官术网_书友最值得收藏!

  • Containers in OpenStack
  • Pradeep Kumar Singh Madhuri Kumari
  • 279字
  • 2021-07-02 21:17:22

Container components

Linux containers are typically comprised of five major components:

  • Kernel namespaces: Namespaces are the major building blocks of Linux containers. They isolate various types of Linux resources such as the network, processes, users, and the filesystem into different groups. This allows different groups of processes to have completely independent views of their resources. Other resources that can be segregated include the process ID space, the IPC space, and semaphore space.
  • Control groups: Control groups, also known as CGroups, limit and account for different types of resource usage such as the CPU, memory, disk I/O, network I/O, and so on, across a group of different processes. They help in preventing one container from resource starvation or contention caused by another container, and thereby maintains QoS.
  • Security: Security in containers is provided via the following components:
    • Root capabilities: This will help in enforcing namespaces in so-called privileged containers by reducing the power of root, in some cases to no power at all.
    • Discretionary Access Control (DAC): It mediates access to resources based on user-applied policies so that inpidual containers can't interfere with each other and can be run by non-root users securely.
    • Mandatory Access Controls (MAC): Mandatory Access Controls (MAC), such as AppArmor and SELinux, are not required for creating containers, but are often a key element to their security. MAC ensures that neither the container code itself nor the code running in the containers has a greater degree of access than the process itself requires. This way, it minimizes the privileges granted to rogue or compromised processes.
    • Toolsets: Above the host kernel lies the user-space toolsets such as LXD, Docker, and other libraries, which help in managing containers:

主站蜘蛛池模板: 固原市| 上饶县| 宜宾县| 龙门县| 同仁县| 安阳县| 平度市| 老河口市| 堆龙德庆县| 盐池县| 古浪县| 三都| 涞源县| 阜城县| 博湖县| 高雄市| 双柏县| 驻马店市| 吴江市| 彭阳县| 沈阳市| 资阳市| 公主岭市| 杭锦旗| 西城区| 枝江市| 长岛县| 木里| 舒城县| 鹰潭市| 富宁县| 普宁市| 郎溪县| 宜阳县| 清远市| 吐鲁番市| 望都县| 桑日县| 宜丰县| 大理市| 通化市|