Container technology is one of the solutions for microservices.
Containers and virtual machines
In the past, single application deployment usually uses virtual machines to create the operating system and dependent environment required by the application, but the virtual machines consume relatively large hardware resources. When monolithic applications are disassembled into smaller microservices, it is not cost-effective to use virtual machines. Therefore, containers with less hardware overhead than virtual machines have become an alternative microservice solution.
Containers are similar to virtual machines and can create an independent operating environment. But unlike a virtual machine, the process in the container runs on the operating system of the host machine, but the process itself feels that it is the only process in the operating system. The virtual machine needs its own system process, which consumes more system resources. Therefore, multiple monolithic applications are usually grouped and deployed in a virtual machine. Container technology allows each microservice application to run in a container separately, ultimately enabling more applications to run on the same bare metal. In addition, running a container does not require booting (running its own system service) like a virtual machine, so the process in the container can be started faster.
Container isolation scheme
The container can realize the isolation between processes through the two schemes of Linux namespace and Linux control group.
Linux namespace
In linux, multiple resource types are used:
- Mounf (mnt)
- Process ID(pid)
- Network(net)
- Inter-process communication (etc.)
- UTS
- User ID (user)
Each type of resource has a namespace to isolate the corresponding resource. For example, the UTS namespace determines which hostnames and domain names can be seen by processes running in the namespace. By assigning two different UTS namespaces to a pair of processes, they can see different local host names.
When a new namespace is created, these resources can be organized in this namespace. Programs running in this namespace can only see resources in the same namespace.
Linux Control Group
Linux control groups/cgroups is a Linux kernel function used to limit the resources that a process or a group of processes can use.
Limitations of containers
- The container does not have its own kernel, so if the kernel of the host machine and the kernel module of the container cannot match, then the container cannot run on this host machine
- The container can only run on a host machine that has the same hardware architecture as the compiling machine. For example, cheap application containers with x86 architecture cannot run on ARM architecture machines.