Log in

No account? Create an account

Previous Entry | Next Entry

Last week me and Kirill Korotaev visited Ottawa to take part in Linux Kernel Summit and Linux Symposium. It was our first time on these events, so we were in a good mood despite the 16 hours flight from Moscow to Ottawa, and the 8 hours timezone change. We went to those event mostly to discuss containers and their integration into mainstream.

Containers (VEs, VPSs), or kernel-level virtualization technology (implemented in OpenVZ), were discussed very widely during both events. The topic was presented by three parties:

  • OpenVZ
  • IBM (ex-Meiosys guys)
  • Eric Biederman
Unfortunately, Herbert Poetzl (of Linux-VServer) was not able to attend the event :(

The overall feeling among the kernel people is: containers are a good feature to have in Linux kernel, let’s merge it into mainstream. But since several different implementations of the technology are available, and several groups are working on those, the mainstream code should be a result of consensus between all those implementations.

So, let me describe what are all those groups are aiming for:

  • Eric Biederman wants to have so-called namespaces in kernel. Namespaces are basically a building blocks of containers, for example, with user namespace we have an ability to have the same root user in different containers; network namespace gives an ability to have a separate network interface; process namespace is when you have an isolated set of processes. All the namespaces combined together creates a container. But, as Eric states, an ability to use not all but only selected namespaces gives endless possibilities to a user.
  • IBM people want application containers, and for them the main purpose of such containers is live migration of those. The difference between app. container and the “full” (system) container is a set of features: for example, an application container might lack /proc virtualization, devices, pseudo-terminals (needed to run ssh, for example) etc. So, an application container might be seen as a subset of a system container.
  • OpenVZ wants system containers that resemble the real system as much as possible. In other words, we want to preserve existing kernel APIs as much as possible inside a container, so all of the existing Linux distributions and applictions should run fine inside a container without any modifications. Of course, the goal is not 100% achievable, for example we do not want the container to be able to set the system time.
  • Linux-VServer wants just about the same as OpenVZ, it’s only that their implementations of various components are different, and their level of a container resembling a real system is a bit lower (for example, in networking).

So, from the first glance it’s really hard to find a consensus. Say, Eric’s approach of having a distinct namespaces faces the fact that all the namespaces are heavily interdependent -- for example, processes belongs to user, so process namespace depend on user namespace, and you can hardly find a namespace which can be independent on all the others.

IBM’s application containers are closer to reality, and actually they might be a first step towards a full containers implementation in mainstream. How hard is to move from app. containers to system containers is not yet clear at this point though -- for example, if we do not care about /proc virtualization from the beginning, it might be real pain to add it later. From the other hand, IBM might be quite happy with full containers since they do all they want.

To conclude — this is not going to be an easy task, but it’s doable, and the thing that we met in person and discussed all that stuff, and that all the other kernel developers are all for us helps a lot. Sooner or later, we will be there.


( 7 comments — Leave a comment )
Aug. 4th, 2006 03:44 pm (UTC)
Great report
But like... how was the beer, eh?
Aug. 4th, 2006 04:10 pm (UTC)
Re: Great report
Good question!

Believe it or not, I only consumed only about two litres of beer for the whole week :( and clearly, there is a room for improvement here!

Bottled Guinness, served for the Kernel Guys and the ones who sneaked in (read me), was just great! As for the other brands I tried, I have to conclude U.S. is way behind Canada as it comes for the good beer (and Canada is way behing, say, Czech, but this is a different story...)
Aug. 4th, 2006 04:51 pm (UTC)
Re: Beer
Czech beer is not better than Canadian. It's the same kind if argument that states French wines are better than of from California, Chile, Australia or Niagara Falls, and it usually supported only by a snobbery or ignorance.

Using the term "behind" related to beer brewing along with saying that bottled Guinness is great makes me think that beer is not one of your favorite drinks and/or area of expertise, so there is no reason for you to be judgmental.

Remember, Canada was once in a pre-war situation with the United States because of some careless beer remarks (there is a documentary "Canadian Bacon" by Michael Moore about that dark period). You don't want banning your software from North American market for the same reason.
Aug. 4th, 2006 08:08 pm (UTC)
Re: Beer
While I do not consider myself as an ultimate beer expert, I can say I'm at the very least fond of it.

And yes, I was not expecting bottled Guinness to be great (and I do not expect much from bottled beers, comparing to those "from the tap") -- and was really amused by the fact that it was great. I don't know why -- probably it's non-pasteurized? Or maybe I just was in a good mood -- who knows? But it tasted really great (and I tried good (and sometimes bad) Guinness in a lot of places and countries).

Finally -- I've been to Prague, Czech Republic, and I've been to England, Scotland, Germany. And I talk from my experience -- all for all, I really enjoyed Czech beer more than the beer in any other country. Well, Scotland definitely won the first place when it comes for ales.

PS oh my, that deserves a separate LJ community! <lj comm="openvz-beer" perhaps? ;)
Aug. 17th, 2006 09:44 am (UTC)
System time
There is no reason at all each container can't set its own system time. We don't think of global values like that as a namespace but they are. You just need to track offsets for ech container
Aug. 23rd, 2006 02:07 am (UTC)
Re: System time
each host (machine) has to run @ "actual time", however containers could be in different time zones if that is what is meant here..

interesting report, by the way ;)
May. 2nd, 2007 03:17 am (UTC)
Is it any updates on the topic?
( 7 comments — Leave a comment )

Latest Month

July 2016

Page Summary

Powered by LiveJournal.com
Designed by Tiffany Chow