Chapter 4. Containers

Question 1

What are containers? What do they include?

Answer 1

• isolated user-space instances
  that include:
• application source code,
• requiered libraries
• **required runtime **
  to run the application without any external dependencies

Question 2

What makes containers possible?

Answer 2

Operating-System-level virtualization
-> applications running in containers only see resources etc belonging to that container

Question 3

What problem makes containers useful/necessary?

Answer 3

Deyploying multiple applications in parallel on one host leads to problems with isolating them from each other and avoiding conflicts between:
- dependencies
- libraries
- runtimes

Problems arise as well, when trying to run an application on multiple hardware and platforms
-> challanges with portability

Question 4

How do containers solve the portability challange?

Answer 4

By bundling the application and all its dependencies in a box
- that box can be shipped to different platforms and runs identically on each of them

Question 5

What are building blocks of the container technology (provided by Linux)

Answer 5

• namespaces
• Control groups
• Union filesystem

Question 6

What is a namespace in a container (Linux kernel)?

Answer 6

• wrap a particular global system resource like network or process IDs in an abstraction
• to the processes within the namespace it appears that they have their own isolated instance of the global resource
• > isolate processes from each other

Question 7

How are VMs and containers different?

Answer 7

Virtual Machine simulate whole OSes, isolated from each other on the same host. Installed on top of hypervisor. Multiple layers between running application and outside world: guest OS, hypervisor, and at time host OS

containers:
- Namespaces isolate processes from each other.
- Possibly multiple processes running on the same host OS.
- No middle layers like in VMs.
- Enables near-native performance.
- Easier to run multiple containers than multiple VMs
- but Containers need to be compatible with host OS

Question 8

What global resources are names paced? (6)

Answer 8

• pid
• net
• mnt
• ipc
• uts
• user

Question 9

What does the pid namespace enable?

Answer 9

• each process can have the same PIDs.
• Each container has its own PID 1

Question 10

What does the net namespace enable?

Answer 10

• allows each namespace to have its network stack.
• Each container has its own IP address.

Question 11

What does the mnt namespace enable?

Answer 11

• allows each namespace to have its own view of the filesystem hierarchy

Question 12

What does the ipc namespace enable?

Answer 12

• allows each namespace to have its own interprocess communication

Question 13

What does the uts namespace enable?

Answer 13

• allows each namespace to have its own hostname and domain name

Question 14

What does the user namespace enable?

Answer 14

• allows each namespace to have its own user and group ID number spaces
• root user inside a container is not the root user of the host on which the container is running

Question 15

What are Control Groups (linux kernel) used for?

Answer 15

• used to organize processes hierarchically
• and distribute resources along the hierarchy in a controlled and configurable manner

Question 16

What Features do control Groups (cgroup) have? (4)

Answer 16

• resource limits: for a cgroup can a limit be set how much of a particular resource a process can use
• prioritization: controlable how much of a resource an process can use compared to other processes when there is resource contention
• accounting: resource limits are monitored and reported at cgroup level
• control: status (frozen, stopped, restarted) of all processes in a cgroup can be changed with a single command

Question 17

How does the Union filesystem work?

Answer 17

• allows files and directories of separate filesystems, known as layers, to be transparently overlaid on top of each other, to create a new virtual filesystem
• at runtime a container is made of multiple layers merged to create a** read-only filesystem**
• on top of the read-only filesystem, a container gets a read-write layer, which is an ephemeral layer and it is local to the container

Question 18

How do container runtimes help?

Answer 18

• container runtimes ensure the containers portability, offering a consistent environment for containers to run, regardless of the infrastructure
• with them can be interacted through a collection of tools (Docker, Kubernetes, CRI-O)

Question 19

What are the most popular container runtimes?

Answer 19

• runc: CLI tool for spawning and running containers, according to Open Container Initiative (OCI) specifications
• crun: OCI-conformant runtime. Fast
• containerd: OCI-compliant container runtime, emphasis on simplicity, robustness and portability, high-level runtime
• CRI-O: OCI-compatible runtime, lightweight high-level runtime alternative to using Docker as the runtime for Kubernetes

Question 20

What is the Docker Platform?

Answer 20

• a collection of development tools that follow a client-server architecture

Question 21

How does the Docker Client-Server architecture work?

Answer 21

• Docker Host server runs the Docker daemon (like fomr Containerd) to execute commands for containers and image management
• > in response to client requests

Question 22

Do Docker containers always run as rooted containers?

Answer 22

No, rooted containers are default. But rootless containers have been introduced

Question 23

What is Podman? Or Pod Manager

Answer 23

• open source, daemonless tool designed to support the searching, running, building, sharing and deploying of applications using OCI containers and container images

Question 24

What are Podman advantages?

Answer 24

• open source
• daemonless (can spawn root containers as well as rootless ones)
• can run containers rootless by default

Question 25

What are Benefits of using Containers?

Answer 25

- offer portability and consistency - light footprint - flexible solution, can run on any computer, infrastructure or cloud environment - can be deployed very fast - problematic container instances can be quickly isolated and analysed for troubleshooting - can be scaled up or down very fast and with ease - rich ecosystem built around them - increased productivity with reduced overhead - use less memory and CPU than VMs running similar workloads