Cgroups, namespaces, and beyond: what are containers made from?

with Jérôme Petazzoni, Tinkerer Extraordinaire, Docker
Linux containers are different from Solaris Zones or BSD Jails: they use discrete kernel features like cgroups, namespaces, SELinux, and more. We will describe those mechanisms in depth, as well as demo how to put them together to produce a container. We will also highlight how different container runtimes compare to each other.
Learn more about Docker www.docker.com/what-docker
--
Docker is an open platform for developers and system administrators to build, ship and run distributed applications. With Docker, IT organizations shrink application delivery from months to minutes, frictionlessly move workloads between data centers and the cloud and can achieve up to 20X greater efficiency in their use of computing resources. Inspired by an active community and by transparent, open source innovation, Docker containers have been downloaded more than 700 million times and Docker is used by millions of developers across thousands of the world’s most innovative organizations, including eBay, Baidu, the BBC, Goldman Sachs, Groupon, ING, Yelp, and Spotify. Docker’s rapid adoption has catalyzed an active ecosystem, resulting in more than 180,000 “Dockerized” applications, over 40 Docker-related startups and integration partnerships with AWS, Cloud Foundry, Google, IBM, Microsoft, OpenStack, Rackspace, Red Hat and VMware.

[@nelsonjoppi]

- What is a container? 2:40 - Control Groups. 5:12 - Different type of CGroups: 7:05 - Namespaces: 24:43 - Container runtimes (cgroups + namespaces): 35:51

[@omerpriel5588]

For 8 years since this video came out. And still he is the only one who explained docker really well thank you very much

[@omerpriel5588]

And it was fun (in the good way)

[@rschmidtzalles]

After 4 years, this is one the best talks about docker

[@24Shredder]

I'm a Docker noob: after 4 years, does this video still say valid things? Behind the scenes, Docker is still working as this guy say?

[@anpham871]

@@24Shredder yes, fundamentals never change

[@alexjswilliamelise]

Saw this in 2020 unfortunately. This talk is so awesome. Should have saw this before.Thanks Jerome!

[@vladbagbuss]

Awesome talk! thanks for uploading the vid.

[@mads2k5]

Great talk. Went far further than most materials on (pure) docker. (and containers in general)

[@deeptivaidyula]

Very well presented. Thank you for uploading!

[@SithembisoKhumalo]

Great talk! Very informative

[@sudarshansargur9253]

What a fantastic talk!

[@sachinmainkar]

This has to be the first material any newcomer like me, to cgroups and namespaces encounters. Then read or listen to others to get more details. Merci beaucoup Monsieur !

[@MohamedAnsari_H]

This is the best place to start for someone coming from Linux

[@rakra4551]

The moment slides are replaced by the speaker, the line of thought/understanding is lost. The slides must be visible all the time. Great talk but bad camera placement.

[@nebulousnomad]

Also too much text in slides. Trying to listen to him talk fast and read at same time. Otherwise great informative presentation

[@MrNathanIL]

awesome talk. thank you ☺️

[@josephroland4000]

This is so interesting, simply the best, in this presentation i get to understand how docker works under the hood.

[@bhavesh1877]

Very informative, thanks.

[@nebulousnomad]

This was such a good presentation

[@balajipattabhiraman]

Awesome one. Loved it

[@ishi92]

Thank you !!!

[@BalvinderRawat]

Really informative :)

[@rezakh]

Great Talk! I wish the demo steps was documented in the presentation.

[@alitajvidi5610]

Excellent!!!

[@spillai6000]

Notes: - What is a container? 2:40 - Control Groups. 5:12 - Different type of CGroups: 7:05

[@amir3515]

Go on...

[@nelsonjoppi]

- What is a container? 2:40 - Control Groups. 5:12 - Different type of CGroups: 7:05 - Namespaces: 24:43 - Container runtimes (cgroups + namespaces): 35:51

[@sntshkmr60]

Bawandarful! Got to learn a lot about Linux kernel.

[@hardikdodiya1741]

Great talk, thanks.

[@youtube_resident]

great speach!

[@king0s]

❤ and gratitude

[@animalschannal123]

Thanks for sharing

[@dmytrohuz9323]

could someone explain or recommend something to read for understanding what and why is going on there with mount/unmount commands in demo project in the end.

[@berginv6827]

Great

[@patmansf]

Are there more details on the page overhead accounting (at 13:16)? Specifically what boot time (or kernel config) options disable it?

[@teddyzhai4442]

great talk. please persistently show the slides rather than full screen only to the presenter. sometimes it is hard to corresponds his explanation to the bullet points.

[@ArmenManukyan]

Funny that cgroups2 allows now to control percentage as well.

[@imanebt8617]

Thank you for this talk! By curiosity, are there open-source or on-the-market container runtimes that are not based on namespaces and cgroups ?

[@anywhereroam9698]

Yes. One example is Kata. It’s uses virtualisation to run containers. It’s open source.

[@user-uw7st6vn1z]

can someone help to explain why there is ubuntu and alpine docker image? how can ubuntu / alpine linux distribution live inside container? I dont understand!!!!

[@riderblack6401]

it is too complex to understand without a specilized backgroun. Anyone knows a refrence to start with understanding what he meant???

[@tejaszarekar9145]

I know right... You gotta be a kernel Hacker to know all of this...

[@f8881f]

25:00

[@ickyickyptangzoopboing]

couldn't fully follow the demo

[@keokawasaki7833]

skill issue

[@devakumarnm987]

is this video is still relevant in 2020?

[@KingslayerSrb]

in my mind - yes. cgroups are still cgroups, namespaces are namespaces, copy-on-write is copy-on-write. Can't see anything major changing there? Could be wrong, if so I hope someone corrects me, but I think the main innovation since this video went into container orchestration and everything that came out of that

[@tejaszarekar9145]

This is clearly not for everyone

[@kir9290]

sure it's not, understanding it requires some essential knowledge of OS concepts and mechanisms (especially Linux in this case)

[@arabiccola]

I don't mean to be disrespectful but this was 45 minutes of lame ass slides and jokes followed by 8 minutes of pure gold. I would have loved to have 53 minutes of that powerful demonstration. If anyone reads this and knows a place where this man demonstrates slowly and explains how to create the illusion of a container using Linux commands and all the other cgroup layers then please reply to this comment. Very impressive.

[@AndresMujica]

first chapter of Containerization with LXC by Konstantin Ivanov has it like that.

[@abdulrahmanalotaibi783]

d

[@SoeaOu]

That rude comment about systemd-nspawn maintainers at 37:15 was really childish and unprofessional. Beside that a very good presentation.

[@kukikukac]

it was funny

[@SisypheanRoller]

Funny how podman basically makes systemd a key part of local container management.

[@GUN2kify]

#2:55 - Container can be like VM ... that's the way how LXC works ... intended is *Docker is not like VM* .

[@igmarzullowski5605]

Nobody has broken out of OpenVZ ... then obviously it's so uninteresting that people even don't bother.

[@MrMikomi]

Not sure who really needs to know this stuff. If you're planning on creating the next Docker Corp maybe it's useful. If you merely want to use Docker.... I imagine pretty much none of this stuff is needed.

[@sjraju]

Great talk! Very informative