Welcome to Microsoft Mechanics.
Coming up on the show
If you are in IT and want to understand more about
the design and architecture of containers
and how you can use them?
I am joined by Mark Russinovich
to take a look at the latest in containerization and your options.
We'll review what containers are and how they work
including the new native container technology in Windows Server 2016
and how this extends to Hyper-V and Microsoft Azure.
Microsoft Mechanics
So I am joined by Mark Russinovich, welcome. Thanks, it's good to be here.
Now container technology has been around for a while in Linux but this is something relatively
new to windows.
That is right we've been working on integrating container support into Windows Server 2016,
and you might be familiar with some of the work we've been doing with Docker to make
sure that Docker works with both Linux containers as well as Windows containers.
Yep, so to take a step back though for people who aren't familiar with what containers are
all about, help us understand just what containers are.
So most people are familiar with hardware virtualization where the operating system
creates the illusion that there's a machine in which another operating system runs. With
containers, we create the illusion or perception that there's a dedicated installation of Windows
in which the hosts the application though the application is sharing on underlying operating
system with other applications.
Ok, so this is not necessarily using Hyper-V technology the same as we have in the past
hardware virtualization this is something completely new for us.
That's right, and some people consider this a lightweight approach to application hosting
though it's not light weight in terms of necessarily
the size of the application that you want to run.
Right, so it's not restricted to very small applications.
Right.
Ok cool, so how does it work?
Yes. So Windows consist of user mode processes as well as system processes. And what we've
done in Windows Server 2016 is enlightened kernel mode so that it can support the operation
of multiple copies of or instances of user mode. We've done things like make enhancements
to the memory manager, the file system device drivers, and the scheduler. We've also added
two forms of isolation. One is namespace isolation where each container running user mode sees
its own file system and registry. And the other one is resource isolation where we can
have those processes controlled with respect to how much CPU they use, how much network
bandwidth they use and so on.
So what's the big advantage for that type of approach that isolation?
So you get a few advantages out of this one is that if you create an application and deploy
into a container because it has a very fixed environment regardless of what server it's
running on it'll run reproducibly so makes it very easy to move applications around from
server to server and make in have a high degree of assurance that they're going to work.
Ok.
The second is because they're sharing the operating system underneath these user mode
processes don't need to boot kernel mode that's already what they're going to be sharing from
the underlying hosting environment and so that means your applications going to start
up that much faster.
And you get a lot of efficiency from that if you wanted to scale out an application it
would be incredibly quick.
That's right, you get efficiency from the start up and then because there are all the
applications you put on the same host are sharing the same operating system you can
pack more applications onto that because they're sharing this.
And as a developer, I can move container images from my local workstation that I've been working
on I can push them to the cloud can put them somewhere else in the data center.
That's right my laptop which might be a little meek compared to the servers in the data center.
It is a lovely laptop, though.
And i've got other, my own development environment running on it I can take that same container
move it onto a server where they might be dozens or hundreds of other containers on
a much beefier server and again be confident that is going to work great.
Now I understand a little bit more about containers can you show us how easy it is to create a
windows server container?
Sure I'll be glad to. Now normally I do my demos, container demos, using Docker but this
time I'm going to use PowerShell.
Ok.
So the first thing I'm going to do is start container here you can see start container
and I'm going to call it CTN01 for container one.
And what's this container going to run on?
Now this containers going to run on Nano Server, which is a minimal installation of Windows
specifically optimized to host containers.
And it's a headless deployment, so you're going to have to manage that remotely.
That's right. In fact I'm gonna be using PowerShell remoting here in a second but let's just make
sure that our container launched by typing Get-Container you can see that it's there
running and now let's connect into that using PowerShell remoting, and once we're in it
I'm going to take a look around at some aspects of the environment and then were going to
compare that with what we see outside on the host which is where we're coming from.
So first thing let's to do is take a look at the IP address because each container gets
its own IP address, and you can see here that the last part of the IP address is 193 let's
remember that when we get back out to the host.
So even though it's a container, it's isolated from the namespace it can still interact with
the network.
It can. Then let's take a look at the process list this I'll highlight two things here one
is it's because it's Nano server it's a very small list of processes compared to a full
installation of Windows but the second thing let's take a look at here is this process
csrss which was one of the Windows system processes you can see its process ID is 6528,
and this csrss is specific to this container it's running inside the container, and that's
going to be interesting when we get out of the container. Let's exit it. And take a look
at those aspects of the environment from the host perspective but take a look at the IP
address here you can see we've got a different IP address of the host and when I do I get
process you'll see that the list is much much longer and if I try to filter and take a look
at just the csrss processes
that we saw in the container, and that was process ID 6528 and so that.
This will confirm with your telling the truth or not.
That's right so we can see that csrss from outside the container, but you notice that
inside the container we saw none of these other csrss.
Yep that makes sense, so it seems pretty simple and fast to create container I'm guessing
you can you can create lots of containers very quickly.
I can. I'm glad you asked because I'm going to launch five new containers of the same
type right here.
All from that same base.
All from that same base image this will just take a few seconds and now will have a total
of six containers once this command completes.
I notice one of the commands there is the switch name, virtual switch, it's using some
of the Hyper-V technology investments we've made in the platform.
Exactly that's how these containers are going to connect to the network.
Ok.
Looks like they are starting pretty quickly.
So you can see that script printed the status of each container, and that shows as off and
that's because when the script terminated those containers were starting up now you can see
that they're all running, and there is my original CTN01 and then you can see the other
five that I just launched.
But all from the same base.
All from that same base image.
Excellent, so it's generating a lot of efficiency as well using that same.
That's right. It might be an example, I've got a frontend that I need to scale out, so
I'm scaling them out dynamically.
Like a web front-end web server.
That's right.
So all that seems pretty simple and quick to create containers but you guys in Azure
must be thinking this is actually pretty cool stuff us.
It is really cool for us to be able to create applications made of containers like this,
but we also have scenarios where these types of containers don't meet our needs.
Ok.
So example of that is that we host what we call hostile multi-tenant code, and that means
code from customers that might not be friendly to us or to other customers and we need to
put that code in a very strongly isolated environment, and we've been using virtual
machines to do that, but what would be ideal is to have lightweight containers
to host that kind of code.
To get the benefit of containers but the isolation.
The benefit of isolation, yeah.
So what we've done is created Hyper-V containers which is another type of container that can
run the exact same code or images inside of them and have the strong isolation guarantees
of Hyper-V the difference between Hyper-V containers the key difference between Hyper-V
containers and Windows Server containers is it with Hyper-V containers besides being isolated
with Hyper-V they get their own optimized installation of Windows running inside of
them as the host for the single container that they run inside them as well.
So I've seen you spin up a Windows server containers, now can we see you spin up a Hyper-V container.
Sure so let's take a look. So I'm back on that same host and what I'm going to do is
stop that container that we just launched, that CTN01 we launched earlier and now that
it stopped let's take a look at the container type by doing a Get-Container, and we'll print
out the runtime type here and you can see its default.
Default Windows Server.
That's right correct what we going to do a switch the type to Hyper-V on the fly by doing
Set-Container on it and now if we do the same command to get see what type it as you can
see it switched.
Right.
To Hyper-V now when I start that container it's going to be running in that isolated
mode we just talked about so let's start it up, and you can see I'm launching the exact
same image the only change I made was to the type of the container.
So if I' a developer, I've built my app, I've containerized it; I don't have to do any extra work?
No extra work. You get the compatibility that’s a dynamic decision the deployment time decision
is whether you need that isolation or don't.
And from an IT perspective so that deployment decision might rest with them all I have to
decide is essentially that runtime type.
That's right. One example would be IT says that for compliance or regulatory reasons
we need to have this app strongly isolated we don't have to put it in its own virtual
machine we can put it in a Hyper-V container.
Ok so that's great for IT because it's no extra learning apart from that extra single
command, and it's great for the developer because they don't change their application.
So benefits all around.
So how do you know? Can we see both containers now, if you've got them?
Yeah, let's take a look at some aspects of the environment of the Hyper-V container and
then again look at what we see on the host because there is a difference from what we
saw with the Windows Server container.
Right.
So let's enter it with PowerShell and let's take a look at the process list like we did before
again this is Nano and you can see here that we've got a csrss this time its
process 8080 so let's exit that PS session go back out to the host
and this time let's just look to see if we see
if we see that process 8080 out here on the host
so here all the processes the csrss processes,
and you can see 8080 is missing from the list, and that's because that csrss is running inside
that Hyper-V environment, and it's not visible from outside of the host.
Right.
That's intentional.
Yeah.
Excellent. That demonstrates the isolation the extra level of isolation for that particular
container type. We talked about the benefits, great for IT because no change between Windows
server and Hyper-V containers from their deployment apart from the single command for the developer
no change in building application but can we see both of them together are we able to
look and distinguish them?
Yes so first what I'll show you is the fact that this isn't a virtual machine this Hyper-V
container we just launched isn't a virtual machine, and so the PowerShell virtual machine
management API's don't show it.
Right.
But if we use that Get-Container API like we did before we're going to see those six
containers the one that I just launched as well as five I created before, you see those
five I created before are Windows Server containers the default run time and then the one I just
launched it a Hyper-V container managing them exact same way.
Ok so we've covered Windows Server and Hyper-V containers but what are Azure's plans going
forward with containers.
Yeah we want to make sure that Azure is the best place to run containers and one of the
things we've done recently is announce the Azure container service which is managing
Mesos clusters we've been working with Mesosphere to make sure that Mesos can host both Linux
containers as well as Windows Server and Hyper-V containers, in addition, we're taking advantage
of Hyper-V containers with some of those multi-tenant scenarios I talked about it like Azure automation
and machine learning so customers can run their code in a much lighter weight environment
for us.
Great stuff, thanks Mark. So if you want to experience containers try the technical preview
of Windows Server today and keep checking Microsoft Mechanics Wednesdays or as news
breaks for the latest updates.
Thanks for watching.
Microsoft Mechanics
www.microsoft.com/mechanics