Kernel

Userland

Rings

Gates

Instructions

Privileged Instructions

Ring System

Kernel

Software that talks directly with your hardware

Userland

Everything not in the kernel

A mechanism to protect data and functionality from errors and malicious behaviour

Rings

Allows communication between outer and inner rings

Gates

Statements that run directly on your CPU

Instructions

Priviledged Instructions

Statements that run directly on your CPU

that can only be called from the kernel

The Monastary Metaphor

• Neighborhoods
• Monastery Gates
• Villagers 
• Monk

= Rings

= Gates

= Instructions

= Privileged 

     Instructions

The Monastary Metaphor

Monks (privileged instructions) can never leave the monastery (ring 0, kernel land) and can only be addressed in the monastery. 

Villagers(instructions) from the neighboring settlement (userland) may come to and from the monastery (ring 0, kernel land).

Virtualization

What is Virtualization?

The creation of simulated resources to logically separate execution environments.

Why Virtualize?

• Non-homogenous environments
• Security
• Flexibility
• Partitioning of Resources

Types of Virtualization

1. Hardware Virtualization
2. Operating System Level Virtualization

When someone says virtualization, they mean Hardware Virtualization

Hardware Virtualization

Can run multiple virtual computers under a physical one.

Hardware Virtualization

• The Kernel no longer gets direct access to hardware
• A hypervisor gets access instead 

Hosts

Underlying hardware that

provides shared computing resources

Guests

Secondary computers whose hardware is really provided by software running on the host

Hardware Virtualization

Can run multiple virtual computers under a physical one

Virtualization History

• Virtualization

  Theory:     1959
  Practice:   1966

• Paravirtualization

  Theory:    1959
  Practice:  1974

• Binary Translation 

  Theory:    1963
  Practice:  1974

• Hardware Virtualization

  Theory:    1959
  Practice:  1972

A Very Short List of Unvirtualizable Things

• The Intel x86 Architecture

Containerization

Single Kernel, Multiple Userlands

But they have to be the same

"Operating System-Level virtualization"

• Uses the underlying OS
  • Creates siloed userlands
  • ​Kernel and Hardware are shared
• Requires OS Level Support
  • Host Kernel must have support 
• Usually runs the same userland as a master

Containerization History

• Containerization

  Theory:   1974
  Practice: 1982

• "Multiple Userlands"
  Theory:   1960
  Practice: 1966

Containerization

vs Virtuzaliztion

Hardware Virtualization

Containerization

Pros

• Fast
• No full Operating System

Cons

• Requires Homogenous Operating System
• Easier to break out when being exploited
• No hardware support

Overview

Docker Basics

• Uses a series of subcommand options
• Helps solve configuration issues

How Do I Docker?

• Create a docker Image
  • A layered filesystem
  • Contains metadata on the underlying Operating System 
• In programming terms:
  • Class = Docker Image 
  • Object = Container

Docker History

• Not a new idea
  • Most of the components are at least 10 years old
• Why is it so popular now?
  • Recent tools have made it usable

Docker internals

• Kernel Namespaces to create siloed userlands
  • similar to BSD Jails 
• Uses Linux built-ins
  • CGroups- to manage resources
  • Capabilities- Containerization version of rings
  • ​Layered FS (AUFS) - Git for filesystems

The Good

• Shipping applications is easier
• Ships with dependencies
• Can simply send an image to send a working app
• Image can be easily copied for debugging
• Adds a small level of security

The Bad

• Logging is problematic
• Doesn't work well with SELinux
• Requires root to manage
• Has resource management issues
• Container exploits as are bad as on-metal exploits
• Requires the same OS

Mythology

MYTH: Hardware Virtualization is going away

• Likely to lose focus in the next few years

• Some systems are easier to virtualize via hardware than software

• Additional layer makes it difficult for suspected bad-actors to interact with other systems

MYTH: Hardware Virtualization has terrible performance

• Not as performant as bare-metal or containerization 
  • "Good enough"
• Hardware support for virtualization is promising

MYTH: Containerization is slow

• Docker initially had speed problems due to the filesystem type involved
• Is largely solved today

MYTH: Containerize all the things!

• Popular as a new hot technology
• Makes sense in many scenarios
• Doesn't make sense in others
  • Not for Databases
  • Not for minimal SSH

MYTH: Containerization is just as secure as Virtualization

• There's no simple answer in reality
• In Theory, Virtualization is more secure
  • It has extra layers and potential hardware support

MYTH: Dockers means no more DevOps

• Docker allows for easier deployment and dependency 
• Someone still has to manage:
  • Hardware
  • Network
  • Monitoring
  • Logging 

Review

• Rings
• Virtualization
• Containers
• Docker

Rings

Protect data and functionality from faults (by improving fault tolerance) and malicious behaviour 

Virtualization

The creation of simulated resources to logically separate execution environments

Hardware

Virtualization

Lets you run multiple virtual computers under a physical one

Containers

Uses the underlying OS to create siloed userlands

Docker

Configuration tool that allows the deployment of containers via cgroups and kernel namespaces