Announcing Intel Clear Containers V2.1.1

#1

Post by ah- » Mon, Mar 13, 2017, 10:09 PM UTC

Announcing Intel Clear Containers V2.1.1
clearlinux.org

Re: Announcing Intel Clear Containers V2.1.1

#2

Post by phildougherty » Mon, Mar 13, 2017, 10:59 PM UTC

Pretty neat how nicely this integrates into an existing docker host setup. Definitely going to give it a try and see about integrating into containership.

edit: typo

Re: Announcing Intel Clear Containers V2.1.1

#3

Post by chatmasta » Mon, Mar 13, 2017, 10:59 PM UTC

I hadn't seen this project before. It looks really cool. I especially like the support for pushing network configuration at startup (via the "hyperstart" concept in v1 and systemd in v2). This is sorely lacking in Docker. You can accomplish it with pipework (which is just a wrapper around `ip exec` in the container netns), but then you need to write code in the container like "wait for interface XX to be up before running entry_point.sh"

My use case is creating containers with multiple interfaces and custom routing rules for each interface. Currently I am using pipework.sh to setup the interfaces and routes, but it's a dirty hack and increases container boot time due to the need to poll for interfaces to be up before starting the application. It looks like this "hyperstart"/systemd approach to namespace isolation avoids that latency, which is nice.

Unfortunately, according to these docs, each container interface requires a tap bridge in addition to the usual veth pair, due to qemu networking limitations. That's unfortunate, especially for containers with multiple interfaces, which is specifically my use-case.

Does anyone have an idea of the overhead of creating many tap interfaces within a container?

Re: Announcing Intel Clear Containers V2.1.1

#4

Post by gtirloni » Mon, Mar 13, 2017, 11:08 PM UTC

Anyone using this in production and betting on the long term viability of this project?

Re: Announcing Intel Clear Containers V2.1.1

#5

Post by justincormack » Mon, Mar 13, 2017, 11:31 PM UTC

chatmasta wrote: post #3

I hadn't seen this project before. It looks really cool. I especially like the support for pushing network configuration at startup (via the "hyperstart" concept in v1 and systemd in v2). This is sorely lacking in Docker. You can accomplish it with pipework (which is just a wrapper around `ip exec` in the container netns), but then you need to write code in the container like "wait for interface XX to be up before ru…

Sounds like the networking model for containerd will suit you? See https://github.com/docker/containerd/issues/362#issuecomment... - you get as long as you like to set up networking before the process starts running.

Re: Announcing Intel Clear Containers V2.1.1

#6

Post by alpb » Mon, Mar 13, 2017, 11:34 PM UTC

Here's a cool technical and short article about the Clear Containers by someone worked on the project to bring you up to speed with what is going on: https://lwn.net/Articles/644675/

Re: Announcing Intel Clear Containers V2.1.1

#7

Post by tyingq » Mon, Mar 13, 2017, 11:39 PM UTC

Sounds similar to what http://hypercontainer.io is doing.

Re: Announcing Intel Clear Containers V2.1.1

#8

Post by nimish » Tue, Mar 14, 2017, 1:06 AM UTC

Containers done right

I wish the documentation was better for integrating with docker seamlessly

Re: Announcing Intel Clear Containers V2.1.1

#9

Post by philips » Tue, Mar 14, 2017, 1:20 AM UTC

If you want to try out Clear Containers with rkt you can easily do it on a linux physical machine. First, install rkt via deb/rpm[1] or tarball[2]

Then do:

    sudo rkt run --debug --insecure-options=image --stage1-name=coreos.com/rkt/stage1-kvm:1.25.0 docker://redis

If you run into problem you can email rkt-dev[3].

[1] https://coreos.com/rkt/docs/latest/distributions.html#rpm-ba... [2] https://github.com/coreos/rkt/releases/tag/v1.25.0 [3] https://groups.google.com/forum/#!forum/rkt-dev

Re: Announcing Intel Clear Containers V2.1.1

#10

Post by doublerebel » Tue, Mar 14, 2017, 6:36 AM UTC

chatmasta wrote: post #3

I hadn't seen this project before. It looks really cool. I especially like the support for pushing network configuration at startup (via the "hyperstart" concept in v1 and systemd in v2). This is sorely lacking in Docker. You can accomplish it with pipework (which is just a wrapper around `ip exec` in the container netns), but then you need to write code in the container like "wait for interface XX to be up before ru…

FWIW I just use Joyent Triton with SmartOS and docker containers, my VLANs exist on start and I can't imagine dealing with those issues. What SDN solution are you using that requires this kind of init process?

Solaris solved the service dependency graph problem with SMF, which is nice.