfs (rw,nosuid,size=65536k,mode=755)
devpts on /dev/pts type devpts (rw,nosuid,noexec,relatime,gid=5,mode=620,ptmxmode=666)
sysfs on /sys type sysfs (ro,nosuid,nodev,noexec,relatime)
tmpfs on /sys/fs/cgroup type tmpfs (ro,nosuid,nodev,noexec,relatime,mode=755)
cgroup on /sys/fs/cgroup/systemd type cgroup (ro,nosuid,nodev,noexec,relatime,xattr,name=systemd)
cgroup on /sys/fs/cgroup/cpu,cpuacct type cgroup (ro,nosuid,nodev,noexec,relatime,cpu,cpuacct)
cgroup on /sys/fs/cgroup/blkio type cgroup (ro,nosuid,nodev,noexec,relatime,blkio)
cgroup on /sys/fs/cgroup/memory type cgroup (ro,nosuid,nodev,noexec,relatime,memory)
cgroup on /sys/fs/cgroup/devices type cgroup (ro,nosuid,nodev,noexec,relatime,devices)
cgroup on /sys/fs/cgroup/perf_event type cgroup (ro,nosuid,nodev,noexec,relatime,perf_event)
cgroup on /sys/fs/cgroup/net_cls,net_prio type cgroup (ro,nosuid,nodev,noexec,relatime,net_cls,net_prio)
cgroup on /sys/fs/cgroup/freezer type cgroup (ro,nosuid,nodev,noexec,relatime,freezer)
cgroup on /sys/fs/cgroup/pids type cgroup (ro,nosuid,nodev,noexec,relatime,pids)
cgroup on /sys/fs/cgroup/cpuset type cgroup (ro,nosuid,nodev,noexec,relatime,cpuset)
mqueue on /dev/mqueue type mqueue (rw,nosuid,nodev,noexec,relatime)
shm on /dev/shm type tmpfs (rw,nosuid,nodev,noexec,relatime,size=65536k)
kataShared on /etc/resolv.conf type 9p (rw,dirsync,nodev,relatime,mmap,access=client,trans=virtio)
kataShared on /etc/hostname type 9p (rw,dirsync,nodev,relatime,mmap,access=client,trans=virtio)
kataShared on /etc/hosts type 9p (rw,dirsync,nodev,relatime,mmap,access=client,trans=virtio)
proc on /proc/bus type proc (ro,relatime)
proc on /proc/fs type proc (ro,relatime)
proc on /proc/irq type proc (ro,relatime)
proc on /proc/sys type proc (ro,relatime)
tmpfs on /proc/acpi type tmpfs (ro,relatime)
tmpfs on /proc/timer_list type tmpfs (rw,nosuid,size=65536k,mode=755)
tmpfs on /sys/firmware type tmpfs (ro,relatime)

real    0m2.381s
user    0m0.066s
sys 0m0.039s

# time docker run busybox free -m
              total        used        free      shared  buff/cache   available
Mem:           1993          30        1962           0           1        1946
Swap:             0           0           0

real    0m3.297s
user    0m0.086s
sys 0m0.050s

Uji beban gancang

Pikeun meunteun karugian tina virtualisasi - kuring ngajalankeun sysbench, salaku conto utama nyandak pilihan ieu.

Ngajalankeun sysbench nganggo Docker + containerd

Tés prosésor

sysbench 1.0:  multi-threaded system evaluation benchmark

Running the test with following options:
Number of threads: 1
Initializing random number generator from current time

Prime numbers limit: 20000

Initializing worker threads...

Threads started!

General statistics:
    total time:                          36.7335s
    total number of events:              10000
    total time taken by event execution: 36.7173s
    response time:
         min:                                  3.43ms
         avg:                                  3.67ms
         max:                                  8.34ms
         approx.  95 percentile:               3.79ms

Threads fairness:
    events (avg/stddev):           10000.0000/0.00
    execution time (avg/stddev):   36.7173/0.00

tés RAM

sysbench 1.0:  multi-threaded system evaluation benchmark

Running the test with following options:
Number of threads: 1
Initializing random number generator from current time

Initializing worker threads...

Threads started!

Operations performed: 104857600 (2172673.64 ops/sec)

102400.00 MiB transferred (2121.75 MiB/sec)

General statistics:
    total time:                          48.2620s
    total number of events:              104857600
    total time taken by event execution: 17.4161s
    response time:
         min:                                  0.00ms
         avg:                                  0.00ms
         max:                                  0.17ms
         approx.  95 percentile:               0.00ms

Threads fairness:
    events (avg/stddev):           104857600.0000/0.00
    execution time (avg/stddev):   17.4161/0.00

Ngajalankeun sysbench nganggo Docker + Kata Containers

Tés prosésor

sysbench 1.0:  multi-threaded system evaluation benchmark

Running the test with following options:
Number of threads: 1
Initializing random number generator from current time

Prime numbers limit: 20000

Initializing worker threads...

Threads started!

General statistics:
    total time:                          36.5747s
    total number of events:              10000
    total time taken by event execution: 36.5594s
    response time:
         min:                                  3.43ms
         avg:                                  3.66ms
         max:                                  4.93ms
         approx.  95 percentile:               3.77ms

Threads fairness:
    events (avg/stddev):           10000.0000/0.00
    execution time (avg/stddev):   36.5594/0.00

tés RAM

sysbench 1.0:  multi-threaded system evaluation benchmark

Running the test with following options:
Number of threads: 1
Initializing random number generator from current time

Initializing worker threads...

Threads started!

Operations performed: 104857600 (2450366.94 ops/sec)

102400.00 MiB transferred (2392.94 MiB/sec)

General statistics:
    total time:                          42.7926s
    total number of events:              104857600
    total time taken by event execution: 16.1512s
    response time:
         min:                                  0.00ms
         avg:                                  0.00ms
         max:                                  0.43ms
         approx.  95 percentile:               0.00ms

Threads fairness:
    events (avg/stddev):           104857600.0000/0.00
    execution time (avg/stddev):   16.1512/0.00

Sacara prinsip, kaayaan parantos jelas, tapi langkung optimal pikeun ngajalankeun tés sababaraha kali, ngaleungitkeun outliers sareng rata-rata hasil, janten kuring henteu ngalakukeun deui tés.

papanggihan

Sanaos kanyataan yén wadah sapertos kitu nyandak sakitar lima dugi ka sapuluh kali langkung lami pikeun ngamimitian (waktos ngajalankeun khas pikeun paréntah anu sami nalika nganggo containerd kirang ti sapertilu detik), aranjeunna tetep tiasa dianggo gancang upami urang nyandak waktos ngamimitian mutlak (aya conto di luhur, paréntah dipigawé dina rata-rata tilu detik). Nya, hasil tés gancang CPU sareng RAM nunjukkeun hasil anu ampir sami, anu teu tiasa tapi girang, khususna dina kanyataan yén isolasi disayogikeun nganggo mékanisme anu dijalankeun sapertos kvm.

Bewara

Tulisan éta mangrupikeun ulasan, tapi masihan anjeun kasempetan pikeun ngaraosan runtime alternatif. Seueur daérah aplikasi henteu katutupan, contona, situs éta ngajelaskeun kamampuan pikeun ngajalankeun Kubernetes di luhur Wadah Kata. Salaku tambahan, anjeun ogé tiasa ngajalankeun sababaraha tés anu difokuskeun pikeun milarian masalah kaamanan, netepkeun larangan, sareng hal-hal anu pikaresepeun.

Kuring naroskeun ka sadayana anu parantos maca sareng ngulang deui di dieu pikeun ngiringan survey, dimana publikasi anu bakal datang ngeunaan topik ieu bakal gumantung.

Ngan pamaké nu kadaptar bisa ilubiung dina survey. Daptar, Punten.

Naha kuring kedah neraskeun nyebarkeun tulisan ngeunaan Wadah Kata?

  • 80,0%Enya, tulis deui!28

  • 20,0%Henteu, ulah…7

35 pamaké milih. 7 pamaké abstained.

sumber: www.habr.com

Mésér hosting anu dipercaya pikeun situs anu gaduh panyalindungan DDoS, server VPS VDS 🔥 Meser hosting situs wéb anu tiasa dipercaya nganggo panyalindungan DDoS, server VPS VDS | ProHoster