You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
- Enables developers to package applications with their specific requirements
22
+
- Allows for consistent environments across local and production settings
23
+
24
+
## Goals of containerization
25
+
26
+
- Achieves strong security isolation
27
+
- Reduces virtual machine overhead
28
+
- Enhances privacy with per-container directory access control
29
+
- Delivers a performant experience that respects user resources
30
+
31
+
## Use cases
32
+
33
+
- Provides isolation from the host
34
+
- Provides isolation from other workloads
35
+
- Development environments
36
+
37
+
## Image management
38
+
39
+
- Containerization provides APIs for image management, container execution, and a powerful initialization system
40
+
- Containerization works by fetching images from a registry
41
+
- The image serves as a template, containing the file system contents and default configuration for a new container
42
+
- The image's configuration can specify the default process to execute, the working directory, and the user identity
43
+
- Containerization exposes the file system of the image as a block device for performant access, formatting the block device using EXT4, a widely used Linux file system
44
+
45
+
## Virtualization
46
+
47
+
- An EXT4 file system is directly populated from Swift
48
+
- The system starts a Linux VM to run a container that provides:
49
+
- Lightweight VM-level isolation
50
+
- Sub-second start times
51
+
- Dedicated IPs for each container
52
+
- Secure file and directory sharing
53
+
54
+
## Container environment
55
+
56
+
- Resources like CPU and memory are dynamically allocated only when containers are running
57
+
- Within this VM, a minimal file system contains the `vminitd` binary
58
+
-`vminitd`:
59
+
- Runs as the first process
60
+
- Manages network interfaces
61
+
- Mounts file systems
62
+
- Launches and supervises all subsequent processes
63
+
- To enhance security, the file system is stripped of core utilities, dynamic libraries, and `libc`
64
+
- To do this, `vminitd` is compiled as a static executable using Swift’s Static Linux SDK
65
+
66
+
### Swift Static Linux SDK
67
+
68
+
For security, we want to reduce the attack surface of our containers
69
+
- The file system provided by Containerization has no core utilities
70
+
- It contains no dynamic libraries and no `libc` implementation
71
+
- In order for `vminitd` to run in this constrained environment where there are no libraries to link to, we need to compile `vminitd` as a static executable
72
+
- Swift’s Static Linux SDK allows us to cross-compile static Linux binaries, directly from our Mac
73
+
- We are also able to use `musl`, a `libc` implementation with excellent support for static linking
74
+
- We produce `vminitd` as a static linux executable cross-compiled from our Mac
75
+
76
+
## Command-line tooling
77
+
78
+
A command-line tool, `container`, utilizes these APIs to manage storage, images, networks, and run containers
0 commit comments