Unprivileged Container Builds at Kinvolk

Ideas you will meet

Distributed Systems

Consensus, time, failure and the fundamentals of scale-out.

Docker

Package and ship applications as containers.

Web Security

OWASP risks, XSS, CSRF, CORS and secure design.

What we already know about this

Our own lessons on these ideas. Read them here before you start, so it makes sense.

• Core Concepts: How Things Actually Work · 7 minIaaS, PaaS, SaaS, containers and serverlessWhat you manage and what the provider manages in each model, and when each one fits.Read hereClose

  The stack and who manages what

  Every application sits on layers: networking, storage, servers, virtualisation, operating system, runtime, application, data. Cloud models differ in how many layers the provider handles for you.

  Model	You manage	Provider manages	Example
  On premises	everything	nothing	your own data centre
  IaaS (infrastructure)	OS, runtime, app, data	hardware, virtualisation, network	virtual machines, block storage
  PaaS (platform)	app and data	OS, runtime, scaling	managed app platforms, managed databases
  FaaS / serverless	function code	everything else, including scaling	event-triggered functions
  SaaS (software)	your usage and settings	the whole application	email, CRM, collaboration tools

  More managed means less work and less control. Less managed means more flexibility, and more to operate.

  100%

  Figure SDA-CORE-13-1 · Who manages what in each model · © forcsguy.com

  Virtual machines and containers

  • A virtual machine emulates hardware and runs a complete guest OS. Strong isolation, heavier, slower to start.
  • A container packages an app and its dependencies and runs as an isolated process on the host's kernel. Lightweight, starts in seconds, and runs the same everywhere ("works on my machine" problems shrink).
  • Orchestrators such as Kubernetes schedule containers across machines, restart failed ones, scale and roll out updates.

  100%

  Figure SDA-CORE-13-2 · Virtual machines and containers · © forcsguy.com

  Serverless

  You provide a function; the platform runs it on demand and bills per execution. Strengths: no servers to manage, scales to zero and up automatically, and you pay for use. Limits: cold starts (first request after idle is slower), maximum run time, limited local state, and harder local testing. Best for event-driven, spiky or glue workloads.

  Choosing

  • Spiky or tiny workloads, small team: serverless or PaaS.
  • Steady high load or special needs: containers or VMs with more control, often cheaper at scale.
  • Need maximum control, compliance or custom hardware: IaaS or on premises.
  • Use managed databases and queues where you can: operating them well is hard.
  • Beware lock-in: prefer open formats (containers, standard SQL) when portability matters.

  More on this site

  Related reading

  • TechWorld with Nana: Docker & KubernetesNana Janashia · TechWorld with NanaYouTube
  • AWS Containers BlogAmazon Web Services engineers · Amazon Web ServicesBlogs
  • Awesome KubernetesRamit Surana · ramitsuranaGitHub
  • Kubernetes ConceptsKubernetes Authors · CNCF / KubernetesDocumentation

  Show 6 moreShow fewer

  • Docker BlogDocker engineers · DockerBlogs
  • Docker OverviewDocker · Docker Inc.Documentation
  • Docker Containers that Power Over 100.000 Online Shops at ShopifyShopify engineers · ShopifyCase Studies
  • Build Your Own XCodeCrafters · GitHubGitHub
  • Docker Engineering BlogDocker engineers · DockerBlogs
  • Scaling Git at Microsoft - Saeed Noursalehi, Principal Program Manager at MicrosoftMicrosoftYouTube

  Open this lesson with its quiz and exercise