Container Awesome

Storage, Metadata, Runtime

• CRI
  • opencontainers/runc
  • google/gvisor
    • Apache-2.0, Go
    • Application Kernel for Containers
    • runsc
  • nvidia-container-runtime
  • containers/crun
    • GPL-2, C
    • lightweight
  • containers/youki
    • Apache-2.0, Rust
• CNI
  • Kube-router
  • Calico
  • Flannel
• CSI
• Daemon - 管理 OCI 容器、镜像
  • ContainerD
  • docker
  • podman
  • lxd
  • rkt
• Builder
  • buildkit - docker
    • support resetting timestamp for determinism #1058
  • buildah
  • Kaniko
  • genuinetools/img
    • 不需要 dockerd
    • 需要更高权限
    • 兼容 docker cli
  • apko
    • 声明式
    • 基于 alpine apk 逻辑
    • 构建依赖 apk - 非 linux 环境需要 vm
    • 辅助构建 distroless
    • 想要构建项目需要先 source -> apk
  • dockerfile
    • docker build
  • containerfile
    • podman build
    • buildah
• Source to Image
  • openshift/source-to-image
  • GoogleContainerTools/jib
    • Java to container
  • bazelbuild/bazel
  • ko
    • Golang to kubernetes
  • Skaffold
  • buildpack
• Registry Client
  • crane
  • skopeo
  • regclient/regclient
  • oras-project/oras
• Registry Server
  • habor
  • nexus
  • netvarun/docket
    • DOCKEr + torrenT
• docker/docker-credential-helpers
  • docker-credential-osxkeychain.
• Web UI
  • louislam/dockge
  • SelfhostedPro/Yacht

{
  "credsStore": "osxkeychain"
}

• cri-o
• Container Desktop/VM
  • Docker Desktop
  • podman machine
  • lima-vm/lima
    • Linux VM on macOS for running containerd
    • QEMU+HVF
    • lima-vm/sshocker 文件共享 - 反向 sshfs
    • ssh -L
  • 基于 lima
    • abiosoft/colima
      • Container runtimes on macOS & Linux
    • Rancher Desktop
  • mikrok8s
  • minikube
• weaveworks/footloose
  • Containers that look like Virtual Machines
• GoogleContainerTools/kpt
  • Automate Kubernetes Configuration Editing
• checkpoint-restore/criu
  • GPLv2, C
  • application or container live migration, snapshots, remote debugging

Image

• opencontainers/image-spec
• containerd/stargz-snapshotter
  • fast container image distribution plugin with lazy pulling
• nydus.dev
  • OCI tar layer -> Blob+meta
  • containerd/nydus-snapshotter
    • containerd snapshotter with data deduplication and lazy loading in P2P
  • dragonflyoss/nydus
    • based on FUSE,virtiofs
    • RAFS v6 - erofs over fscache - Linux 5.19+
  • dragonflyoss/Dragonfly2
    • P2P-based file distribution and image acceleration
  • d7y.io/blog/2022/06/06/evolution-of-nydus
  • dragonflyoss/nydus/docs/nydusify.md
• goharbor/acceleration-service
• google/crfs
  • CRFS: Container Registry Filesystem
  • read-only FUSE

Runtime

• drifting-in-space/spawner
  • Session-lived containers for advanced browser-based applications.
• indigo-dc/udocker
• opencontainers/runtime-spec/implementations.md

CLI

• ctr,nerdctl -> containerd
  • contaiNERD CTL
• crictl -> cri -> containerd
  • cri 是 kubelet 接口

工具

• sigstore/cosign
  • Container Signing
• plexsystems/sinker
  • 同步镜像
  • 使用 github.com/docker/docker/client 操作 docker
  • 使用 github.com/google/go-containerregistry 操作 仓库

go install github.com/plexsystems/sinker@latest
sinker push

依赖包github.com/plexsystems/sinker

target:
  host: mycompany.com
  repository: myteam
sources:
  - repository: coreos/prometheus-operator
    host: quay.io
    tag: v0.40.0

• crane
  • 基于 google/go-containerregistry 的工具
• containers/skopeo
  • remote images registries - retrieving information, images, signing content
• oras
• regclient/regclient
  • regctl
  • regbot
  • regsync
• GoogleContainerTools/container-diff
• jwilder/dockerize
• 参考
  • 构建容器的最佳做法

crane copy docker.io/wener/base:3.22 quay.io/wener/base:3.22
skopeo copy docker.io/wener/base:3.22 docker://quay.io/wener/base:3.22
regctl image copy docker.io/wener/base:3.22 quay.io/wener/base:3.22

regctl manifest digest docker.io/wener/base:3.22
# sha256:abcd
regctl manifest get quay.io/wener/base:3.22

库

• google/go-containerregistry
• uber/kraken
  • P2P Docker registry capable of distributing TBs of data in seconds
  • dragonfly2
• heroku/docker-registry-client
• Docker Registry HTTP V2
• docs.quay.io/api/swagger
• quay/quay
  • Apache-2.0, Python
• distribution/distribution
  • spec/api.md
• registry
  • docker.io -> index.docker.io
  • registry-1.docker.io
  • docker.mirrors.ustc.edu.cn
    • ustc-edu-cn.mirror.aliyuncs.com
  • fogjl973.mirror.aliyuncs.com
  • 8x40wsit.mirror.aliyuncs.com
• Docker HUB API

curl https://hub.docker.com/v2/repositories/wener/base/tags | jq

# Registry API
curl https://ustc-edu-cn.mirror.aliyuncs.com/v2/wener/base/tags/list | jq -r '.tags | .[]'

Build

问题

• 是否需要 Linux 环境
• 是否需要 Privilege 环境
• 是否需要守护进程
• 是否支持跨平台
• Manifest 支持
• 缓存支持
• 易用性

Inspect

• wagoodman/dive
• vicanso/diving
• vicanso/diving-rs
  • diving.npmtrend.com
  • dive web

docker run --rm -it \
  -v /var/run/docker.sock:/var/run/docker.sock \
  -p 7001:7001 \
  --name diving vicanso/diving

Learn

• Diving Deeper Into Runtimes: Kubernetes, CRI, and Shims
• First look at the internals of containerd and runc
• Implementing Container Runtime Shim: runc