COSCUP 2020: Playing with AWS Firecracker VMM

Blog post: https://www.ernestchiang.com/zh/posts/2020/2020-08-01-playing-with-firecracker/

Transcript

1. Playing with AWS Firecracker VMM 之 ⼤熱天捲起袖⼦動⼿玩 ... Ernest Chiang @ COSCUP 2020, Track: Cloud Native Hub
2. Give me a place to stand on, and I will move the Earth. —Archimedes 2
3. sli.do #awsvmm #awsvmm #awsvmm #awsvmm #awsvmm #awsvmm #awsvmm #awsvmm #awsvmm #awsvmm #awsvmm #awsvmm #awsvmm #awsvmm #awsvmm #awsvmm #awsvmm #awsvmm #awsvmm #awsvmm #awsvmm 議程中有任何問題、好奇、疑問，都可以隨時丟進 sli.do US$25 AWS Credits 問券連結，也放在 sli.do 裡頭喔 3
4. Ernest Chiang Worked on process integration engineering in semiconductor industry @tsmc. Doing product and technology integration in fitness industry @pafers. Off Work TGO Networks Taipei. AWS Community Hero. Mozillian. AIESECer. 4
8. Outline Problems & Solutions Firecracker Virtualization & Containerization Lambda & Fargate Firecracker & container d Live Demo Getting started with Firecracker in 2 Minutes Creating 4,000 microVMs in 90 seconds Firecracker & Open Source Projects 8
9. Problems & Solutions 9
10. Firecracker, Part 1 10
11. What is Firecraker Firecracker is an open source VMM that is purpose-built for creating and managing secure, multi-tenant container and function-based services. 11
12. What is Firecraker Firecracker is an open source VMM that is purpose-built for creating and managing secure, multi-tenant container and function-based services. 12
13. What problem is AWS helping to solve? 13
14. What problem is AWS helping to solve? 14
15. What problem is AWS helping to solve? Multiple functions on multiple environments from multiple accounts . 15
16. What is Firecracker Open source virtualization technology (microVM) Security and isolation of traditional VMs Speed and density of containers Low resource overhead Developed at Amazon 16
17. Benefits of Firecracker 17
18. Benefits of Firecracker 18
19. 安全隔離好 啟動時間短 產能效率⾼ # 像極了愛情 -- AWS Firecracker VMM 19
20. Virtualization & Containerization 20
21. Virtualization (1/3) In computing, virtualization refers to the act of creating a virtual (rather than actual) version of something , including virtual computer hardware platforms, storage devices, and computer network resources. 21
22. Virtualization (2/3) Creating a virtual version of something : CPU Memory Device/IO (Storage, NIC) 22
23. Virtualization (3/3) 23
24. Hypervisor (1/6) A hypervisor (or virtual machine monitor , VMM , virtualizer) is computer software, firmware or hardware that creates and runs virtual machines. 24
25. Hypervisor (2/6) In 1974 , Gerald J. Popek and Robert P. Goldberg classified two types of hypervisor: Type-1, native or bare- metal hypervisors Type-2 or hosted hypervisors 25
26. Hypervisor (3/6) The distinction between these two types is not always clear. For instance, Linux's Kernel- based Virtual Machine ( KVM ) and FreeBSD's bhyve are kernel modules that effectively convert the host operating system to a type-1 hypervisor. 26
27. Hypervisor (4/6) At the same time, since Linux distributions and FreeBSD are still general-purpose operating systems, with applications competing with each other for VM resources, KVM and bhyve can also be categorized as type-2 hypervisors. 27
28. Hypervisor (5/6) 28
29. Hypervisor (6/6) 29
30. KVM Kernel-based Virtual Machine (KVM) is a virtualization module in the Linux kernel that allows the kernel to function as a hypervisor. 30
31. Containerization Operating-system-level virtualization, also known as containerization, refers to an operating system feature in which the kernel allows the existence of multiple isolated user-space instances. Such instances, called containers , partitions, virtual environments (VEs) or jails (FreeBSD jail or chroot jail), may look like real computers from the point of view of programs running in them. 31
32. Containerization 32
34. Firecracker, Part 2 34
39. Host-facing REST API 39
40. Firecracker Started with a branch of crosvm Removed >50% of the code 96% fewer lines of code than QEMU Simplified device model no BIOS, no PCI, etc Apache 2.0 license 40
41. Security Models (1/2) 41
42. Security Models (2/2) 42
43. Firecracker In production in AWS Lambda Millions of workloads Trillions of requests/month 43
44. AWS Lambda 44
45. Lambda worker architecture 45
46. Lambda worker isolation 46
47. Lambda isolation comparison 47
48. Lambda isolation using Firecracker 48
49. Allocate Workloads: 49
50. More efficient: 50
51. AWS Container Services landscape 51
53. AWS Fargate 53
54. Fargate configurations CPU (vCPU) Memory Values (GB) 0.25 0.5, 1, 2 0.5 Min 1GB, max 4GB, in 1GB increments 1 Min 2GB, max 8GB, in 1GB increments 2 Min 4GB, max 16GB, in 1GB increments 4 Min 8GB, max 30GB, in 1GB increments 54
60. Firecracker & container d 60
61. Firecracker & container d container d to manage containers as Firecracker microVMs. Multi-tenant hosts OCI image format Work with popular orchestration frameworks Kubernetes and Amazon ECS Define a future: light as container, secure as VM 61
62. OCI Image & OCI Runtime container d runc is a CLI tool for spawning and running containers according to the OCI specification. 62
63. Firecracker & container d Architecture 63
64. Live Demo 64
65. Live Demo #1 Getting Started with Firecracker in 2 Minutes 65
66. Getting started with Firecracker Firecracker on AWS bare metal Firecracker on other clouds with bare metal (e.g., Packet) Firecracker on GCP nested-virt Firecracker on Azure nested-virt Firecracker on your dev machine (physical/nested-virt) 66
67. Getting started with Firecracker Firecracker on AWS bare metal Firecracker on other clouds with bare metal (e.g., Packet) Firecracker on GCP nested-virt Firecracker on Azure nested-virt Firecracker on your dev machine (physical/nested-virt) 67
68. Live Demo #1 Getting Started with Firecracker in 2 Minutes: Firecracker on VirtualBox on macOS on Macbook Pro https://github.com/dwchiang/f irecracker- workshops/tree/master/01- getting-started 68
69. Live Demo #2 Creating 4,000 microVMs in 90 Seconds 69
70. Live Demo #2 Creating 4,000 microVMs in 90 Seconds: Firecracker on EC2 Bare Metal instance https://github.com/dwchiang/f irecracker- workshops/tree/master/02- 4000-microVMs 70
72. Type Name vCPU ECU Memory Instance Storage Cost per hour i3.metal 64 208 512 GiB 8 x 1900 NVMe SSD $4.992 m5.metal 96 345 384 GiB EBS Only $4.608 m5d.metal 96 345 384 GiB 4 x 900 NVMe SSD $5.424 c5.metal 96 375 192 GiB EBS Only $4.08 c5d.metal 96 375 192 GiB 4 x 900 NVMe SSD $4.608 72
73. Savings on Spot Instance 73
74. Firecracker & Open Source Projects 74
75. Firecracker Integration with Open Source Projects Kata Containers UniK OSv Weave Ignite 75
76. Weave Ignite Open source VMM with a container UX Combines Firecracker microVMs with OCI images Works using GitOps ignite gitops <repo> 76
77. Who would use Firecracker? Teams building compute services Teams integrating Firecracker with container stacks Developers & security engineers who want to contribute 77
78. Takeaways 78
79. 安全隔離好 啟動時間短 產能效率⾼ # 像極了愛情 -- AWS Firecracker VMM 79
80. Firecracker Security Model 80
81. Q&A & Thank you Blog https://www.ernestchiang.com Twitter @dwchiang #CrossFieldIntegration #TechnicalManagement #Bluetooth #AWS 81
82. https://bit.ly/awsvmm2020 抽獎活動 & $25 AWS Credits 82
83. Community 83
84. Community Cloud Native Taiwan User Group Facebook : https://www.facebook.com/groups/cloudnative.tw AWS User Group Taiwan Facebook : https://www.facebook.com/groups/awsugtw Taiwan CDK Meetup Facebook : https://www.facebook.com/groups/cdkmeetuptw 84
85. Reference 85
86. Reference: Firecracker Project Homepage : https://firecracker-microvm.github.io/ Project GitHub : https://github.com/firecracker- microvm/firecracker Project Roadmap : https://github.com/firecracker- microvm/firecracker/projects/13 86
87. Reference: Firecracker Youtube : Firecracker: A Secure and Fast microVM for Serverless Computing, 2019-0717, by Meena Gowdar (@meejamb) & Arun Gupta (@arungupta) Youtube : NSDI '20 - Firecracker: Lightweight Virtualization for Serverless Applications, 2020-02, by Marc Brooker at NSDI 20 Paper (PDF) : Firecracker: Lightweight Virtualization for Serverless Applications 87
88. Reference: Firecracker Blog : 深度解析 AWS Firecracker 原理篇 – 虚拟化与容器运⾏时技术 by 莫梓元. Blog : 深度解析 AWS Firecracker 实战篇 – ⼀起动⼿点炮⽵ by 莫梓 元. Workshop : IGNITE YOUR FIRECRACKER WORKSHOP - AWS TKO 2020 Workshop : Firecracker Workshop Collections Slide : Deep Dive into Firecracker Using Lightweight Virtual Machines to Enhance the Container Security Boundary - AWS Summit Sydney, 2019 88
89. Reference: Firecracker Demo : A demo running 4000 Firecracker microVMs Docs : Firecracker Design (firecracker-microvm/firecracker) Docs : Getting started (firecracker-microvm/firecracker) Youtube : Running AWS Firecracker in your localmachine, by Abhijith PK, 2018. 89
90. Reference: ecosystems Weave Ignite is an open source Virtual Machine (VM) manager with a container UX and built-in GitOps management. https://github.com/weaveworks/ignite OSv is an open-source versatile modular unikernel designed to run single unmodified Linux application securely as microVM on top of a hypervisor, when compared to traditional operating systems which were designed for a vast range of physical machines. https://github.com/cloudius-systems/osv 90
91. Reference: ecosystems Kata Containers is an open source project and community working to build a standard implementation of lightweight Virtual Machines (VMs) that feel and perform like containers, but provide the workload isolation and security advantages of VMs. https://github.com/kata-containers/kata-containers 91
92. Reference: ecosystems crosvm rust-vmm ... Cloud Hypervisor 92
93. Reference: Virtualization Youtube : Linux 核⼼設計_ 發展動態回顧 (2020-05-23) by jserv Slide : Embedded Virtualization applied in Mobile Devices by jserv, 2012. 93
94. Open Source at AWS https://aws.amazon.com/opensource/ 94
95. Firecracker design principles Multitenant Any vCPU and memory combination Oversubscription permissible Steady mutation rate: 100+ microVMs/host/sec Limited only by hardware resources Host-facing REST API Minimalist guest device model 95
96. Slido Poll Results 2020-0801 96