Despite the popularity and hype of containers, there is no need to regard containers as a block box. It is important to have an awareness of what's going on under the hood to help optimize your container requirements. In this session, we'll discuss: - Namespacing in the kernel - Copy-on-write storage choices - Portable container formats - Available container alternatives - Validation, trust, and content addressability with image verification See examples and options for your use-cases.

1. CONTAINERS:
UNDER THE HOOD
Vincent Batts @vbatts

2. $> finger $(whoami)
Login: vbatts Name: Vincent Batts
Directory: /home/vbatts Shell: /bin/bash
Such mail.
Plan:
OHMAN
$> id -Gn
devel opencontainers docker appc redhat golang slackware

4. HAN D S- O N:
capabilities
Syscalls
Copy-On-Write (CoW)
Archives
Namespaces
p.s. Don't forget to fill out the surveys!

5. SO,
WHY, CO NTAINERS?
Single Application
Full System
But Not a VM
Except Maybe a VM
Pods of applications
Labels of services
Non-root
Desktop Applications
OMG AND CATS
https://www.flickr.com/photos/27549668@N03/

6. But Wait,
What does "container" mean to you?

7. CAPAB ILITIES
(only on some versions of util-linux)
capabilities(7)
setpriv(1)
capsh(1)
proc(5)
DEMO

8. GOOD IDEA:
BAD IDEA:
whistling while you work
whistling while you eat

9. DEMO
SYS CALLS
seccomp(2)
proc(5)

10. GOOD IDEA:
BAD IDEA:
feeding a stray kitten in the park
feeding a stray kitten in the park to a bear

11. DEMO
NAM ESPACES
unshare(1)
proc(5)
lsns(8)

12. GOOD IDEA:
BAD IDEA:
playing catch with your grandpa
playing catch with your grandpa

13. DEMO
COPY-ON-WRITE ( COW )
lvmthin(7)
btrfs-subvolume(8)
overlayFS

14. GOOD IDEA:
BAD IDEA:
being served breakfast in bed
being served tennis balls in bed

15. FS *MAG IC*
shared subtree propogation

16. GOOD IDEA:
BAD IDEA:
ordering a chili dog to go
ordering a chili dog that makes you go

17. TAR ARCH IVES
format
tar-split

18. GOOD IDEA:
BAD IDEA:
Dressing up at Halloween as a pirate
Dressing up at Halloween as a piñata

19. THAN KS!
VIN CEN T BATTS
@ VBATTS| VBAT TS@ RE DHAT.COM