I

Context & Goals

• Linux containers
• OpenMOLE
• Goals

2

Context (1)

Linux Containers

• Isolation:

• Application packaging

3

reproducibility

security layer

Context (2)

Server-side

Client-side

HPC

Tasks

Results

4

Compute Node

Compute Node

Compute Node

Compute Node

OpenMOLE: Open Model Experiment

High Performing Computing

Context (3)

OpenMOLE: Isolation

(A)

(B)

Filesystem isolation

/home/openmole

Container 1

/home/openmole

Container 2

bind(localhost, 8000)

Container 1

Container 2

Network isolation

bind(localhost, 8000)

=> Same path

=> Same address/port

5

Context (4)

Server-side

#root

Client-side

HPC

Tasks

Results

OpenMOLE: Docker support issues

6

Goals

1

2

Running

#user

kernel-agnostic

7

Linux containers

in

restricted environments

Features:

Filesystem isolation

Network isolation

Restrictions:

images

in

II

Sandbox Solution

• Why not containers
• PRoot
• Benchmarking

8

Why not containers

• chroot / pivot_root
• network namespace
• ...
• user namespace

Containerisation features:

#root

#user

but kernel >= 3.12

9

Sandbox solution (1)

Sandbox solution (2)

PRoot

• ptrace-based sandbox

• intercept system calls

• path translation

• extension framework

10

Sandbox solution (3)

PRoot features

userspace

kernel-agnostic

filesystem isolation

network isolation

=> EXTENSION

11

Program

PRoot

Kernel

or    bind(******,          )

Port mapping extension (-p command)

        →      

kernel operation

port mapping:

Command:              -p          :                          

proot

8001

8001

8000

8000

connect(******,          )

8000

8000

bind(******,          )

8001

program

Sandbox solution (4)

12

Port mapping extension (-n command)

Command:                 -n                                       

proot

program

Sandbox solution (5)

        bind(******,          )

8000

  bind(******,   )

0

OS selects new port

Retrieve new port

Add port mapping entry

13

PRoot Benchmark (1)

script.py

server

client

bind

close

connect

send

close

"OK!"

1 iteration

14

15

PRoot Benchmark (2)

Evaluation of PRoot's and Docker's overhead
over socket operations

III

OCI Loader

• Open Container Initiative
• PRoot OCI Loader
• Benchmarking

16

OCI Loader (1)

17

Open Container Initiative

Image format

OCI Loader (2)

PRoot OCI Loader

1) Merge layers

2) Build launcher

with appropriate PRoot options

extract layers and remove whiteouts

=> Little Scala program

Steps:

18

also called squashing

Loader Benchmark (1)

Setup

: Fibonacci with recursion

script.py

• Setup:   script.py  0
• ​Total:    script.py 40

Docker image used: Alpine + Python3

19

Loader Benchmark (1)

Evaluation of the Loader's and Docker's overhead using a Python Docker image

-

Restrictions

-

Not root

kernel 2.6

20

IV

ContainerTask

• Workflow
• ContainerTask

21

Workflow (1)

transition

task

inputs

workflow:

set of:

with:

outputs

EmptyTask

ExplorationTask

ScalaTask

CARETask

files

variables

...Task

...

22

ContainerTask (1)

ContainerTask

image archive

command

execute image over variables

(Scala case class)

Design

23

ContainerTask (2)

Implementation

ContainerTask steps:

1. Merge layers

2. Build launcher

3. Prepare input files

4. Prepare PRoot wrapper

5. Execute command

6. Fetch output files

CARETask

OCI Loader

24

Conclusion

25

Goals fulfilled with:

script.py

bind

close

connect

send

close

"OK!"

script.py

bind

close

connect

send

close

"OK!"

Demo 1

same port?