Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
ランタイムとcgroupの xxxな関係 / bpf_get_current_cgroup_i...
Search
KONDO Uchio
January 28, 2021
Technology
0
1.3k
ランタイムとcgroupの xxxな関係 / bpf_get_current_cgroup_id(void) and modern container runtimes
Container Runtime Meetup #3
https://runtime.connpass.com/event/198071/
KONDO Uchio
January 28, 2021
Tweet
Share
More Decks by KONDO Uchio
See All by KONDO Uchio
大規模レガシーテストを 倒すための CI基盤の作り方 / #CICD2023
udzura
5
2.4k
Ruby x BPF in Action / RubyKaigi 2022
udzura
0
240
Narrative of Ruby & Rust
udzura
0
220
開発者生産性指標の可視化 / pepabo-four-keys
udzura
3
1.7k
Talk of RBS
udzura
0
450
Re: みなさん最近どうですか? / FGN tech meetup in 2021
udzura
0
780
Dockerとやわらかい仮想化 - ProSec-IT/SECKUN 2021 edition -
udzura
2
730
Device access filtering in cgroup v2
udzura
1
900
"Story of Rucy" on RubyKaigi takeout 2021
udzura
0
830
Other Decks in Technology
See All in Technology
Perk アプリの技術選定とリリースから1年弱経ってのふりかえり
stomk
0
120
Agentic DevOps時代の生存戦略
kkamegawa
0
670
米国国防総省のDevSecOpsライフサイクルをAWSのセキュリティサービスとOSSで実現
syoshie
1
350
TODAY 看世界(?) 是我們在看扣啦!
line_developers_tw
PRO
0
780
CSS、JSをHTMLテンプレートにまとめるフロントエンド戦略
d120145
0
160
Claude Code どこまでも/ Claude Code Everywhere
nwiizo
51
30k
kubellが挑むBPaaSにおける、人とAIエージェントによるサービス開発の最前線と技術展望
kubell_hr
1
360
OCI Oracle Database Services新機能アップデート(2025/03-2025/05)
oracle4engineer
PRO
1
190
"SaaS is Dead" は本当か!? 生成AI時代の医療 Vertical SaaS のリアル
kakehashi
PRO
3
250
vLLM meetup Tokyo
jpishikawa
1
250
Observability в PHP без боли. Олег Мифле, тимлид Altenar
lamodatech
0
170
VCpp Link and Library - C++ breaktime 2025 Summer
harukasao
0
210
Featured
See All Featured
Building Better People: How to give real-time feedback that sticks.
wjessup
367
19k
BBQ
matthewcrist
89
9.7k
GitHub's CSS Performance
jonrohan
1031
460k
Intergalactic Javascript Robots from Outer Space
tanoku
271
27k
The Art of Programming - Codeland 2020
erikaheidi
54
13k
Six Lessons from altMBA
skipperchong
28
3.8k
Art, The Web, and Tiny UX
lynnandtonic
299
21k
Creating an realtime collaboration tool: Agile Flush - .NET Oxford
marcduiker
30
2.1k
A Tale of Four Properties
chriscoyier
159
23k
Into the Great Unknown - MozCon
thekraken
39
1.8k
Typedesign – Prime Four
hannesfritz
42
2.7k
The Pragmatic Product Professional
lauravandoore
35
6.7k
Transcript
bpf_get_current_cgroup_id(void) を添えて Uchio Kondo / Container Runtime Meetup #3 ランタイムとcgroupの
xxxな関係 * Photo by Fukuoka City
γχΞɾϓϦϯγύϧΤϯδχΞ ۙ౻ Ӊஐ࿕ / @udzura https://blog.udzura.jp/ Uchio Kondo ٕज़෦ ٕज़ج൫νʔϜ
#Ruby #mruby #Containers #eBPF #CRIU #Seccomp #RubyKaigi #CloudNativeDays #Zumba #γϨϯ
ToC •τϨʔγϯάͱ eBPF •ίϯςφΛτϨʔε͢ΔͨΊͷલఏࣝ •eBPF ͰͷίϯςφͱϨʔεͷ࣮ࡍ •ίϯςφϥϯλΠϜͷରԠ •ʢ͓·͚ʣBPF CO-RE
eBPF and Containers
eBPF ͷ •https://speakerdeck.com/chikuwait/learn-ebpf
eBPF ͱԿ͔ •ϢʔβۭؒͰ࡞ͬͨϓϩάϥϜΛΧʔωϧͰಈ͔ٕ͢ज़ͷͻͱͭ •ϑΟϧλϦϯά͕ಘҙʢtcpdump, seccomp, bpftraceʣ •ΧʔωϧͷใʹΞΫηεͰ͖Δ͕ɺةݥͳίʔυಈ͔ͳ͍ͳͲ ҆શੑ͕͋Δఔ୲อ͞Ε͍ͯΔ
τϨʔεπʔϧͷར༻ •bpftrace •BCC •BPF Performance Tools • execsnoop, runqlat, tcplife...
• http://www.brendangregg.com/bpf-performance-tools-book.html
ίϯςφΛτϨʔε͍ͨ͠ •લఏࣝ2ͭ •Linux Namespace •cgroup (v1/v2)
Linux Namespaceʢ໊લۭؒʣ •OSͷதͷҰ෦ͷ໊લۭؒΛΓग़͠ɺ ಠཱͨ͠Ϧιʔεʢϗετ໊ɺωοτϫʔΫɺPIDͷ࠾൪ɺϚϯτ ϙΠϯτͳͲʣΛ࣋ͨͤΔٕज़ɻ IUUQTDPOUBJOFSTFDVSJUZEFWOBNFTQBDF
cgroup (Control Groups) •ϓϩηεΛάϧʔϓԽ͠ɺͦͷ୯ҐͰϦιʔεͷར༻ʢCPUɺϝϞ ϦɺϒϩοΫI/OɺϓϩηεʣΛ੍ݶ͢Δɻ •rlimitͱҧ͍ϢʔβΛލ͍ͰॴଐՄೳɺ·ͨλεΫͷॴଐάϧʔϓ ॊೈʹม͑ΒΕΔ •v1/v2͕͋Δ (v2=2014/8~ Linux
3.16) IUUQTDPOUBJOFSTFDVSJUZEFWDHSPVQɹ
Implementations
eBPFͰίϯςφΛτϨʔε͢Δ •ઓུ͕͍͔ͭ͋͘Δ •Linux Namespace·ͨcgroup (v2)ͷใ͕ར༻Ͱ͖Δ
ઓུ(1) •task_struct→nsproxy ͔Β namespaceͷใΛ औಘͯ͠ϑΟϧλ͢Δ ʢcxrayʣ IUUQTHJUIVCDPNNSUDDYSBZCMPCNBTUFSQLHUSBDFSPQFOPQFOHP--
ઓུ(2) •BPFϓϩάϥϜͰऔಘͰ͖ͨ tidͱɺϗετͰͷtidΛ ൺֱ͠ɺҰக͠ͳ͚Ε ίϯςφͱఆ͢Δ ʢTraceeʣ • tasuk_structґଘ IUUQTHJUIVCDPNBRVBTFDVSJUZUSBDFFCMPCNBJOUSBDFFUSBDFFCQGD-ɹ
ઓུ(3) •cgroup v2ͷIDΛϗετͱൺֱ͢Δ •bpf-helpers(7)
࣮ࡍʹͬͯΈ࣮ͨྫ •udzura/copenclose(8)
6TJOHIPTUOBNF 654/4 6TJOH$(SPVQW*%
cgroup v2
ϥϯλΠϜͷରԠঢ়گ •Suda͞Μͷهࣄ͕ৄ͍͠Ͱ͢… (https://medium.com/nttlabs/cgroup-v2-596d035be4d7) •ͱ͍͑ɺ2021ݱࡏͷঢ়گΛ؆୯ʹௐࠪ͠·ͨ͠
ϥϯλΠϜͱcgroupͷઃఆ •Cgroup Driver: ίϯςφʹׂΓͯΔcgroupΛͲ͏ίϯτϩʔϧ͢Δ͔ •cgroupfs: cgroupfsͷͷϑΝΠϧૢ࡞ •systemd: systemdʹΑΔཧ •Cgroup Version:
Ϧιʔε੍ݶʹ v1/v2 ͲͪΒΛར༻͢Δ͔ •/sys/fs/cgroup ʹͲͷϑΝΠϧγεςϜ͕Ϛϯτ͞ΕͯΔ͔Ͱఆ •ʢdocker/containerd ͷ߹ɻpodmanಉ༷ʁʣ
v2ΛͲ͏͏? •ϗετΛv2Ϟʔυʹ͢ΔʹɺΧʔωϧىಈύϥϝʔλͷมߋ͕ඞཁ... •ϗετLinuxΛv1/v2ڞଘڥͰىಈ͍ͯ͠Δ߹Version=v1ͱఆ͞ΕΔ •CGroup Driver=systemdʹ͢Είϯςφv2ͷάϧʔϓʹॴଐ͢Δ Α͏ʹͳΔʂ systemd͕ͬͯ͘ΕΔ༷ʁ •੍ݶͷॻ͖ࠐΈv1ͷAPI͕ΘΕΔ •άϧʔϓIDɺී௨ʹऔಘͰ͖ΔΑ͏ʹͳΔ
֤ίϯςφϥϯλΠϜͰͷରԠঢ়گ •ߴϨϕϧϥϯλΠϜɺCgroup DriverͷઃఆมߋखॱΛܝࣔ͢Δɻ •ϨϕϧϥϯλΠϜͷରԠঢ়گΛࢀߟʹܝࡌ͢Δ
ߴϨϕϧϥϯλΠϜ •docker: •podman: σϑΥϧτͰsystemdɻ໌ࣔ: •containerd: ྫ: •FYI: ఆखॱ
ϨϕϧϥϯλΠϜ •runc, crun •Cgroup v2/systemd driverʹରԠࡁΈ •runsc (gVisor) •ରԠͷͨΊͷIssueཱ͍ͬͯΔ •ݱঢ়Τϥʔͷ༷
IUUQTHJUIVCDPNHPPHMFHWJTPSJTTVFT $ sudo podman run --runtime `which runsc` -dt -p 10184:80/tcp httpd:2.4 Error: OCI runtime error: systemd cgroup flag passed, but systemd cgroups not supported. See gvisor.dev/issue/193
·ͱΊ •֤छϥϯλΠϜ͢Ͱʹv2Ͱಈ͘ •cgroupidͷऔಘͳΒ͙͢ʹͰઃఆͯ͠Ͱ͖Δঢ়ଶ •cAdvisorͳͲରԠΛਐΊ͍ͯΔ •τϨʔεͪΖΜɺPSI͑Δ͠ rootless kubernetes ͷເ... Զ ͨͪͷݥ࢝·͔ͬͨΓͩ
IUUQTHJUIVCDPNHPPHMFDBEWJTPSQVMM
͓·͚: BPF CO-REόΠφϦ •eBPF ToolΛίϯςφ෦Ͱಈ͔͢ͷେม... •BPF CO-REͱ͍͏ٕज़ͰɺϓϨίϯύΠϧࡁΈͷBPFόΠφϦΛಈ͔ ͤΔɺΧʔωϧͷϔομϑΝΠϧclangίϚϯυʹґଘͤͣಈ࡞͢Δ •͔͠͠࠷৽ͷΧʔωϧʴ৽͍͠CONFIG͕ඞཁ...
πʔϧͷಈ࡞ڥྫ
ࢀߟ: ಈ࡞ڥ IUUQTHJTUHJUIVCDPNVE[VSBBFEDCDBEFG •ࠓݕূͨ͠ڥҎԼʹ·ͱΊ·ͨ͠ɻUbuntu 20.10ϕʔε