精通LXC与LXD：Linux容器虚拟化与编排实战

Linux

需积分: 17 39 浏览量更新于2023-05-30 2 收藏 3MB PDF 举报

身份认证购VIP最低享 7 折!

领优惠券(最高得80元）

"《实用LXC和LXD：Linux容器虚拟化与编排》由Senthil Kumaran S撰写，是一本深入介绍Linux容器技术的书籍，特别关注LXC（Linux Containers）和LXD（Linux Containers Daemon）的使用。本书旨在帮助读者理解如何利用Linux容器作为虚拟化技术的替代方案，提升操作系统环境的灵活性，并提供平滑的用户体验。书中通过实际案例探讨了LXC和LXD在开发者、DevOps和系统管理员场景下的应用，同时讲解了与libvirt和SaltStack等虚拟化及编排工具的集成，并深入讨论了容器化与物联网安全问题。" 在这本书中，读者将学习到以下关键知识点： 1. **Linux容器基础**：了解Linux容器的概念，它是如何在不牺牲性能的情况下实现轻量级虚拟化的。 2. **LXC和LXD入门**：熟悉这两个工具的安装、配置和基本操作，理解它们之间的区别和联系。 3. **LXC和LXD应用场景**：针对开发人员、DevOps和系统管理员展示LXC和LXD的实际用例，例如代码隔离、测试环境搭建和资源管理等。 4. **LXC和LXD资源管理**：掌握如何管理和使用LXC和LXD的存储库与模板，以创建和定制容器环境。 5. **虚拟化和编排工具集成**：学习如何将LXC和LXD与libvirt、SaltStack等工具配合使用，提升自动化运维能力。 6. **容器化与安全性**：深入探讨容器化在物联网(IoT)环境中的安全问题，通过案例分析展示如何利用容器化技术减轻操作系统级别的安全风险。 7. **目标读者**：适合具备基本Linux和软件开发知识的软件开发者、运维工程师和系统管理员，同时也对经理和爱好者有参考价值。书中的章节安排如下： 1. **第一章：Linux容器简介**：介绍容器技术的基础概念和优势。 2. **第二章：安装**：指导读者在不同的Linux发行版上安装LXC和LXD。 3. **第三章：开始使用LXC和LXD**：逐步教学如何创建和管理容器。 4. **第四章：LXC和LXD资源**：探索资源的获取和配置方法。 5. **第五章：常见虚拟化和编排工具**：介绍如何与其他工具集成。 6. **第六章：使用案例**：展示不同场景下LXC和LXD的实际应用。 7. **第七章：容器与安全**：讨论容器安全问题，包括潜在风险和防护策略。通过本书，读者不仅能学会使用LXC和LXD，还能深化对容器技术的理解，提升在现代IT环境中运用容器的能力。

资源详情

资源推荐

CHAPTER 1 ■ INTRODUCTION TO LINUX CONTAINERS

■ Note Some technologies covered in Table 1-1 may be supported in more operating

systems than those listed. Most of the technologies are available on various forms of Unix

operating system, including Linux.

Some container technologies listed in Table1-1 have a very specific purpose, such

as chroot, which provides filesystem isolation by switching the root directory for running

processes and their children. Other technologies listed provide complete operating

system–level virtualization, such as Solaris containers (zones) and LXC.

Common modern-day containers are descended from LXC, which was first

introduced in 2008. LXC was possible due to some key features added to the Linux kernel

starting from the 2.6.24 release, as described in the next section.

Features to Enable Containers

Containers rely on the following features in the Linux kernel to get a contained or isolated

area within the host machine. This area is closely related to a virtual machine, but without

the need for a hypervisor.

• Control groups (cgroups)

• Namespaces

• Filesystem or rootfs

Control Groups (Cgroups)

To understand the importance of cgroups, consider a common scenario: A process

running on a system requests certain resources from the system at a particular instance,

but unfortunately the resources are unavailable currently, so the system decides to defer

Table 1-1. Container Technology Timeline

Year Technology First Introduced in OS

1982 Chroot Unix-like operating systems

2000 Jail FreeBSD

2000 Virtuozzo containers Linux, Windows (Parallels Inc. version)

2001 Linux VServer Linux, Windows

2004 Solaris containers (zones) Sun Solaris, Open Solaris

2005 OpenVZ Linux (open source version of Virtuozzo)

2008 LXC Linux

2013 Docker Linux, FreeBSD, Windows

CHAPTER 1 ■ INTRODUCTION TO LINUX CONTAINERS

the process until the requested resources are available. The requested resources may

become available when other processes release them. This delays the process execution,

which may not be acceptable in many applications. Resource unavailability such as this

can occur when a malicious process consumes all or a majority of the resources available

on a system and does not allow other processes to execute.

Google presented a new generic method to solve the resource control problem

with the cgroups project in 2007. Control groups allow resources to be controlled and

accounted for based on process groups. The mainline Linux kernel first included a

cgroups implementation in 2008, and this paved the way for LXC.

Cgroups provide a mechanism to aggregate sets of tasks or processes and their future

children into hierarchical groups. These groups may be configured to have specialized

behavior as desired.

Listing Cgroups

Cgroups are listed within the pseudo filesystem subsystem in the directory /sys/fs/

cgroup, which gives an overview of all the cgroup subsystems available or mounted in

the currently running system:

stylesen@harshu:~$ ls -alh /sys/fs/cgroup

total 0

drwxr-xr-x 12 root root 320 Mar 24 20:40 .

drwxr-xr-x 8 root root 0 Mar 24 20:40 ..

dr-xr-xr-x 6 root root 0 Mar 24 20:40 blkio

lrwxrwxrwx 1 root root 11 Mar 24 20:40 cpu -> cpu,cpuacct

lrwxrwxrwx 1 root root 11 Mar 24 20:40 cpuacct -> cpu,cpuacct

dr-xr-xr-x 6 root root 0 Mar 24 20:40 cpu,cpuacct

dr-xr-xr-x 3 root root 0 Mar 24 20:40 cpuset

dr-xr-xr-x 6 root root 0 Mar 24 20:40 devices

dr-xr-xr-x 4 root root 0 Mar 24 20:40 freezer

dr-xr-xr-x 7 root root 0 Mar 24 20:40 memory

lrwxrwxrwx 1 root root 16 Mar 24 20:40 net_cls -> net_cls,net_prio

dr-xr-xr-x 3 root root 0 Mar 24 20:40 net_cls,net_prio

lrwxrwxrwx 1 root root 16 Mar 24 20:40 net_prio -> net_cls,net_prio

dr-xr-xr-x 3 root root 0 Mar 24 20:40 perf_event

dr-xr-xr-x 6 root root 0 Mar 24 20:40 pids

dr-xr-xr-x 7 root root 0 Mar 24 20:40 systemd

Memory Subsystem Hierarchy

Let’s take a look at an example of the memory subsystem hierarchy of cgroups. It is

available in the following location:

/sys/fs/cgroup/memory

CHAPTER 1 ■ INTRODUCTION TO LINUX CONTAINERS

The memory subsystem hierarchy consists of the following files:

root@harshu:/sys/fs/cgroup/memory# ls

cgroup.clone_children memory.memsw.failcnt

cgroup.event_control memory.memsw.limit_in_bytes

cgroup.procs memory.memsw.max_usage_in_bytes

cgroup.sane_behavior memory.memsw.usage_in_bytes

init.scope memory.move_charge_at_immigrate

lxc memory.numa_stat

memory.failcnt memory.oom_control

memory.force_empty memory.pressure_level

memory.kmem.failcnt memory.soft_limit_in_bytes

memory.kmem.limit_in_bytes memory.stat

memory.kmem.max_usage_in_bytes memory.swappiness

memory.kmem.slabinfo memory.usage_in_bytes

memory.kmem.tcp.failcnt memory.use_hierarchy

memory.kmem.tcp.limit_in_bytes notify_on_release

memory.kmem.tcp.max_usage_in_bytes release_agent

memory.kmem.tcp.usage_in_bytes system.slice

memory.kmem.usage_in_bytes tasks

memory.limit_in_bytes user

memory.max_usage_in_bytes user.slice

root@harshu:/sys/fs/cgroup/memory#

Each of the files listed contains information on the control group for which it

has been created. For example, the maximum memory usage in bytes is given by the

following command (since this is the top-level hierarchy, it lists the default setting for the

current host system):

root@harshu:/sys/fs/cgroup/memory# cat memory.max_usage_in_bytes

15973715968

The preceding value is in bytes; it corresponds to approximately 14.8GB of memory

that is available for use by the currently running system. You can create your own cgroups

within /sys/fs/cgroup and control each of the subsystems.

Namespaces

At the Ottawa Linux Symposium held in 2006, Eric W. Bierderman presented his paper

“Multiple Instances of the Global Linux Namespaces” (available at https://www.kernel.org/

doc/ols/2006/ols2006v1-pages-101-112.pdf). This paper proposed the addition of ten

namespaces to the Linux kernel. His inspiration for these additional namespaces was the

existing filesystem namespace for mounts, which was introduced in 2002. The proposed

namespaces are as follows:

• The Filesystem Mount Namespace (mnt)

• The UTS Namespace

• The IPC Namespace (ipc)

剩余166页未读，继续阅读

向来痴SAS

粉丝: 30
资源: 71

会员权益专享

精通LXC与LXD：Linux容器虚拟化与编排实战

用于LXC技术在arm平台上移植的linux内核文件

eclipse3.5 反编译插件运行异常报：Unmatched braces in the pattern

高峰：LXC（Linux Container）介绍

linux lxc lxd提供了哪些命令

LXC/LXD常用配置

linux lxc 提供了哪些命令

linux LXC LXD 区别

有没有国产化的类似docker的容器

RTLinux是否支持docker

android安装lxc

lxc_getstate

docker换成contain

linux lxd提供了哪些命令

allow lxc-init overlayfs_file:dir write; allow lxc-init tmpfs:blk_file ioctl;

allow lxc-init tmpfs:blk_file ioct

openwrt lxc

pve8.0 lxc

ubuntu上怎么启动freebsd的容器

lxc_container_put

会员权益专享

最新资源