DUSTIN KIRKLAND: Hello, again.
I'm Dustin Kirkland.
I'm joined now by Yoshi Tamura, Product Manager at Google.
And we are here to talk about gVisor.
So gVisor-- brand new, just open-sourced this week
at KubeCon here in Copenhagen. Give me the highlights
of that announcement.
YOSHI TAMURA: Yes, so Google Cloud just announced gVisor.
It is a new open-source sandbox technology
for container isolation.
It is very lightweight, yet provide a very strong isolation
compared to various [INAUDIBLE] approaches.
DUSTIN KIRKLAND: Interesting.
So you said it's new.
It's new to the open-source community.
This is technology that's been in use at Google
for quite some time, right?
YOSHI TAMURA: Correct.
We have been using gVisor at Google for a while.
And we're very excited to share the technology and also
the knowledge that we gain from there.
DUSTIN KIRKLAND: Yeah, so why are we
at Google open-sourcing this project now?
YOSHI TAMURA: It is mainly because container adoption--
Docker, Kubernetes.
Now, a lot of people are using containers.
And the more people use containers,
we started seeing a lot of new use cases,
especially multi-tenancy, where there's
one cluster with different types of groups or even customers.
Now, the container isolation becomes
more important in this kind of situation.
We believe that open-sourcing gVisor, which
is a new proposal to the open-source community
could advance the technology in this container isolation space.
DUSTIN KIRKLAND: So it's really about the security.
It's about sandboxing some containers-- all containers?
Some containers?
YOSHI TAMURA: Specifically on-- you could definitely specify.
But if you specify that you want stronger isolation
for a particular container, yes, you
can actually do the [? show. ?]
DUSTIN KIRKLAND: Yeah.
And how strong is this isolation?
Is it as strong as a VM?
YOSHI TAMURA: We believe that is kind of a very closer level,
for sure.
The other aspect, I think, strong
and the lightweight part.
In our testing environment, it can
launch within 150 millisecond.
DUSTIN KIRKLAND: 150 milliseconds to launch?
YOSHI TAMURA: Exactly.
And also, the footprint is about 15 megabytes.
So it is very lightweight, and yet provide a strong isolation.
DUSTIN KIRKLAND: Super lightweight.
So compare that lightweight to, say, QMU, KVM, Kata.
YOSHI TAMURA: Yes, so there are existing approaches
like the ones that you mentioned.
You can definitely put the container
inside a virtual machine to provide
a very strong isolation.
DUSTIN KIRKLAND: OK.
Is that what gVisor is?
YOSHI TAMURA: It is actually very similar.
But if you look into the detail where you can look--
please look at the blog.
It actually highlights the key differences there.
But in a nutshell, the virtual machine,
you actually need to run, QMU [INAUDIBLE]
device [? simulate ?] and also the guest kernel.
Therefore the footprint plus also the attacking surface
is still significant enough.
gVisor took a little bit different approach,
where you trap the system calls and then provide
multiple layers of security.
This is, I think, the great part of the gVisor.
DUSTIN KIRKLAND: Yeah, interesting.
So do you actually run a kernel inside of the gVisor machine?
YOSHI TAMURA: It is a very tricky question.
So I strongly recommend going to the blog.
It's a very novel and innovative approach that I think is--
DUSTIN KIRKLAND: Sys calls are being trapped, though?
YOSHI TAMURA: Yes.
DUSTIN KIRKLAND: And those are being
executed by the host kernel.
YOSHI TAMURA: Actually, so there is a guest user LAN
kernel that will drive this.
DUSTIN KIRKLAND: Microkernel.
YOSHI TAMURA: It is not a microkernel
from a technical perspective.
Again, it's a very new approach and it's very creative.
We also reached out to the Kata container community about this.
They were also very welcome.
And as you can see in a blog post,
we also got the quotes from their team.
So I think--
DUSTIN KIRKLAND: You think there's
an opportunity for the two projects
to really come together and advance the state of the art?
YOSHI TAMURA: I think that is the most exciting part.
This feels so important for our ecosystem.
And taking different approaches is definitely
going to advance the field altogether.
So that is the most exciting part of why we're open-sourcing
and what we look for toward the future.
DUSTIN KIRKLAND: And if someone wants to get started with this,
what's the best place to get started?
So we also have, I guess, the Getting Started section
in our blog.
But, certainly, yes.
Going from GitHub, you can download the source code.
gVisor is implementing OCI.
Therefore, it runs on with Kubernetes and Docker.
So if you're interested, just go to GitHub and try out.
DUSTIN KIRKLAND: So it's another runtime
that Kubernetes supports, or will support.
YOSHI TAMURA: So the runtime itself,
[? or ?] command is call runsc, which
is where you can replace the existing runc
and drop in a replacement.
So you are familiar with those concepts,
you should be able to run it very quickly.
DUSTIN KIRKLAND: Sure.
And if I do this, can I run some containers
in the same Kubernetes with runc and some containers
at a runsc context?
YOSHI TAMURA: Right now, the Kubernetes community,
especially, [? should ?] know that we're specifying
the higher-level API [? call ?] sandbox.
So until that gets into Kubernetes,
you may have to [INAUDIBLE] some manual points to control that.
But we believe that integration is
going to come to the Kubernetes world very quickly.
DUSTIN KIRKLAND: That's great.
That's great.
So I've got a question for you.
How did you get started in Kubernetes?
YOSHI TAMURA: It's a great question.
I will say two points.
When I joined Google, I was very excited
about the internal system called Borg.
So Kubernetes, based off of Borg or derived from Borg
is some kind of a way that I got more--
I got the knowledge after getting Google.
The other aspect, which is interesting,
is before I joined the Kubernetes team,
I went to Tokyo.
One of my friends were saying, I'm using Kubernetes.
I actually didn't know about Kubernetes at that time.
So that was how I learned about Kubernetes in 2017.
DUSTIN KIRKLAND: Interesting.
And another question for you.
You're involved in the Kubernetes community.
Certainly encounter a lot of people in our very
large and open community.
Can you tell us a few of the people that inspired you,
that you find yourself working with and being super impressed,
and appreciative of?
YOSHI TAMURA: Absolutely.
A little bit hesitating to highlight my colleague
at Google, but it is definitely a truth,
so Dawn Chen has been inspiring me quite a bit.
I work with her on gVisor, and also various Kubernetes stuff.
She has a very strong and visionary technical
insight, and also very good communication.
So it's just a joy to work with her.
DUSTIN KIRKLAND: Well, great.
Yoshi, thank you very much.
YOSHI TAMURA: Thank you very much, Dustin.
DUSTIN KIRKLAND: Domo arigato.
YOSHI TAMURA: Domo arigato.