官术网_书友最值得收藏!

Container components

Linux containers are typically comprised of five major components:

  • Kernel namespaces: Namespaces are the major building blocks of Linux containers. They isolate various types of Linux resources such as the network, processes, users, and the filesystem into different groups. This allows different groups of processes to have completely independent views of their resources. Other resources that can be segregated include the process ID space, the IPC space, and semaphore space.
  • Control groups: Control groups, also known as CGroups, limit and account for different types of resource usage such as the CPU, memory, disk I/O, network I/O, and so on, across a group of different processes. They help in preventing one container from resource starvation or contention caused by another container, and thereby maintains QoS.
  • Security: Security in containers is provided via the following components:
    • Root capabilities: This will help in enforcing namespaces in so-called privileged containers by reducing the power of root, in some cases to no power at all.
    • Discretionary Access Control (DAC): It mediates access to resources based on user-applied policies so that inpidual containers can't interfere with each other and can be run by non-root users securely.
    • Mandatory Access Controls (MAC): Mandatory Access Controls (MAC), such as AppArmor and SELinux, are not required for creating containers, but are often a key element to their security. MAC ensures that neither the container code itself nor the code running in the containers has a greater degree of access than the process itself requires. This way, it minimizes the privileges granted to rogue or compromised processes.
    • Toolsets: Above the host kernel lies the user-space toolsets such as LXD, Docker, and other libraries, which help in managing containers:

主站蜘蛛池模板: 望都县| 同心县| 牙克石市| 甘孜| 张家界市| 屏南县| 济宁市| 青浦区| 迭部县| 弋阳县| 永胜县| 伊川县| 承德市| 东源县| 虎林市| 雷山县| 平泉县| 玉屏| 东光县| 阜城县| 德惠市| 蒙山县| 醴陵市| 兴义市| 农安县| 嘉兴市| 宁都县| 开封市| 历史| 吕梁市| 淮北市| 玉山县| 滨海县| 勃利县| 三河市| 鹤庆县| 东兴市| 石台县| 乌鲁木齐市| 额尔古纳市| 漾濞|