Linux Namespaces and Control Groups - Revision history

Pio2pio: /* Control Groups */

2020-03-06T08:49:16Z

Control Groups

← Older revision		Revision as of 10:49, 6 March 2020
Line 62:		Line 62:

	Common Control Groups (cgrups) subsystems, as new subsystems are constantly developed		Common Control Groups (cgrups) subsystems, as new subsystems are constantly developed
	;blkio (disk): subsystem allows limit and measure I/Os for each process group		;blkio (disk): subsystem allows or limit and measure I/Os for each process group; allows or denies access to devices in a cgroup based on I/o
	;cpu: subsystem allows to monitor CPU by a group of processes, enables you to set weights and keep track of usage per CPU		;cpu: subsystem allows to monitor CPU by a group of processes, enables you to set weights and keep track of usage per CPU
	;cpuacct: (cpu account) generates automatic reports on CPU resources used by tasks in a cgroup		;cpuacct: (cpu account) generates automatic reports on CPU resources used by tasks in a cgroup

Pio2pio: /* Control Groups */

2020-03-06T08:46:03Z

Control Groups

← Older revision		Revision as of 10:46, 6 March 2020
Line 55:		Line 55:

	= Control Groups =		= Control Groups =
	Think as a ''process containers'', to avoid any confusion with Docker Containers got renamed into ''Control Groups'.		Think as ''a process containers'', to avoid any confusion with Docker Containers got renamed into ''Control Groups''.

Pio2pio: /* Control Groups */

2020-03-06T08:45:23Z

Control Groups

← Older revision		Revision as of 10:45, 6 March 2020
Line 55:		Line 55:

	= Control Groups =		= Control Groups =
			Think as a ''process containers'', to avoid any confusion with Docker Containers got renamed into ''Control Groups'.


	;Control Groups (Cgroups): provide ''resource limitation'' and reporting capability within the container space. They allow for granular control over what host resources are allocated to container(s). It's Linux kernel feature that limits the resource usage of a process or group of processes.		;Control Groups (Cgroups): provide ''resource limitation'' and reporting capability within the container space. They allow for granular control over what host resources are allocated to container(s). It's Linux kernel feature that limits the resource usage of a process or group of processes.

Line 67:		Line 70:
	;memory: memory is managed in blocks known as pages. A page is 4096 bytes, it means 1 Megabyte is equal to 256 pages of memory. Memory cgroup allows you track memory use by a process/group of processes down do the specific memory page.		;memory: memory is managed in blocks known as pages. A page is 4096 bytes, it means 1 Megabyte is equal to 256 pages of memory. Memory cgroup allows you track memory use by a process/group of processes down do the specific memory page.
	;net_cls (network bandwith): allows tags network packets with ''classid'' allowing identification of packets origination from a particular ''cgroup'' task. This allows to set QOS based on sources and destinations.		;net_cls (network bandwith): allows tags network packets with ''classid'' allowing identification of packets origination from a particular ''cgroup'' task. This allows to set QOS based on sources and destinations.
	net_prio (network priority): subsystem provides a way to set the priority of network traffic dynamically.		;net_prio (network priority): subsystem provides a way to set the priority of network traffic dynamically.

Pio2pio: /* Namespaces operations */

2020-03-05T11:31:30Z

Namespaces operations

← Older revision		Revision as of 13:31, 5 March 2020
Line 47:		Line 47:
	target prot opt source destination		target prot opt source destination
	</source>		</source>


			;Tooling
			*<code>pivot_root</code> - moves the root file system of the current process to the directory put_old and makes new_root the new root file system
			*<code>unshare</code> - run program with some namespaces unshared from parent
			*<code>ip netns</code> - manage network namespace

	= Control Groups =		= Control Groups =

Pio2pio: /* Linux Namespaces */

2020-03-05T08:45:23Z

Linux Namespaces

← Older revision		Revision as of 10:45, 5 March 2020
Line 4:		Line 4:
	Namespaces has been brought to Linux kernel in version 3.8		Namespaces has been brought to Linux kernel in version 3.8

	;Namespaces provide: ''isolation'' so that other pieces of the system remain unaffected by whatever is within the namespace. ''Docker'' uses namespaces of various kinds to provide the isolation that containers need in order to remain portable and refrain from affecting the remainder of the host system		;Namespaces provide: ''isolation'' so that other pieces of the system remain unaffected by whatever is within the namespace. ''Docker'' uses namespaces of various kinds to provide the isolation that containers need in order to remain portable and refrain from affecting the remainder of the host system. The purpose of each namespace is to wrap a particular global system resource in an abstraction that makes it appear to the processes within the namespace that they have their own isolated instance of the global resource.

	Namespaces in Linux kernel (6 ns):		Namespaces in Linux kernel (6 ns):

Pio2pio: /* Control Groups */

2020-03-05T08:42:46Z

Control Groups

← Older revision		Revision as of 10:42, 5 March 2020
Line 70:		Line 70:

	PIDs inside cgroups are allowed to have its own process hierarchy that are independent from each other. It allows one process to live in many trees.		PIDs inside cgroups are allowed to have its own process hierarchy that are independent from each other. It allows one process to live in many trees.

			= References =
			*[https://dev.to/nicolasmesa/container-creation-using-namespaces-and-bash-6g Container Creation Using Namespaces and Bash]

Pio2pio: /* Control Groups */

2020-02-29T23:31:33Z

Control Groups

← Older revision		Revision as of 01:31, 1 March 2020
Line 49:		Line 49:

	= Control Groups =		= Control Groups =
			;Control Groups (Cgroups): provide ''resource limitation'' and reporting capability within the container space. They allow for granular control over what host resources are allocated to container(s). It's Linux kernel feature that limits the resource usage of a process or group of processes.

	;Control Groups (Cgroups): provide ''resource limitation'' and reporting capability within the container space. They allow for granular control over what host resources are allocated to container/s and when they are allocated. It's Linux kernel feature that limits the resource usage of a process or group of processes.

	Common Control Groups		Common Control Groups (cgrups) subsystems, as new subsystems are constantly developed
	* CPU		;blkio (disk): subsystem allows limit and measure I/Os for each process group
	* Memory		;cpu: subsystem allows to monitor CPU by a group of processes, enables you to set weights and keep track of usage per CPU
	* ~~Network Bandwidth~~		;cpuacct: (cpu account) generates automatic reports on CPU resources used by tasks in a cgroup
	* ~~Disk~~		;cpuset: allows to pin a process or group of processes to one CPU
	* Priority		;devices: allows or denies access to devices by tasks in a cgroup
			;freezer: suspends or resumes tasks in a cgroup. The SIGSTOP signal is sent to the whole container
			;memory: memory is managed in blocks known as pages. A page is 4096 bytes, it means 1 Megabyte is equal to 256 pages of memory. Memory cgroup allows you track memory use by a process/group of processes down do the specific memory page.
			;net_cls (network bandwith): allows tags network packets with ''classid'' allowing identification of packets origination from a particular ''cgroup'' task. This allows to set QOS based on sources and destinations.
			net_prio (network priority): subsystem provides a way to set the priority of network traffic dynamically.


			;Implementations
			* Kernel 2.6.24 - Cgroups v1
			* Kernel 3.1.0 - Cgroups v2


			PIDs inside cgroups are allowed to have its own process hierarchy that are independent from each other. It allows one process to live in many trees.

Pio2pio: /* Linux Namespaces */

2020-02-29T23:06:22Z

Linux Namespaces

@@ Line 7: / Line 7: @@
 Namespaces in Linux kernel (6 ns):
-* User :- (1.12+ experimental) map container users to host users. This can break other isolation items; allows for 32 nested mappings
+;User: Each Namespace can be given its own set of UIDs and GUIDs. (Docker 1.12+ experimental) maps container users to host users. This can break other isolation items; allows for 32 nested mappings.
-* PID :- Process ID - container encapsulate everything into a single process; provides processes with independent set of process IDs (PIDs); allow to avoid PID conflicts
+;IPC (Inter-Process Communication): eg. swarm services allowed to communicate with containers but not outside; isolates system resources from a process, while giving processes created in an IPC namespace visibility to each other allowing for interprocess communication (aka exchange data). Creates a separate message queue for each container that enables such IPC comms.
-* Mount - controls volume mounts visible to each container; similar to chroot
+;UTS (Unix Time Sharing): namespace isolation of hostname for each container; allows a single system to appear to have a different hostname and domain names to different processes. This namespace determines what hostname and domain name the process running inside that namespace sees.
-* IPC :- Inter-Process Communication - eg. swarm services allowed to communicate with containers but not outside; isolates system resources from a process, while giving processes crested IPC namespace visibility to each other allowing for interprocess communication
+;Mount: controls the mountpoints that are visible to each container; allows processes to be mounted in different trees; similar to chroot
-* Network - allows containers to have its own network stack; eg. ips, routing tables, fw rules, network devices
+;PID (Process ID): provides processes with independent set of process IDs (PIDs); allow to avoid PIDs conflicts
-* UTS :- Unix Time Sharing namespace, allows a single system to appear to have a different host and domain names to different processes. This namespace determines what hostname and domain name the process running inside that namespace sees.
+;Network: allows containers to have its own network stack of eg. IPs, routing tables, iptables rules, network devices
 = Control Groups =

Pio2pio at 22:36, 29 February 2020

2020-02-29T22:36:44Z

← Older revision		Revision as of 00:36, 1 March 2020
Line 1:		Line 1:
			;''namespaces'': provide security and isolation by controlling what a process can see
			;''control groups'': provide resource management and reporting, by controlling what a process can access
	= Linux Namespaces =		= Linux Namespaces =
	Namespaces has been brought to Linux kernel in version 3.8		Namespaces has been brought to Linux kernel in version 3.8

Pio2pio: /* Linux Namespaces */

2020-02-29T22:36:04Z

Linux Namespaces

← Older revision		Revision as of 00:36, 1 March 2020
Line 1:		Line 1:
	= Linux Namespaces =		= Linux Namespaces =
	Namespaces has been brought to Linux kernel in version 3.8		Namespaces has been brought to Linux kernel in version 3.8

	~~''namespaces'' provide security and isolation by controlling what a process can see, ''control groups'' provide resource management and reporting, by controlling what a process can access~~


	;Namespaces provide: ''isolation'' so that other pieces of the system remain unaffected by whatever is within the namespace. ''Docker'' uses namespaces of various kinds to provide the isolation that containers need in order to remain portable and refrain from affecting the remainder of the host system		;Namespaces provide: ''isolation'' so that other pieces of the system remain unaffected by whatever is within the namespace. ''Docker'' uses namespaces of various kinds to provide the isolation that containers need in order to remain portable and refrain from affecting the remainder of the host system

	~~Namespace Type (~~in kernel):		Namespaces in Linux kernel (6 ns):
	* User :- (1.12+ experimental) map container users to host users. This can break other isolation items; allows for 32 nested mappings		* User :- (1.12+ experimental) map container users to host users. This can break other isolation items; allows for 32 nested mappings
	* PID :- Process ID - container encapsulate everything into a single process; provides processes with independent set of process IDs (PIDs); allow to avoid PID conflicts		* PID :- Process ID - container encapsulate everything into a single process; provides processes with independent set of process IDs (PIDs); allow to avoid PID conflicts