Why Linux Containers Are Awesome

Rob Landley

Modern computers have over a million times the computing power of the machines Unix first ran on. Collections of processes now regularly perform tasks that once required their own dedicated machine. Efficiently managing these ever-growing systems requires new concepts, and new infrastructure. This new infrastructure is called "Linux Containers".

Containers give a collection of processes its own identity, allowing the system to treat the group as a single entity. Containers provide a place for the system to attach resource constraints and resource tracking (memory, CPU time, I/O bandwidth, etc). They also allow each group of processes to have its own view of the system, perhaps seeing only certain devices, or having their own local PIDs (with a container-local init task that reaps zombies and kills all other processes in the container when it exits), or their own network addresses and routing...

Fully deployed, the Linux containers infrstructure is used to provide much more scalable virtual environments than "Virtual Machine" approaches like KVM and Xen. The VM approach started with full isolation and worked to add efficiency, where containers started with the efficiency of chroot and worked to add isolation on top of that. Where the VM approach struggles to scale to a few dozen instances per machine with all the clever hacks paravirtualization can provide, the "chroot on steroids" approach (pioneered by the out-of-tree OpenVZ project and handled in vanilla by lxc.sourceforge.net) already scales to thousands of instances.

But the containers infrastructure has many other uses, based on selectively deploying subsets of the infrastructure to control the amount of isolation, sharing, tracking, and resource constraints. Linus's "magic patch" in 2.6.38, treating each setsid() as a new scheduler entity sharing a single measure of system resources among all its member processes, is one such imaginative use of the container infrastructure. Similar patches exist to limit disk and network I/O bandwidth, to make the OOM killer aware of process groups, and to implement checkpoint/restart and even live migration. New uses are being developed all the time.

Containers introduce a powerful new concept into the kernel: that arbitrary groups of processes can have an identity, with attributes attached. Unix always had the idea of distinguishing processes by user, but now Linux can distinguish them by anything, can create and destroy such groups on the fly, and can control how much they share, from completely changing their view of the system to merely tracking their resource usage with no other constraints or modifications.

The full ramifications of this new concept are still being explored. We don't know everything it can do yet. Let's find out.