Shulou(Shulou.com)06/02 Report--

I. concept

Docker is an open source container engine, implemented based on cgroup,namespace,unionFS and other technologies, and a virtualization technology that encapsulates applications.

What is cgroup? To limit system resources, the process of creating containers is actually creating processes. Cgroup is used to manage the allocation and maintenance of resources, including cpu, memory, io, etc. What is namespace? When creating a container, it is a brand new system for the container. The file system in the container should be isolated from the host file system, cyberspace and user permissions. What is unionFS managed by namespace? A federated file system simply means that multiple directory structures are merged into one, while the physical location of each directory structure itself does not change.

II. Structure

1.C/S architecture

Component: docker cli: docker client, a tool used to manage docker and send instructions to docker: docker engine: pull push image, encapsulate the top layer of api related to container operation, directly face clientimage repository: register the letter, store the image Containerd: is a daemon process, responsible for managing shim, providing interfaces to docker engine, using UnixSocket communication, the protocol is grpcshim: responsible for managing a single container, starting a container A shim process is started, and containerd manages all containers runC: run a container. Is a container technology implementation based on the OCI standard, and is a tool that can create and run containers directly. Runc interacts directly with the cgroups/kernel on which the container depends, and is responsible for the environment required by the container.

two。 Work flow

Docker client issues the instructions to create the container. Docker engine receives the instruction and goes to the image warehouse to get the image. After receiving the instruction, docker engine notifies docker-containerd to start the container, and docker-containerd starts the shim process after receiving the notification. After the shim process starts, run the RunC child process, runcC will interact with cgroup,kernel, start the container, then runC destroys the container, shim takes over the container and monitors the container, and the whole container creation process is completed.

The relationship between the image and the container

The image can be understood as a series of encapsulated directories, and the container is understood as mounting these encapsulated directories together. The image is a static resource, and the container is readable and writable.

4. Container application scenarios

1. Environmental consistency 2.CI/CD3. Micro service 4. Elastic telescopic 5. Grayscale release

Fifth, the difference between container and virtual machine

The VM technology layer is implemented in the hardware-based hypervisor layer, while container is based on the software docker engine on the operating system. In order to implement application isolation, we must first create a new bloated os. Rather than isolating applications, it is more like system isolation VM resource consumption, slow startup, system isolation, and hardware-based, so hardware support virtualization is required. Container has the advantages of low cost, fast startup and process isolation, regardless of whether CPU supports virtualization.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.