Build Immutable OS for containers with LinuxKit

1. Anshul Patel

2. What is LinuxKit
● Toolkit for building secure, portable & lean operating system for containers.
● Built with containers, for running containers.
● All Operating system services are containers.
● Operating system services are pluggable.
● Operating system is built using Moby tool.

3. Purpose of LinuxKit
● Creates Immutable Operating Systems.
● Provides Declarative way for creating Operating Systems.
● Build the whole system in CI pipeline which guarantees reproducible builds &
reliability.
● Suitable for Cloud, VMs and Bare-Metals.

4. LinuxKit YAML config file
● Kernel - Specifies Kernel Image version and parameters
● Init - Components which will be part of initrd
● Onboot - One-off containers executed during boot. They get terminated after
execution
● Services - Long running process which will serve the incoming requests.
● Files - Copy local files to Operating System
● Trust - Components which are required to be cryptographically verified with
Docker Content Trust.

5. Example

6. Security
● Include only components which are required.
● Provides Ability to use latest Kernel.
● Containerized Operating System services, hence minimal privileges.
● Smaller attack surface.
● Immutable Infrastructure, only namespaced container data and stateful
partitions can be modified.

7. Support
Best Supported
● Hyperkit, VMware(Pro), Qemu/KVM
● GCE, Packet.net
In Progress
● AWS, Azure, Windows, BlueMix
Planned
● ARM

8. Demo

9. Ongoing/Future Developments
● Rewrite in type safe languages such as Rust.
● Blueprints/Samples for different platforms.
● Improve APIs.
● Integration with Infrakit to run cluster of instances running Kubernetes/Swarm.
● Integration with other orchestration tools like VMware VCloud Director,
Terraform.

10. Questions?
Thank You!