Upload
others
View
2
Download
0
Embed Size (px)
Citation preview
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 1/55
VMS IN A CONTAINER-VMS IN A CONTAINER-CENTRIC WORLDCENTRIC WORLD
ALEX BENNÉEALEX BENNÉEBKK19BKK19
1
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 2/55
INTRODUCTIONINTRODUCTION
2 . 1
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 3/55
WHO AM IWHO AM I
Alex BennéeSenior Virtualisation Engineer @LinaroQEMU's TCG (emulation)/KVMIRC: stsquad/ajb-linaro
2 . 2
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 4/55
DOCKER HYPE?DOCKER HYPE?
2 . 3
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 5/55
DEVELOPER BUZZWORDSDEVELOPER BUZZWORDS
LightweightAgileDevOpsCloud
2 . 4
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 6/55
OTHER USE CASESOTHER USE CASES
ApplicationSandboxesAndroid-in-a-Box
2 . 5
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 7/55
UBIQUITOUSUBIQUITOUS
2 . 6
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 8/55
CONTAINER OVERVIEWCONTAINER OVERVIEW
3 . 1
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 9/55
WHAT IS A CONTAINERWHAT IS A CONTAINER
3 . 2
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 10/55
TECHNOLOGIESTECHNOLOGIES
3 . 3
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 11/55
NAMESPACESNAMESPACES
3 . 4
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 12/55
CONTROL GROUPSCONTROL GROUPS
limitsaccountingprioritycontrol
3 . 5
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 13/55
SANDBOXINGSANDBOXING
seccompnet�lterbpf
3 . 6
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 14/55
FILE-SYSTEMSFILE-SYSTEMS
3 . 7
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 15/55
RUNTIMESRUNTIMES
LXCDockersystemd-nspawn
3 . 8
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 16/55
BUT….BUT….
4 . 1
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 17/55
"container with an attacker-controlled image"…
"overwrite the host runc binary (and consequently obtain host rootaccess)"
CVE-2019-5736CVE-2019-5736
4 . 2
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 18/55
DETAILSDETAILS
Attacker Image (i.e. from a hub)with root privilegesmodi�es guest binary (/bin/target)#!/proc/self/exe
Host launches a containerattempts to run /bin/target
actually runs itselfattacker grabs /proc/TARGETPID/exekeeps writing until PROFIT!
4 . 3
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 19/55
ENTER VMSENTER VMS
5 . 1
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 20/55
WHAT IS A VIRTUAL MACHINEWHAT IS A VIRTUAL MACHINE
5 . 2
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 21/55
ISOLATIONISOLATION
5 . 3
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 22/55
BEST OF BOTH WORLDSBEST OF BOTH WORLDS
6 . 1
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 23/55
MORE LAYERSMORE LAYERS
6 . 2
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 24/55
ABSTRACTION == COSTABSTRACTION == COST
6 . 3
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 25/55
DOCKER 10.9 SECONDSDOCKER 10.9 SECONDS
6 . 4
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 26/55
KVM 12.0 SECONDSKVM 12.0 SECONDS
6 . 5
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 27/55
KVM HOST VIEWKVM HOST VIEW
6 . 6
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 28/55
MITIGATIONMITIGATION
7 . 1
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 29/55
VIRTUAL HWVIRTUAL HW
MinimalParavirtualizedHot-Pluggable
7 . 2
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 30/55
GUEST SETUPGUEST SETUP
Minimal KernelLightweightUserspaceDirect Boot/uBios
7 . 3
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 31/55
HOST/GUEST COMMUNICATIONHOST/GUEST COMMUNICATION
7 . 4
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 32/55
VIRTIO-VSOCKVIRTIO-VSOCK
bi-directional socketzero con�gurationmore ef�cient thannetwork
7 . 5
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 33/55
VIRTIO-FSVIRTIO-FS
POSIX APICo-locatedhost/guestShared Memory
7 . 6
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 34/55
EXAMPLE: CHROMOS CROSTINIEXAMPLE: CHROMOS CROSTINI
8 . 1
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 35/55
CHROME OSCHROME OS
Trusted BootpathLinux KernelMinimal GentooUserspaceChrome Browser
8 . 2
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 36/55
ARCHITECTUREARCHITECTURE
8 . 3
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 37/55
CROSVMCROSVM
8 . 4
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 38/55
EXAMPLE: KATA CONTAINERSEXAMPLE: KATA CONTAINERS
9 . 1
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 39/55
KATA CONTAINERSKATA CONTAINERS
Lightweight VMsDockerIntegration
9 . 2
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 40/55
ARCHITECTUREARCHITECTURE
9 . 3
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 41/55
FEATURESFEATURES
Optimised Kernelrootfs(initrd/nvdimm)
NEMU (NoEmu QEMU)
9 . 4
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 42/55
EXAMPLE: GVISOREXAMPLE: GVISOR
10 . 1
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 43/55
REMAINING WORKREMAINING WORK
11 . 1
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 44/55
DE-BLOAT QEMUDE-BLOAT QEMU
Reduce size & start-up–disable-tcgKCon�g languageWork in progress
11 . 2
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 45/55
X86 KVM FEATURE PARITYX86 KVM FEATURE PARITY
HotplugSupport
11 . 3
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 46/55
SUMMARYSUMMARY
12 . 1
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 47/55
CONTAINERSCONTAINERS
PopularToolingPortability
12 . 2
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 48/55
VIRTUAL MACHINESVIRTUAL MACHINES
More de�ned isolationPerformance Trade-offsCan be contained
12 . 3
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 49/55
COMBINATIONCOMBINATION
Best of BothWorldsDefence in Depth
12 . 4
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 50/55
QUESTIONS?QUESTIONS?
13 . 1
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 51/55
REFERENCESREFERENCESKata Containers: Advanced Features of QEMU forBetter Container Isolation by Eric ErnstCrostini: A Linux Desktop on ChromeOS
14 . 1
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 52/55
EXTRA SLIDESEXTRA SLIDES
15 . 1
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 53/55
"The Floppy Disk Controller (FDC) in QEMU"…
"allows local guest users to cause a denial of service…or possiblyexecute arbitrary code"
CVS-2015-3456 (VENOM)CVS-2015-3456 (VENOM)
15 . 2
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 54/55
CONTAINER PATTERNSCONTAINER PATTERNS
Service OrientatedArchitectureStateless DesignComposability
15 . 3
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 55/55
REASONS FOR POPULARITYREASONS FOR POPULARITY
ToolingPortabilityOrchestration
15 . 4