don’t talk to strangers: test isolation with containers

Don’t talk to strangers

Test isolation with containers

Hristo Iliev, Georgi Sabev | SAP Labs 18-19 November, Sofia

Hristo Iliev

ISTAcon.org 18-19 November, Sofia

SAP

• NetWeaver Application Server Java

• SAP HANA Cloud Platform

Open Source

• Eclipse Virgo

• Cloud Foundry (Diego & Abacus)

Georgi Sabev

ISTAcon.org 18-19 November, Sofia

SAP

• SAP HANA Cloud Platform

Open Source

• Cloud Foundry (Diego & Abacus)

PicturesCreative Commons @ Flickr

ISTAcon.org 18-19 November, Sofia

Creating Working Software

ISTAcon.org 18-19 November, Sofia

Tests

Automation

Discipline

Problems

ISTAcon.org 18-19 November, Sofia

Test Pollution

ISTAcon.org 18-19 November, Sofia

Environment variables

Database records

Files

Programs / libraries

Resource contention

ISTAcon.org 18-19 November, Sofia

Processes compete for

• CPU

• Memory

• I/O

Multiple environments

ISTAcon.org 18-19 November, Sofia

OS

Mobile / Desktop

Cloud / Standalone

Databases

Versions

Test problems summary

ISTAcon.org 18-19 November, Sofia

Test pollution

Resource contention

Multiple environments

Solutions

ISTAcon.org 18-19 November, Sofia

Traditional

• Dedicated hardware

• Virtual machines

• Cloud: AWS, Azure

New tools

Containersbuild, isolate, ship

ISTAcon.org 18-19 November, Sofia

Container: Resource isolation

Tenant 1 Tenant 2 Tenant 3

Pro

cess

A

Pro

cess

B

Pro

cess

C

Pro

cess

D

Pro

cess

E

Pro

cess

F

CPU

Kernel

ISTAcon.org 18-19 November, Sofia

Container: Resource isolation

Tenant 1 Tenant 2 Tenant 3

Pro

cess

A

Pro

cess

B

Pro

cess

C

Pro

cess

D

Pro

cess

E

Pro

cess

F

Kernel

A FEDCB

ISTAcon.org 18-19 November, Sofia

Container: Resource isolation

Tenant 1 Tenant 2 Tenant 3

Pro

cess

A

Pro

cess

B

Pro

cess

C

Pro

cess

D

Pro

cess

E

Pro

cess

F

CPU

Kernel

A FEDCB

ISTAcon.org 18-19 November, Sofia

Container: Resource isolation

Tenant 1 Tenant 2 Tenant 3

Pro

cess

A

Pro

cess

B

Pro

cess

C

Pro

cess

D

Pro

cess

E

Pro

cess

F

CPU

Kernel

A FEDCB

Linux Kernel

ISTAcon.org 18-19 November, Sofia

Container: Namespace isolation

Tenant 1 Tenant 2 Tenant 3

Pro

cess

A

Pro

cess

B

Pro

cess

C

Pro

cess

A

Pro

cess

A

Pro

cess

B

PID, Network, Mount, User

Kernel

ISTAcon.org 18-19 November, Sofia

Containerization = Lightweight Virtualization

ISTAcon.org 18-19 November, Sofia

Operating System

Hypervisor

Virtual Machine

Operating System

Bins / libs

App App

Virtual Machine

Operating System

Bins / libs

App App

Container Daemon

Container

Bins / libs

App App

Container

Bins / libs

App App

Virtualization Containerization

Operating System

Hardware Hardware

Container

?

ISTAcon.org 18-19 November, Sofia

Container

ISTAcon.org18-19 November, Sofia

Network

User

cgroups

PID

Isolation

Container

+

Content

ISTAcon.org18-19 November, Sofia

Network

User

cgroups

PID

Isolation

Container

++

Content Processes

ISTAcon.org18-19 November, Sofia

Network

User

cgroups

PID

Isolation

Container

Network

User

cgroups

PID

ISTAcon.org 18-19 November, Sofia

Container actions

Make me a container

ISTAcon.org 18-19 November, Sofia

Container actions

Put this in itMake me a container

ISTAcon.org 18-19 November, Sofia

Container actions

Put this in it Run this for meMake me a container

ISTAcon.org 18-19 November, Sofia

Docker

ISTAcon.org 18-19 November, Sofia

“Build, Ship, Run” Containers

• Dockerfile

• Docker image

• Docker Hub

Logos

ISTAcon.org 18-19 November, Sofia

Docker

Linux

Go lang

Demo

ISTAcon.org 18-19 November, Sofia

https://github.com/hsiliev/strangers

ISTAcon.org 18-19 November, Sofia

Containers: Pros & Cons

ISTAcon.org 18-19 November, Sofia

Pros

• Isolation

• Reproducible environment

• Easy to maintain

Cons

• Multi-platform

• Discipline

Software Production

ISTAcon.org 18-19 November, Sofia

Complexity

Tests

Automation

PipelinesMultiple-builds

ISTAcon.org 18-19 November, Sofia

Popular solutions

ISTAcon.org 18-19 November, Sofia

Build servers

Jenkins

Travis

…

Homegrown

ConcourseCI, Pipelines, Delivery

ISTAcon.org 18-19 November, Sofia

Concourse

ISTAcon.org 18-19 November, Sofia

Reproducible builds

Simple building blocks

Docker containers

Concourse: Concepts

ISTAcon.org 18-19 November, Sofia

Resources

Tasks

Jobs

Build Job

ConfigureMakeInstall

Source Binary

Concourse: Pipeline

ISTAcon.org 18-19 November, Sofia

resource

jobvalidated resource

Demo

ISTAcon.org 18-19 November, Sofia

https://github.com/hsiliev/strangers

ISTAcon.org 18-19 November, Sofia

Concourse: Pros & Cons

ISTAcon.org 18-19 November, Sofia

Pros

• Reproducible environment

• Native pipeline support

• Release process modeling

Cons

• Maturity

• Scripting

Q&AISTAcon.org 18-19 November, Sofia

Thank you!

hristo.iliev@sap.com

georgi.sabev@sap.com

Hristo Iliev, Georgi Sabev | SAP Labs 18-19 November, Sofia