<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">Dear Javier,<br>
<br>
I am going to push the second proposal with answers added. The
reason being "Docker shouldn't be treated as a hypervisor". <br>
I drew a picture for my proposal which will suit all the container
virtualization folks (I hope so :)).<br>
<br>
<a class="moz-txt-link-freetext" href="https://docs.google.com/drawings/d/1DUYv1NoYunor5KZT4ckKpVVIe7tIRb5tfQd35v8OGEU/edit?usp=sharing">https://docs.google.com/drawings/d/1DUYv1NoYunor5KZT4ckKpVVIe7tIRb5tfQd35v8OGEU/edit?usp=sharing</a><br>
<br>
<b>Terminology</b>:<br>
Docker VM: A VM(Ubuntu,Debian/CentOS) with Docker daemon in it.<br>
Docker container : A docker image that is running inside the
"Docker VM".<br>
<br>
Docker daemon can be interfaced via an API.<br>
<br>
<b>Assumptions</b>:<br>
We are going to use an instance "Docker VM" with docker installed.
Hence Docker can be an appliance in the OpenNebula Marketplace. <br>
<br>
We need a layer on the "Docker VM" which act as a translator to
talk to all the stood-up containers. Let us call the layer an
agent. The <b>agent</b> will be native and can be connected using
messaging or api.<br>
<br>
<b>SSH</b><br>
<a href="https://docs.docker.com/articles/security/">https://docs.docker.com/articles/security/</a><br>
The <b>agent</b> will act as a proxy ssh authentication for the
user and will allow access to the user's container. The container
needs to run as the user. <br>
<br>
The sshconfig can be tweaked in the DockerVM to say that, we'll
use a binary to verify the authentication. The ssh keys should be
stored as before (authorized_keys) etc. <br>
<br>
The sshconfig of the Docker VM:
<p><small><b>AuthorizedKeysCommand</b> </small>: will use our
native binary and perform per container authentication and will
let the user into that container by executing docker run
container id /bin/sh"<br>
<small><b>AuthorizedKeysUser</b></small> : nobody (default) <span
style="color: rgb(0, 0, 0); font-family: 'Helvetica
Neue',Helvetica,Helvetica,Arial,sans-serif; font-size: 14px;
font-style: normal; font-variant: normal; letter-spacing:
normal; line-height: 22.4px; text-align: start; text-indent:
0px; text-transform: none; white-space: normal; word-spacing:
0px; display: inline ! important; float: none;
background-color: rgb(255, 255, 255);"></span><br>
</p>
<b>Logs</b><br>
The Docker containers will be spinned off by "upstart" or systemd
and it runs as a process. We'll use "Docker's log API", and the
logs of the "upstart/systemd" process for that container.<br>
<br>
<b>Metrics/Monitoring</b><br>
<a href="https://docs.docker.com/articles/runmetrics/">https://docs.docker.com/articles/runmetrics/</a><br>
We should be able to pull the correct "cgroup of our container id"
and pull the mem.stat, cpu.stat, network.stat. Using OneGate the
data can be sent out periodically.
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<pre class="prettyprint well" style="padding: 8px; font-family: Monaco, Consolas, 'Lucida Console', monospace; font-size: 14px; color: rgb(51, 51, 51); display: block; line-height: 23.799999237060547px; word-break: break-all; word-wrap: break-word; white-space: pre-wrap; border: 1px solid rgb(227, 227, 227); min-height: 20px; margin-bottom: 20px; font-weight: normal; border-top-left-radius: 4px; border-top-right-radius: 4px; border-bottom-right-radius: 4px; border-bottom-left-radius: 4px; overflow-x: auto; font-style: normal; font-variant: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(252, 252, 252);"><code style="padding: 0px; font-family: Monaco, Menlo, Consolas, 'Courier New', monospace; font-size: 14px; color: inherit; border: 0px; white-space: pre; font-weight: 400; line-height: 1.7; overflow-wrap: normal; background-color: trans
parent;"><span class="pln" style="font-size: 14px; font-weight: 400; line-height: 1.7; color: rgb(72, 72, 76);">grep cgroup </span><span class="pun" style="font-size: 14px; font-weight: 400; line-height: 1.7; color: rgb(147, 161, 161);">/</span><span class="pln" style="font-size: 14px; font-weight: 400; line-height: 1.7; color: rgb(72, 72, 76);">proc</span><span class="pun" style="font-size: 14px; font-weight: 400; line-height: 1.7; color: rgb(147, 161, 161);">/</span><span class="pln" style="font-size: 14px; font-weight: 400; line-height: 1.7; color: rgb(72, 72, 76);">mounts</span></code></pre>
The stuff needs to happen at the PaaS level and operated external
to the Docker container. I am anxious to hear the team's feedback.
<br>
<br>
<pre class="moz-signature" cols="72">
--
Cheers,
Megam Systems; <a class="moz-txt-link-freetext" href="http://www.gomegam.com">http://www.gomegam.com</a>
email : <a class="moz-txt-link-abbreviated" href="mailto:gomegam@megam.co.in">gomegam@megam.co.in</a>; twitter: @megamsystems
web : <a class="moz-txt-link-freetext" href="http://www.gomegam.com">http://www.gomegam.com</a> | try : <a class="moz-txt-link-freetext" href="https://www.megam.co">https://www.megam.co</a>
blog : <a class="moz-txt-link-freetext" href="http://blog.megam.co">http://blog.megam.co</a> | github: <a class="moz-txt-link-freetext" href="https://github.com/megamsys">https://github.com/megamsys</a>
</pre>
On Wednesday 18 June 2014 09:20 PM, Javier Fontan wrote:<br>
</div>
<blockquote
cite="mid:CAK+uMM_XgnJ9_R=86uVEOpvwO=PsC=ZtuFGAUz1UP_e0x9Jnrg@mail.gmail.com"
type="cite">
<pre wrap="">Hi,
I'm happy to find this email as I've been tinkering with Docker and
LXC recently.
There are a lot of discussions these days about Docker. I see it as a
nice way to package and deploy apps but I'm not really sure it fits
into OpenNebula. I really want to be wrong on this.
The second proposal (starting up VMs with docker prepared) is straight
forward. It requires an image with the software prepared and maybe
some context scripts that do some kind of configuration so an external
user can call its docker daemon and start new containers.
The first one is a bit more problematic. Even if creating the drivers
to manage docker instances is relatively easy (but time consuming)
there is a problem I couldn't find a solution. VMs usually can be
reached using ssh or VNC. Containers don't have VNC server and with
the Docker philosophy of one app per container you also lose ssh. In
OpenNebula there is not another way of reaching those containers. The
containers will run and do its duty but when something does not work
as expected you can not attach to it to change something and features
like getting the logs from the app are gone.
It may be possible to add some sort of layer to do this. Maybe an ssh
in some host configured like a git server [1] that starts some docker
command instead of a shell. Anyway, this seemed too far fetched for a
pet project and moved to LXC that is more similar to a VM.
Maybe with a bit more heads on the problem we can find an architecture
that makes Docker right at home in OpenNebula.
Cheers
[1] <a class="moz-txt-link-freetext" href="http://gitolite.com/gitolite/glssh.html#restricting-shell-accessdistinguishing-one-user-from-another">http://gitolite.com/gitolite/glssh.html#restricting-shell-accessdistinguishing-one-user-from-another</a>
On Wed, Jun 18, 2014 at 3:56 PM, Megam Systems <a class="moz-txt-link-rfc2396E" href="mailto:gomegam@megam.co.in"><gomegam@megam.co.in></a> wrote:
</pre>
<blockquote type="cite">
<pre wrap="">Dear All,
Docker 1.0 was released recently. Megam is a cloud automation engine,
and would like to support this feature. With the latest release Docker
uses libcontainer.
Our *vision* is to enable and simplify running Docker container images
using Megam on OpenNebula.
*Terminology:*
* Docker container image : A tiny image which can be unwrapped and
run by "Docker"
* Docker container : An instance that is created as a result of
running the Docker container image.
* Docker service : A regular Ubuntu or Wheezy VM spinned off by
OpenNebula having the "docker" executable installed.
Docker helps to run container images very quickly. A Docker container
image is built by an user. So an user builds the Docker container image
and stores it in a docker registry (this can be public or private).
An example Docker container image can hold "apache2" or "postgresql".
Recommendation by Docker is to run just one process.
There are 2 ways in integrating it to OpenNebula.
1. Docker as a hypervisor which would spin of the user's container
image in the OpenNebula host.
2. A Docker service which is stood-up and shared by an user. Multiple
Docker container can run inside the stood-up Docker service. The
Docker service will be owned by the user and the user can stand-up
multiple Docker container in it.
We would like to hear the communities feedback and thoughts in taking it
forward.
Also how are you using Docker today ? How would like to see it being
used in OpenNebula or using an orchestrator on top of OpenNebula like Megam.
If you haven't started on using Docker, what are the use cases you are
exploring its use ? What is your wish list for the above integration ?
--
Cheers,
Megam Systems; <a class="moz-txt-link-freetext" href="http://www.gomegam.com">http://www.gomegam.com</a>
email : <a class="moz-txt-link-abbreviated" href="mailto:gomegam@megam.co.in">gomegam@megam.co.in</a>; twitter: @megamsystems
web : <a class="moz-txt-link-freetext" href="http://www.gomegam.com">http://www.gomegam.com</a> | try : <a class="moz-txt-link-freetext" href="https://www.megam.co">https://www.megam.co</a>
blog : <a class="moz-txt-link-freetext" href="http://blog.megam.co">http://blog.megam.co</a> | github: <a class="moz-txt-link-freetext" href="https://github.com/megamsys">https://github.com/megamsys</a>
_______________________________________________
Dev mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Dev@lists.opennebula.org">Dev@lists.opennebula.org</a>
<a class="moz-txt-link-freetext" href="http://lists.opennebula.org/listinfo.cgi/dev-opennebula.org">http://lists.opennebula.org/listinfo.cgi/dev-opennebula.org</a>
</pre>
</blockquote>
<pre wrap="">
</pre>
</blockquote>
<br>
</body>
</html>