linux - difference between cgroups and namespaces -
i started learning docker , seems of heavy lifting done linux kernel, using namespaces , cgroups.
a few things finding confusing :
what difference between namespace , cgroup ? different uses cases address ?
what has docker implemented on top these gain popularity ?
i know internals of these features , how implemented.
the proper links 2 notions have been fixed in pr 14307:
under hood, docker built on following components:
the cgroups ,
namespaces
capabilities of linux kernel
with:
- cgroup: control groups provide mechanism aggregating/partitioning sets of tasks, , future children, hierarchical groups specialized behaviour.
- namespace: wraps global system resource in abstraction makes appear processes within namespace have own isolated instance of global resource.
in short:
- cgroups = limits how can use;
- namespaces = limits can see (and therefore use)
see more @ "anatomy of container: namespaces, cgroups & filesystem magic" jérôme petazzoni.
cgroups involve resource metering , limiting:
- memory
- cpu
- block i/o
- network
namespaces provide processes own view of system
multiple namespaces:
- pid
- net
- mnt
- uts
- ipc
- user: userns graduating experimental in docker 1.10
(per-daemon-instance remapping of container root unprivileged user in progress: pr 12648: see design)
Comments
Post a Comment