In this talk, Michal Crosby will present on runC and Containerd, the internals and how they work together to start and manage containers in Docker. Afterwards, Arnaud Porterie will touch on about what was shipped in 1.11 and how it will enable some of the things we are working on for 1.12.

1. Wifi: DockerGuest
Password: containyourself

2. Containerd Internals

3. What is containerd?
• It is a runc multiplexer
• Manages container lifecycle operations
– signal
– pause/resume
– events
3

4. Why build it?
• Decouple container lifecycle/execution management from Docker
• Small and fast
• runc integration
4

5. How is it built?
5
• Lock-free Events
– start
– signal
– exit
– SIGCHLD

6. How is it built?
6
• Concurrency
– 200 containers + 200 workers = 54.5/s
– 200 containers + 10 workers = 71.2/s

7. How is it built?
7
• containerd-shim
– daemonless containers
– 1 shim per container
– report exit status
• fifos for STDIO
• reparent to system init

8. Docker 1.11
… and a glimpse of the future

9. Docker 1.11
• Relies entirely on containerd / runC for execution
– No more direct dependency on libcontainer
– Docker alone isn’t capable of running containers anymore ¯_(ツ)_/¯
• What does it mean for the user?
– Short answer: right now, nothing
– Still pretty cool!
9

10. Docker 1.11
10
Docker Engine
> _
containerd
runC
shim
runC
shim
runC
shim
runC
shim

11. Docker 1.11
• Focus on correctness
– No regressions on the runtime
– Without performance degradation
• Introduce the new binaries
• A first look at the new features this will enable
11
# ls -lah /usr/local/bin/docker*
-rwxr-xr-x 1 root root 34M Apr 23 03:13 /usr/bin/docker
-rwxr-xr-x 1 root root 14M Apr 23 03:12 /usr/bin/docker-containerd
-rwxr-xr-x 1 root root 11M Apr 23 03:12 /usr/bin/docker-containerd-ctr
-rwxr-xr-x 1 root root 7.0M Apr 23 03:12 /usr/bin/docker-containerd-shim
-rwxr-xr-x 1 root root 9.1M Apr 23 03:11 /usr/bin/docker-runc

12. Choosing your execution backend
• Before: Docker had a hardcoded set of supported “execution drivers”
• Future plans
– Specify your execution backend on a per-container basis
– E.g., `docker run --exec-driver=custom redis`
• A whole ecosystem of OCI-compliant backends
– runV, a hypervisor-based runtime
– runZ, an ongoing effort from Oracle based on Solaris Zones
– Clear Containers, an Intel project based on a lightweight hypervisor
12

13. Choosing your execution backend
13
Docker Engine
> _
containerd
runC
shim
runX
shim
runY
shim
runZ
shim

14. Resilience
• Container lifecycle should be independent of the daemon
– Ultimate goal: Docker should never decide on stopping a container
• Not there yet, but we’re getting closer!
14

15. Resilience
15
Docker Engine
> _
containerd
runC
shim
runC
shim
runC
shim
runC
shim

16. Resilience
16
> _
containerd
runC
shim
runC
shim
runC
shim
runC
shim
Docker Engine

17. Resilience
17
Docker Engine
> _
runC
shim
runC
shim
runC
shim
runC
shim
containerd

18. THANK YOU