Docker容器隔離

在容器裡執行top指令，會發現，它顯示的資訊是主控端的CPU和記憶體資料，而不是目前容器的資料。造成該問題的原因在于，容器通過Cgroups來為容器程序設定資源限制，但是/proc 檔案系統并不知道使用者通過Cgroups給這個容器做了什麼樣的資源限制，/proc 檔案系統不了解Cgroups限制的存在。

# 容器
[email protected]:~$ docker run -it -m 256m --memory-swap 256m centos /bin/bash
[[email protected] /]# top 檢視發現并沒有擷取到正确的資源限制
           

主控端

解決思路

主控端上執行top指令，是從/prof/stats 目錄下擷取資料，是以容器不挂載主控端的該目錄即可。lxcfs可實作該功能，它将主控端的/var/lib/lxcfs/proc/meminfo檔案挂載到Docker容器的/proc/meminfo 位置後，容器中程序讀取相應檔案内容後，lxcfs的fuse實作會從容器對應的Cgroups中讀取正确的記憶體限制，進而使應用擷取正确的資源限制。

https://github.com/lxc/lxcfs

安裝

# yum install offline
[[email protected] lxcfs-4.0.7] sudo yum install -y --downloadonly --downloaddir=/data/tzj/rpm fuse fuse-lib fuse-devel
[[email protected] lxcfs-4.0.7] sudo yum localinstall /data/tzj/rpm/*.rpm
# make
[[email protected] lxcfs-4.0.7] cd docker/lxcfs-4.0.7/
[[email protected] lxcfs-4.0.7] ./configure
[[email protected] lxcfs-4.0.7] make
[[email protected] lxcfs-4.0.7] sudo make install
# test
[[email protected] lxcfs-4.0.7]$ lxcfs -v
4.0.7
           

隔離測試

[[email protected] docker] sudo mkdir -p /var/lib/lxcfs
[[email protected] docker] sudo lxcfs /var/lib/lxcfs
sudo: lxcfs: command not found
# bash -c error too，use root users
[[email protected] docker]# lxcfs /var/lib/lxcfs
Running constructor lxcfs_init to reload liblxcfs
mount namespace: 4
hierarchies:
  0: fd:   5: name=systemd
  1: fd:   6: perf_event
  2: fd:   7: memory
  3: fd:   8: cpu,cpuacct
  4: fd:   9: hugetlb
  5: fd:  10: blkio
  6: fd:  11: net_cls,net_prio
  7: fd:  12: cpuset
  8: fd:  13: pids
  9: fd:  14: freezer
 10: fd:  15: devices
Kernel supports swap accounting
api_extensions:
- cgroups
- sys_cpu_online
- proc_cpuinfo
- proc_diskstats
- proc_loadavg
- proc_meminfo
- proc_stat
- proc_swaps
- proc_uptime
- shared_pidns
- cpuview_daemon
- loadavg_daemon
- pidfds
           

運作一個docker容器

docker run -it centos /bin/bash
           

通過lxcfs

docker run -it -m 256m --memory-swap 256m \
      -v /var/lib/lxcfs/proc/cpuinfo:/proc/cpuinfo:rw \
      -v /var/lib/lxcfs/proc/diskstats:/proc/diskstats:rw \
      -v /var/lib/lxcfs/proc/meminfo:/proc/meminfo:rw \
      -v /var/lib/lxcfs/proc/stat:/proc/stat:rw \
      -v /var/lib/lxcfs/proc/swaps:/proc/swaps:rw \
      -v /var/lib/lxcfs/proc/uptime:/proc/uptime:rw \
      centos /bin/bash