CENTRIC WORLD VMS IN A CONTAINER- · 2020. 9. 24. · 05/04/2019 VMs in a container-centric world ...
Transcript of CENTRIC WORLD VMS IN A CONTAINER- · 2020. 9. 24. · 05/04/2019 VMs in a container-centric world ...
![Page 1: CENTRIC WORLD VMS IN A CONTAINER- · 2020. 9. 24. · 05/04/2019 VMs in a container-centric world 2/ 55 INTRODUCTION 2 . 1](https://reader035.fdocuments.us/reader035/viewer/2022071501/6120dfa28ab270101f41f418/html5/thumbnails/1.jpg)
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 1/55
VMS IN A CONTAINER-VMS IN A CONTAINER-CENTRIC WORLDCENTRIC WORLD
ALEX BENNÉEALEX BENNÉEBKK19BKK19
1
![Page 2: CENTRIC WORLD VMS IN A CONTAINER- · 2020. 9. 24. · 05/04/2019 VMs in a container-centric world 2/ 55 INTRODUCTION 2 . 1](https://reader035.fdocuments.us/reader035/viewer/2022071501/6120dfa28ab270101f41f418/html5/thumbnails/2.jpg)
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 2/55
INTRODUCTIONINTRODUCTION
2 . 1
![Page 3: CENTRIC WORLD VMS IN A CONTAINER- · 2020. 9. 24. · 05/04/2019 VMs in a container-centric world 2/ 55 INTRODUCTION 2 . 1](https://reader035.fdocuments.us/reader035/viewer/2022071501/6120dfa28ab270101f41f418/html5/thumbnails/3.jpg)
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 3/55
WHO AM IWHO AM I
Alex BennéeSenior Virtualisation Engineer @LinaroQEMU's TCG (emulation)/KVMIRC: stsquad/ajb-linaro
2 . 2
![Page 4: CENTRIC WORLD VMS IN A CONTAINER- · 2020. 9. 24. · 05/04/2019 VMs in a container-centric world 2/ 55 INTRODUCTION 2 . 1](https://reader035.fdocuments.us/reader035/viewer/2022071501/6120dfa28ab270101f41f418/html5/thumbnails/4.jpg)
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 4/55
DOCKER HYPE?DOCKER HYPE?
2 . 3
![Page 5: CENTRIC WORLD VMS IN A CONTAINER- · 2020. 9. 24. · 05/04/2019 VMs in a container-centric world 2/ 55 INTRODUCTION 2 . 1](https://reader035.fdocuments.us/reader035/viewer/2022071501/6120dfa28ab270101f41f418/html5/thumbnails/5.jpg)
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 5/55
DEVELOPER BUZZWORDSDEVELOPER BUZZWORDS
LightweightAgileDevOpsCloud
2 . 4
![Page 6: CENTRIC WORLD VMS IN A CONTAINER- · 2020. 9. 24. · 05/04/2019 VMs in a container-centric world 2/ 55 INTRODUCTION 2 . 1](https://reader035.fdocuments.us/reader035/viewer/2022071501/6120dfa28ab270101f41f418/html5/thumbnails/6.jpg)
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 6/55
OTHER USE CASESOTHER USE CASES
ApplicationSandboxesAndroid-in-a-Box
2 . 5
![Page 7: CENTRIC WORLD VMS IN A CONTAINER- · 2020. 9. 24. · 05/04/2019 VMs in a container-centric world 2/ 55 INTRODUCTION 2 . 1](https://reader035.fdocuments.us/reader035/viewer/2022071501/6120dfa28ab270101f41f418/html5/thumbnails/7.jpg)
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 7/55
UBIQUITOUSUBIQUITOUS
2 . 6
![Page 8: CENTRIC WORLD VMS IN A CONTAINER- · 2020. 9. 24. · 05/04/2019 VMs in a container-centric world 2/ 55 INTRODUCTION 2 . 1](https://reader035.fdocuments.us/reader035/viewer/2022071501/6120dfa28ab270101f41f418/html5/thumbnails/8.jpg)
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 8/55
CONTAINER OVERVIEWCONTAINER OVERVIEW
3 . 1
![Page 9: CENTRIC WORLD VMS IN A CONTAINER- · 2020. 9. 24. · 05/04/2019 VMs in a container-centric world 2/ 55 INTRODUCTION 2 . 1](https://reader035.fdocuments.us/reader035/viewer/2022071501/6120dfa28ab270101f41f418/html5/thumbnails/9.jpg)
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 9/55
WHAT IS A CONTAINERWHAT IS A CONTAINER
3 . 2
![Page 10: CENTRIC WORLD VMS IN A CONTAINER- · 2020. 9. 24. · 05/04/2019 VMs in a container-centric world 2/ 55 INTRODUCTION 2 . 1](https://reader035.fdocuments.us/reader035/viewer/2022071501/6120dfa28ab270101f41f418/html5/thumbnails/10.jpg)
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 10/55
TECHNOLOGIESTECHNOLOGIES
3 . 3
![Page 11: CENTRIC WORLD VMS IN A CONTAINER- · 2020. 9. 24. · 05/04/2019 VMs in a container-centric world 2/ 55 INTRODUCTION 2 . 1](https://reader035.fdocuments.us/reader035/viewer/2022071501/6120dfa28ab270101f41f418/html5/thumbnails/11.jpg)
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 11/55
NAMESPACESNAMESPACES
3 . 4
![Page 12: CENTRIC WORLD VMS IN A CONTAINER- · 2020. 9. 24. · 05/04/2019 VMs in a container-centric world 2/ 55 INTRODUCTION 2 . 1](https://reader035.fdocuments.us/reader035/viewer/2022071501/6120dfa28ab270101f41f418/html5/thumbnails/12.jpg)
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 12/55
CONTROL GROUPSCONTROL GROUPS
limitsaccountingprioritycontrol
3 . 5
![Page 13: CENTRIC WORLD VMS IN A CONTAINER- · 2020. 9. 24. · 05/04/2019 VMs in a container-centric world 2/ 55 INTRODUCTION 2 . 1](https://reader035.fdocuments.us/reader035/viewer/2022071501/6120dfa28ab270101f41f418/html5/thumbnails/13.jpg)
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 13/55
SANDBOXINGSANDBOXING
seccompnet�lterbpf
3 . 6
![Page 14: CENTRIC WORLD VMS IN A CONTAINER- · 2020. 9. 24. · 05/04/2019 VMs in a container-centric world 2/ 55 INTRODUCTION 2 . 1](https://reader035.fdocuments.us/reader035/viewer/2022071501/6120dfa28ab270101f41f418/html5/thumbnails/14.jpg)
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 14/55
FILE-SYSTEMSFILE-SYSTEMS
3 . 7
![Page 15: CENTRIC WORLD VMS IN A CONTAINER- · 2020. 9. 24. · 05/04/2019 VMs in a container-centric world 2/ 55 INTRODUCTION 2 . 1](https://reader035.fdocuments.us/reader035/viewer/2022071501/6120dfa28ab270101f41f418/html5/thumbnails/15.jpg)
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 15/55
RUNTIMESRUNTIMES
LXCDockersystemd-nspawn
3 . 8
![Page 16: CENTRIC WORLD VMS IN A CONTAINER- · 2020. 9. 24. · 05/04/2019 VMs in a container-centric world 2/ 55 INTRODUCTION 2 . 1](https://reader035.fdocuments.us/reader035/viewer/2022071501/6120dfa28ab270101f41f418/html5/thumbnails/16.jpg)
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 16/55
BUT….BUT….
4 . 1
![Page 17: CENTRIC WORLD VMS IN A CONTAINER- · 2020. 9. 24. · 05/04/2019 VMs in a container-centric world 2/ 55 INTRODUCTION 2 . 1](https://reader035.fdocuments.us/reader035/viewer/2022071501/6120dfa28ab270101f41f418/html5/thumbnails/17.jpg)
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 17/55
"container with an attacker-controlled image"…
"overwrite the host runc binary (and consequently obtain host rootaccess)"
CVE-2019-5736CVE-2019-5736
4 . 2
![Page 18: CENTRIC WORLD VMS IN A CONTAINER- · 2020. 9. 24. · 05/04/2019 VMs in a container-centric world 2/ 55 INTRODUCTION 2 . 1](https://reader035.fdocuments.us/reader035/viewer/2022071501/6120dfa28ab270101f41f418/html5/thumbnails/18.jpg)
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 18/55
DETAILSDETAILS
Attacker Image (i.e. from a hub)with root privilegesmodi�es guest binary (/bin/target)#!/proc/self/exe
Host launches a containerattempts to run /bin/target
actually runs itselfattacker grabs /proc/TARGETPID/exekeeps writing until PROFIT!
4 . 3
![Page 19: CENTRIC WORLD VMS IN A CONTAINER- · 2020. 9. 24. · 05/04/2019 VMs in a container-centric world 2/ 55 INTRODUCTION 2 . 1](https://reader035.fdocuments.us/reader035/viewer/2022071501/6120dfa28ab270101f41f418/html5/thumbnails/19.jpg)
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 19/55
ENTER VMSENTER VMS
5 . 1
![Page 20: CENTRIC WORLD VMS IN A CONTAINER- · 2020. 9. 24. · 05/04/2019 VMs in a container-centric world 2/ 55 INTRODUCTION 2 . 1](https://reader035.fdocuments.us/reader035/viewer/2022071501/6120dfa28ab270101f41f418/html5/thumbnails/20.jpg)
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 20/55
WHAT IS A VIRTUAL MACHINEWHAT IS A VIRTUAL MACHINE
5 . 2
![Page 21: CENTRIC WORLD VMS IN A CONTAINER- · 2020. 9. 24. · 05/04/2019 VMs in a container-centric world 2/ 55 INTRODUCTION 2 . 1](https://reader035.fdocuments.us/reader035/viewer/2022071501/6120dfa28ab270101f41f418/html5/thumbnails/21.jpg)
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 21/55
ISOLATIONISOLATION
5 . 3
![Page 22: CENTRIC WORLD VMS IN A CONTAINER- · 2020. 9. 24. · 05/04/2019 VMs in a container-centric world 2/ 55 INTRODUCTION 2 . 1](https://reader035.fdocuments.us/reader035/viewer/2022071501/6120dfa28ab270101f41f418/html5/thumbnails/22.jpg)
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 22/55
BEST OF BOTH WORLDSBEST OF BOTH WORLDS
6 . 1
![Page 23: CENTRIC WORLD VMS IN A CONTAINER- · 2020. 9. 24. · 05/04/2019 VMs in a container-centric world 2/ 55 INTRODUCTION 2 . 1](https://reader035.fdocuments.us/reader035/viewer/2022071501/6120dfa28ab270101f41f418/html5/thumbnails/23.jpg)
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 23/55
MORE LAYERSMORE LAYERS
6 . 2
![Page 24: CENTRIC WORLD VMS IN A CONTAINER- · 2020. 9. 24. · 05/04/2019 VMs in a container-centric world 2/ 55 INTRODUCTION 2 . 1](https://reader035.fdocuments.us/reader035/viewer/2022071501/6120dfa28ab270101f41f418/html5/thumbnails/24.jpg)
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 24/55
ABSTRACTION == COSTABSTRACTION == COST
6 . 3
![Page 25: CENTRIC WORLD VMS IN A CONTAINER- · 2020. 9. 24. · 05/04/2019 VMs in a container-centric world 2/ 55 INTRODUCTION 2 . 1](https://reader035.fdocuments.us/reader035/viewer/2022071501/6120dfa28ab270101f41f418/html5/thumbnails/25.jpg)
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 25/55
DOCKER 10.9 SECONDSDOCKER 10.9 SECONDS
6 . 4
![Page 26: CENTRIC WORLD VMS IN A CONTAINER- · 2020. 9. 24. · 05/04/2019 VMs in a container-centric world 2/ 55 INTRODUCTION 2 . 1](https://reader035.fdocuments.us/reader035/viewer/2022071501/6120dfa28ab270101f41f418/html5/thumbnails/26.jpg)
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 26/55
KVM 12.0 SECONDSKVM 12.0 SECONDS
6 . 5
![Page 27: CENTRIC WORLD VMS IN A CONTAINER- · 2020. 9. 24. · 05/04/2019 VMs in a container-centric world 2/ 55 INTRODUCTION 2 . 1](https://reader035.fdocuments.us/reader035/viewer/2022071501/6120dfa28ab270101f41f418/html5/thumbnails/27.jpg)
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 27/55
KVM HOST VIEWKVM HOST VIEW
6 . 6
![Page 28: CENTRIC WORLD VMS IN A CONTAINER- · 2020. 9. 24. · 05/04/2019 VMs in a container-centric world 2/ 55 INTRODUCTION 2 . 1](https://reader035.fdocuments.us/reader035/viewer/2022071501/6120dfa28ab270101f41f418/html5/thumbnails/28.jpg)
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 28/55
MITIGATIONMITIGATION
7 . 1
![Page 29: CENTRIC WORLD VMS IN A CONTAINER- · 2020. 9. 24. · 05/04/2019 VMs in a container-centric world 2/ 55 INTRODUCTION 2 . 1](https://reader035.fdocuments.us/reader035/viewer/2022071501/6120dfa28ab270101f41f418/html5/thumbnails/29.jpg)
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 29/55
VIRTUAL HWVIRTUAL HW
MinimalParavirtualizedHot-Pluggable
7 . 2
![Page 30: CENTRIC WORLD VMS IN A CONTAINER- · 2020. 9. 24. · 05/04/2019 VMs in a container-centric world 2/ 55 INTRODUCTION 2 . 1](https://reader035.fdocuments.us/reader035/viewer/2022071501/6120dfa28ab270101f41f418/html5/thumbnails/30.jpg)
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 30/55
GUEST SETUPGUEST SETUP
Minimal KernelLightweightUserspaceDirect Boot/uBios
7 . 3
![Page 31: CENTRIC WORLD VMS IN A CONTAINER- · 2020. 9. 24. · 05/04/2019 VMs in a container-centric world 2/ 55 INTRODUCTION 2 . 1](https://reader035.fdocuments.us/reader035/viewer/2022071501/6120dfa28ab270101f41f418/html5/thumbnails/31.jpg)
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 31/55
HOST/GUEST COMMUNICATIONHOST/GUEST COMMUNICATION
7 . 4
![Page 32: CENTRIC WORLD VMS IN A CONTAINER- · 2020. 9. 24. · 05/04/2019 VMs in a container-centric world 2/ 55 INTRODUCTION 2 . 1](https://reader035.fdocuments.us/reader035/viewer/2022071501/6120dfa28ab270101f41f418/html5/thumbnails/32.jpg)
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 32/55
VIRTIO-VSOCKVIRTIO-VSOCK
bi-directional socketzero con�gurationmore ef�cient thannetwork
7 . 5
![Page 33: CENTRIC WORLD VMS IN A CONTAINER- · 2020. 9. 24. · 05/04/2019 VMs in a container-centric world 2/ 55 INTRODUCTION 2 . 1](https://reader035.fdocuments.us/reader035/viewer/2022071501/6120dfa28ab270101f41f418/html5/thumbnails/33.jpg)
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 33/55
VIRTIO-FSVIRTIO-FS
POSIX APICo-locatedhost/guestShared Memory
7 . 6
![Page 34: CENTRIC WORLD VMS IN A CONTAINER- · 2020. 9. 24. · 05/04/2019 VMs in a container-centric world 2/ 55 INTRODUCTION 2 . 1](https://reader035.fdocuments.us/reader035/viewer/2022071501/6120dfa28ab270101f41f418/html5/thumbnails/34.jpg)
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 34/55
EXAMPLE: CHROMOS CROSTINIEXAMPLE: CHROMOS CROSTINI
8 . 1
![Page 35: CENTRIC WORLD VMS IN A CONTAINER- · 2020. 9. 24. · 05/04/2019 VMs in a container-centric world 2/ 55 INTRODUCTION 2 . 1](https://reader035.fdocuments.us/reader035/viewer/2022071501/6120dfa28ab270101f41f418/html5/thumbnails/35.jpg)
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 35/55
CHROME OSCHROME OS
Trusted BootpathLinux KernelMinimal GentooUserspaceChrome Browser
8 . 2
![Page 36: CENTRIC WORLD VMS IN A CONTAINER- · 2020. 9. 24. · 05/04/2019 VMs in a container-centric world 2/ 55 INTRODUCTION 2 . 1](https://reader035.fdocuments.us/reader035/viewer/2022071501/6120dfa28ab270101f41f418/html5/thumbnails/36.jpg)
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 36/55
ARCHITECTUREARCHITECTURE
8 . 3
![Page 37: CENTRIC WORLD VMS IN A CONTAINER- · 2020. 9. 24. · 05/04/2019 VMs in a container-centric world 2/ 55 INTRODUCTION 2 . 1](https://reader035.fdocuments.us/reader035/viewer/2022071501/6120dfa28ab270101f41f418/html5/thumbnails/37.jpg)
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 37/55
CROSVMCROSVM
8 . 4
![Page 38: CENTRIC WORLD VMS IN A CONTAINER- · 2020. 9. 24. · 05/04/2019 VMs in a container-centric world 2/ 55 INTRODUCTION 2 . 1](https://reader035.fdocuments.us/reader035/viewer/2022071501/6120dfa28ab270101f41f418/html5/thumbnails/38.jpg)
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 38/55
EXAMPLE: KATA CONTAINERSEXAMPLE: KATA CONTAINERS
9 . 1
![Page 39: CENTRIC WORLD VMS IN A CONTAINER- · 2020. 9. 24. · 05/04/2019 VMs in a container-centric world 2/ 55 INTRODUCTION 2 . 1](https://reader035.fdocuments.us/reader035/viewer/2022071501/6120dfa28ab270101f41f418/html5/thumbnails/39.jpg)
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 39/55
KATA CONTAINERSKATA CONTAINERS
Lightweight VMsDockerIntegration
9 . 2
![Page 40: CENTRIC WORLD VMS IN A CONTAINER- · 2020. 9. 24. · 05/04/2019 VMs in a container-centric world 2/ 55 INTRODUCTION 2 . 1](https://reader035.fdocuments.us/reader035/viewer/2022071501/6120dfa28ab270101f41f418/html5/thumbnails/40.jpg)
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 40/55
ARCHITECTUREARCHITECTURE
9 . 3
![Page 41: CENTRIC WORLD VMS IN A CONTAINER- · 2020. 9. 24. · 05/04/2019 VMs in a container-centric world 2/ 55 INTRODUCTION 2 . 1](https://reader035.fdocuments.us/reader035/viewer/2022071501/6120dfa28ab270101f41f418/html5/thumbnails/41.jpg)
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 41/55
FEATURESFEATURES
Optimised Kernelrootfs(initrd/nvdimm)
NEMU (NoEmu QEMU)
9 . 4
![Page 42: CENTRIC WORLD VMS IN A CONTAINER- · 2020. 9. 24. · 05/04/2019 VMs in a container-centric world 2/ 55 INTRODUCTION 2 . 1](https://reader035.fdocuments.us/reader035/viewer/2022071501/6120dfa28ab270101f41f418/html5/thumbnails/42.jpg)
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 42/55
EXAMPLE: GVISOREXAMPLE: GVISOR
10 . 1
![Page 43: CENTRIC WORLD VMS IN A CONTAINER- · 2020. 9. 24. · 05/04/2019 VMs in a container-centric world 2/ 55 INTRODUCTION 2 . 1](https://reader035.fdocuments.us/reader035/viewer/2022071501/6120dfa28ab270101f41f418/html5/thumbnails/43.jpg)
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 43/55
REMAINING WORKREMAINING WORK
11 . 1
![Page 44: CENTRIC WORLD VMS IN A CONTAINER- · 2020. 9. 24. · 05/04/2019 VMs in a container-centric world 2/ 55 INTRODUCTION 2 . 1](https://reader035.fdocuments.us/reader035/viewer/2022071501/6120dfa28ab270101f41f418/html5/thumbnails/44.jpg)
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 44/55
DE-BLOAT QEMUDE-BLOAT QEMU
Reduce size & start-up–disable-tcgKCon�g languageWork in progress
11 . 2
![Page 45: CENTRIC WORLD VMS IN A CONTAINER- · 2020. 9. 24. · 05/04/2019 VMs in a container-centric world 2/ 55 INTRODUCTION 2 . 1](https://reader035.fdocuments.us/reader035/viewer/2022071501/6120dfa28ab270101f41f418/html5/thumbnails/45.jpg)
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 45/55
X86 KVM FEATURE PARITYX86 KVM FEATURE PARITY
HotplugSupport
11 . 3
![Page 46: CENTRIC WORLD VMS IN A CONTAINER- · 2020. 9. 24. · 05/04/2019 VMs in a container-centric world 2/ 55 INTRODUCTION 2 . 1](https://reader035.fdocuments.us/reader035/viewer/2022071501/6120dfa28ab270101f41f418/html5/thumbnails/46.jpg)
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 46/55
SUMMARYSUMMARY
12 . 1
![Page 47: CENTRIC WORLD VMS IN A CONTAINER- · 2020. 9. 24. · 05/04/2019 VMs in a container-centric world 2/ 55 INTRODUCTION 2 . 1](https://reader035.fdocuments.us/reader035/viewer/2022071501/6120dfa28ab270101f41f418/html5/thumbnails/47.jpg)
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 47/55
CONTAINERSCONTAINERS
PopularToolingPortability
12 . 2
![Page 48: CENTRIC WORLD VMS IN A CONTAINER- · 2020. 9. 24. · 05/04/2019 VMs in a container-centric world 2/ 55 INTRODUCTION 2 . 1](https://reader035.fdocuments.us/reader035/viewer/2022071501/6120dfa28ab270101f41f418/html5/thumbnails/48.jpg)
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 48/55
VIRTUAL MACHINESVIRTUAL MACHINES
More de�ned isolationPerformance Trade-offsCan be contained
12 . 3
![Page 49: CENTRIC WORLD VMS IN A CONTAINER- · 2020. 9. 24. · 05/04/2019 VMs in a container-centric world 2/ 55 INTRODUCTION 2 . 1](https://reader035.fdocuments.us/reader035/viewer/2022071501/6120dfa28ab270101f41f418/html5/thumbnails/49.jpg)
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 49/55
COMBINATIONCOMBINATION
Best of BothWorldsDefence in Depth
12 . 4
![Page 50: CENTRIC WORLD VMS IN A CONTAINER- · 2020. 9. 24. · 05/04/2019 VMs in a container-centric world 2/ 55 INTRODUCTION 2 . 1](https://reader035.fdocuments.us/reader035/viewer/2022071501/6120dfa28ab270101f41f418/html5/thumbnails/50.jpg)
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 50/55
QUESTIONS?QUESTIONS?
13 . 1
![Page 51: CENTRIC WORLD VMS IN A CONTAINER- · 2020. 9. 24. · 05/04/2019 VMs in a container-centric world 2/ 55 INTRODUCTION 2 . 1](https://reader035.fdocuments.us/reader035/viewer/2022071501/6120dfa28ab270101f41f418/html5/thumbnails/51.jpg)
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 51/55
REFERENCESREFERENCESKata Containers: Advanced Features of QEMU forBetter Container Isolation by Eric ErnstCrostini: A Linux Desktop on ChromeOS
14 . 1
![Page 52: CENTRIC WORLD VMS IN A CONTAINER- · 2020. 9. 24. · 05/04/2019 VMs in a container-centric world 2/ 55 INTRODUCTION 2 . 1](https://reader035.fdocuments.us/reader035/viewer/2022071501/6120dfa28ab270101f41f418/html5/thumbnails/52.jpg)
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 52/55
EXTRA SLIDESEXTRA SLIDES
15 . 1
![Page 53: CENTRIC WORLD VMS IN A CONTAINER- · 2020. 9. 24. · 05/04/2019 VMs in a container-centric world 2/ 55 INTRODUCTION 2 . 1](https://reader035.fdocuments.us/reader035/viewer/2022071501/6120dfa28ab270101f41f418/html5/thumbnails/53.jpg)
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 53/55
"The Floppy Disk Controller (FDC) in QEMU"…
"allows local guest users to cause a denial of service…or possiblyexecute arbitrary code"
CVS-2015-3456 (VENOM)CVS-2015-3456 (VENOM)
15 . 2
![Page 54: CENTRIC WORLD VMS IN A CONTAINER- · 2020. 9. 24. · 05/04/2019 VMs in a container-centric world 2/ 55 INTRODUCTION 2 . 1](https://reader035.fdocuments.us/reader035/viewer/2022071501/6120dfa28ab270101f41f418/html5/thumbnails/54.jpg)
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 54/55
CONTAINER PATTERNSCONTAINER PATTERNS
Service OrientatedArchitectureStateless DesignComposability
15 . 3
![Page 55: CENTRIC WORLD VMS IN A CONTAINER- · 2020. 9. 24. · 05/04/2019 VMs in a container-centric world 2/ 55 INTRODUCTION 2 . 1](https://reader035.fdocuments.us/reader035/viewer/2022071501/6120dfa28ab270101f41f418/html5/thumbnails/55.jpg)
05/04/2019 VMs in a container-centric world
http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 55/55
REASONS FOR POPULARITYREASONS FOR POPULARITY
ToolingPortabilityOrchestration
15 . 4