Containers training

[jiaqing-tee]

Containers training

Playlist: https://www.youtube.com/playlist?list=PLLTou95Km32RKy7RLTDkL4O8Zkj-taxnF

[jiaqing-tee]

Containerization

Title: Containerization Explained Link: https://youtu.be/0qotVMX-J5s

Takeaway

• Uses duplicated and unnecessary resources
• Using VMs: Incompatibility issues
• Using containers: Doesn't need OS dependencies thus using less resources
• Containers shares hardware resources. Able to use resources that other containers are not using

3 Step Process for Containers

1. Create Manifest: Describes the container
   • Docker: DockerFile
   • Cloud Foundry: manifest YAML
2. Build Image
   • Docker: Docker image
   • Rocket: Application Container Image (ACI)
3. Push image to registry
   • Contains all runtimes, libraries, and binaries for the application

[jiaqing-tee]

Containers and VMs Differences

Title: Containers vs VMs: What's the difference? Link: https://youtu.be/cjXI-yxqGTI

Takeaways

Differences

1. Virtualization
   • VMs are hardware level virtualization
   • Containers are operating system level virtualization
2. Isolation
   • VMs achieves isolation of machines
   • Containers deals with process isolation
3. Resources accessed
   • VMs: Hypervisor creates different machines out of server
   • Containers: Kernel have namespaces which allow the customization and appearance of each container instance has its own OS
   • Containers: Kernel have control groups (cgroups) which monitors and meters the resources. This helps to limit the resources the containers are accessing
4. Portability and Flexibility
   • VMs: Infinite flexibility of hardware
   • Containers: Infinite portability
   • Run type 2 hypervisor (VirtualBox) which gives flexibility with containers which gives portability together

[jiaqing-tee]

Kubernetes vs Docker

Title: Kubernetes vs. Docker: It's Not an Either/Or Question Link: https://youtu.be/2vMEQ5zs1ko

Takeaways

• Kubernetes is able to use existing Docker containers and workloads but also allows tackling of complex issues when moving in scale
• Kubernetes can use existing Dockerized applications but also orchestrate them and make the servers and space more effective
• Servers has worker nodes installed with Kubernetes with the main one to be master node
• Master node
  • Connects to all worker nodes
  • Decides where to host the applications (aka Docker containers)
  • Decides how to piece the worker notes together
  • Manages orchestrating

3 Major Kubernetes Advantages

1. Deployment
   • Kubernetes deployment: if application crashes, auto restarts
2. Development
   • Kubernetes deploys load balancers for microservices
   • Use Kubernetes service which make use of service registry and discovery capabilities
   • Each Kubernetes has a Kubernetes service --> allowing applications to speak to one another
3. Monitoring
   • Kubernetes has capabilities to see logs and CPU load in a UI
   • Community built many useful tools such as Istio

[jiaqing-tee]

Kubernetes and OpenShift

Title: Kubernetes and OpenShift: What's the Difference? Link: https://youtu.be/cTPFwXsM2po

Takeaways

• Kubernetes: open source project
• OpenShift: by Red Hat and powered by Origin Kubernetes Distribution (OKD) which includes:
  • Kubernetes (K8s)
  • Container Runtime: Docker
  • Service Matching Capabilities: Istio

    Deployment

• Deploy with K8s
  • Pull code from GitHub and spin up a container
  • Host container in registry: Docker Hub
  • CI/CD: Many options
  • More flexibility here
• Deploy with OpenShift (OS)
  • Just create application and project
  • A streamlined approach for DevOps and pipeline approach

Managing Applications

• K8s
  • Default dashboard comes with any Kubernetes distribution
  • Install additional dashboards: Use ELK stack / Grafana / Istio
• OS
  • Web console that builds on K8s API
  • Comes with capabilities for Site Reliability Engineering (SRE) and operation teams to manage workloads
  • Prescribed and opinionated way to do dashboard: EFK stack
  • Provides automated installers, Ansible playbooks
  • Easier to manage applications

Node Configuration

• Cluster made up of VMs
• K8s adding VM into cluster is time consuming and requires scripts to be developed
  • Setting up self registration
  • Different cloud automation setting up
  • Creating new VMs
  • Bring VMs into the cluster
• OS
  • Have Ansible playbooks and installers to bring new VM's into the cluster
  • Have ways to handle auto-scaling
  • Spinning up new VMs in response to load

Security

• K8s
  • Need to add Role-Based Access Control (RBAC)
  • Can add Identity and Access Management (IAM)
  • Can take any image out there in Docker Hub and will run as expected
• OS
  • Creating project provides RBAC and IAM
  • Add users will handle K8s name spacing and creating different security policies with best practices
  • Have restricted permissions where containers don't run as root thus images might not run as expected

[jiaqing-tee]

Bare Metal, VMs, and Containers

Title: Big Misconceptions about Bare Metal, Virtual Machines, and Containers Link: https://youtu.be/Jz8Gs4UHTO8

Takeaways

Bare metal server

• Bare metal server: Physical computer that is single tenant
• Gives complete control over hardware resources and software stack to run
• Software applications that require absolute highest performance from hardware, stick with bare metal
• Bare metal servers are physically isolated, providing 2 benefits
  1. Not affected by "noisy neighbor problem": Occurs when 1 tenant's performance because another tenant is sharing same hardware
  2. Provides highest level of security: Not affected b side-channel attacks which take advantage of design flaws in modern microprocessors to allow malicious tenant to steal secrets from neighbors
• Advantages
  • Meet most stringent security, compliance, or regulatory requirements
• Disadvantages
  • Expensive
  • Hard to manage
  • Hard to scale
  • Acquiring new hardware takes time
  • Takes competent team to manage them well

VMs

• Virtualization: Emulation of a physical computer
• Many VMs can run on single piece of bare metal hardware
• Bare metal hypervisor controls hardware directly without host operating system which gives hypervisor full control over hardware and provide higher performance
• Hardware that support bare metal hypervisor is more expensive
• Advantages
  • Cheaper to run
  • Share the same hardware
  • Allow higher resource utilization
  • Easier to scale which provide more flexibility
  • Can move running VM from 1 bare metal hardware to another without shutting down VM
• Disadvantages
  • Vulnerable to "noisy neighbor problem"
  • If co-locates with resource hogging neighbor, own application performance could suffer
  • VMs running on same bare metal hardware shares same physical CPU cores
  • Vulnerable to attacks that aim at design flaws in modern processors
    • Examples: Side-channel attacks like Meltdown and Spectre

Containers

• Lightweight and standalone package of application with all its dependencies like libraries, frameworks, and runtime
• Containerization is a lightweight version of virtualization
• Each containers is its own application environment isolated from each other
• Container engine provides faster resource provisioning
• All resources needed to run application are packaged together to allow application to run anywhere
• Advantages
  • Containers are scalable and portable
  • Lightweight and require less hardware resources to run than VMs
  • A bare metal server can host significantly more containers than VMs
  • Each container run as a native process of host operating system: faster to start
  • All of the above made containers easier to deploy and maintain at scale
• Disadvantages
  • Potentially less secure
  • Share same underlying operating system and isolation relies on OS-level primitives
  • Containers are exposed to wider class of security vulnerabilities at OS level
  • Possible to run containers inside VMs
    • Provides better security by reducing possible attack surfaces
    • Tradeoff between flexibility and security

After Containers

• Serverless and Edge computing
  • Make developer productivity and deployment stories more compelling