官术网_书友最值得收藏!

Container components

Linux containers are typically comprised of five major components:

  • Kernel namespaces: Namespaces are the major building blocks of Linux containers. They isolate various types of Linux resources such as the network, processes, users, and the filesystem into different groups. This allows different groups of processes to have completely independent views of their resources. Other resources that can be segregated include the process ID space, the IPC space, and semaphore space.
  • Control groups: Control groups, also known as CGroups, limit and account for different types of resource usage such as the CPU, memory, disk I/O, network I/O, and so on, across a group of different processes. They help in preventing one container from resource starvation or contention caused by another container, and thereby maintains QoS.
  • Security: Security in containers is provided via the following components:
    • Root capabilities: This will help in enforcing namespaces in so-called privileged containers by reducing the power of root, in some cases to no power at all.
    • Discretionary Access Control (DAC): It mediates access to resources based on user-applied policies so that inpidual containers can't interfere with each other and can be run by non-root users securely.
    • Mandatory Access Controls (MAC): Mandatory Access Controls (MAC), such as AppArmor and SELinux, are not required for creating containers, but are often a key element to their security. MAC ensures that neither the container code itself nor the code running in the containers has a greater degree of access than the process itself requires. This way, it minimizes the privileges granted to rogue or compromised processes.
    • Toolsets: Above the host kernel lies the user-space toolsets such as LXD, Docker, and other libraries, which help in managing containers:

主站蜘蛛池模板: 南华县| 腾冲县| 德令哈市| 潞西市| 兴和县| 孙吴县| 建德市| 林甸县| 鸡东县| 民丰县| 耿马| 鄂托克旗| 当涂县| 灵寿县| 罗江县| 海安县| 专栏| 屏南县| 达拉特旗| 江达县| 宣城市| 广元市| 卓尼县| 普宁市| 民和| 兖州市| 舒城县| 什邡市| 和林格尔县| 外汇| 五河县| 原阳县| 敦煌市| 唐海县| 广灵县| 玉环县| 康马县| 收藏| 榆社县| 易门县| 德惠市|