Hey friends, have you ever wondered what's going on under
the hood for serverless offerings like Azure Container
Instances? MacKenzie Olson is here to show me the latest
innovations in the infrastructure that powers ACI.
Today on Azure Friday.
Hey, friends! I'm Scott Hanselman and it's Azure Friday. I'm here with
MacKenzie Olson. How are you? I'm doing well, Scott, how about
yourself? I am living the remote dream. But I'm excited to talk to
you about ACI because you're going to tell me what's going on
underneath. 'cause from my point of view, I just spin up
containers willy-nilly and they do their jobs and then they go
away. But I don't really know how it's happening. Yeah, I'm
excited to talk to you a little bit about what's going on under
the hood here, so as you said, ACI is a serverless offering,
but that doesn't mean we don't have lots of servers and VMs.
The background working away, so today I'd like to peel back the
covers a little bit and talk about what's going on in the ACI
architecture. OK, so you've got a slide here. Absolutely. So
here we have rough outline of what our back end infrastructure
looks like, so this is what's happening when you're deploying
a container group via ACI. Here it lands basically through our
control plane onto a set of service fabric clusters were
able to support containers at a really large skill.
And our hostile multitenant
secure way. We also are have been working really on the
unifying efforts between our Windows and Linux container
story and I'm going to pull back the covers a little bit about
how we're able to do that as well. When you say hostile and
multi-tenant, that sounds not only totally awesome but also
something that I should probably ask about. But does that mean
that you, like trust no one and any container next to you could
be evil? That's basically the premise of, yeah,
hostile multitenancy. There's a little bit we
should probably cover in terms of container
isolation modes, OK?
So there are two main ways that you can isolate a container.
One is through process isolation and this is where all
containers are sharing the same kernel. You can still provide
isolation through namespacing and whatnot. But as you were
alluding to earlier, if a bad actor escapes from the
container or gets access to the host otherwise, all containers
that are running on that host are essentially vulnerable to
that attack.
On the flip side, there is also Hyper-V isolation. This is where
each container is getting their own isolated kernel, which is going
to give you essentially VM-level isolation and provides a much
more secure environment for your container. OK, but that's that's
not like big scary 30 gig VM like when I start up a virtual
machine on my local machine, right? No no, you still get the
performance benefits of standard containers. You're just getting
that extra level of security
from within. Sweet.
For on our ACI infrastructure, we're only supporting Hyper-V
isolated containers, which means you can rest assure that your
container is isolated from any other workloads, including other
container groups that you're deploying as well. OK, so this
slide that we're looking at right here is saying that these
are kinds of container isolation modes that exist in the world,
but not necessarily ones that exist on ACI. 'cause ACI is only
Hyper-V, exactly. You're only getting Hyper-V containers,
which is a good thing because it's the safest one.
Exactly, and there's nothing you have to do to your container.
It'll accept the same containers that you're running locally via
Docker is just all how we handle it on our ACI infrastructure.
Sounds awesome. Yeah.
So now that we've kind of covered the difference between
our process isolated on Hyper-V isolated containers, I wanted to
do a zoom in on ACI dataplane VM or node. If you're familiar with
Kubernetes jargon. OK. So you can see we have our ACI infra VM
an we have two different customers with containers on
here Tenant A and Tenant B an you might notice via looking at the
logos, we have a Linux container running for Tenant A and a
Windows container running for
Tenant B. All on within the same Windows VM.
So we're actually able to achieve this by using a really
cool container runtime of fork of it called containerd. Are
you familiar with that at all, Scott? I am not, but I would
like to be familiar with that. Yeah, containerd essentially is
really cool because it's abstracting away underlying the
underlying host in the sense that you can run any operating
system on top. It's driving the Runcie Binary and because of
that we're actually able to run our Linux and Windows containers
on our Windows host.
And.
It basically provides the exact same experience impact them onto
the same VMs. Oh, okay. That's pretty sweet and then reminder
just to myself, and the folks that listen that Azure is
running on Windows like that's the thing that's always so cool
to be reminded up even though these are tiny little
lightweight VM they run really
fast. The ACI you call it the infra VM. That's Windows 'cause
Azure is a big giant Windows world computer exactly. It's
really cool that we're able to line up both our Linux and
Windows containers on those on those Windows hosts. Leveraging
the work with container D. What's going on with these cows
and wows in the corner here? Yes, if you if you want to get
up to date with the acronyms here. So L cow stands for Linux
containers on Windows, so the container on the left there is
an example of that.
Windows containers on Windows host is W. Cal and we refer to
our ACI infrastructure as accepting star Cal stuff here on
Earth regex that's either Linux or Windows containers on
Windows, that's awesome. I look forward to the star cow mascot
that is sure to pop out of the show. I definitely did a double
take the first time I heard that acronym as well. OK, cool.
So how does this really impact you as an ACI customer will take
a little bit of a peek at the road map for the ACI product.
So because of our ability accepts dark, how containers
were going to be having a much more robust Windows container
story on ACI in 2021 were actually skipping a little bit
ahead looking for Virtual Network support for our Windows
containers, which we're really excited to announce. We're also
going to have support for NSF file share mounts for our Linux
containers, and most the most recent coming up release is
going to be argier of our managed identity integration.
And that managed identity. So that means the way that Azure
does identity in the way that we like go somewhere and it auto
goes into Azure AD and all that kind of stuff you're saying. ACI
will know about that natively.
So we we know about it today in a preview capacity, but we have
a couple limitations that specifically that you're not
able to run your managed identity enabled container group
in a virtual network and with the GA we're actually going to
be able to offer both of those features in conjunction, which
we're really excited about. Cool congratulations, that's cool and
then virtual network support is going to be really exciting. And
then you pointed out there early 2021 NFS file shares. This is
going to be great for Linux
friends. Exactly, yeah, we're excited. Support different type
of file share Mount for Linux container groups. OK so slides
are fun but demos are more fun.
Yes, I'm I'm excited to show you this. She manage identity in
action alright, so this is my my resource group up in Azure. I
have a couple of things going on here, all increase.
So I have a container group that's already up and running.
It's deployed inside of my virtual network. I have a
subnet delegated for my worker container. I also have a subnet
from my app gateway, which is going to be accepting traffic
and a storage cat as well. We're going to be pulling data
for my container to process.
I also have a keyboard setup because I would like to keep my
storage account credentials within there, and I've deployed
my container group to be attached to a user assigned
managed identity and that's how I'm going to be accessing the
storage blob endpoint.
So a pop into this container.
We can see it's up an running.
We have the next container here, an if we were to check in on the
properties you can see it's deployed inside my virtual
network inside of the ACI subnet that I've delegated to it.
Is it concerning that it has a 00 private IP address? No,
that's just because I I didn't assign it a specific
IP on my subnet and I didn't expose support.
And so this is another cool functionality if you haven't
used ACI on the portal before, we actually allow you to exec
into your container using this
little tool. You can also do this via the Etsy CLI as well.
So you're like SSHing into that right now exactly. I like
to say shushing. And now we're inside of our container and
the first thing I'm going to do is curl Azure Active
Directory to get my access token to my Key Vault, which
is connected to my managed identity.
Otherwise, we won't be able to gain access.
Alright, and I've stored that as a variable and I'm going to curl
in my. Key Vault I have stored both my storage endpoint and the
password but will just be curling the endpoint so that 169
endpoint that's unknown management infrastructure
endpoint, right? Yes, there are a couple different ways that you
can access AD. You can do it via curl. You can do it
programmatically. For the sake of showing you Live Today, we've
decided to just crawled out that known endpoint. I just think it
was always. I think that's the thing, like a little Azure thing
that, like some people love and know about. And some people just
don't know about like there's.
An IP address that, through the power of software, defined
networking. It's always got great information and you can
just without even being authenticated because you're in
Azure. Get information about yourself and your friends and
other things that are happening.
Exactly and you can see now that we've received that token from.
From that point we can get.
The name of our our storage blob and with that I'm able to
securely connect to it, run whatever I need within the
storage blob, all in a secure way where I have it hard put in
the credentials within the container that someone else
could access at the user assigned identity. So if this
container restarts for whatever reason, starts stops, the
identity is preserved beyond the life cycle of the container,
which is pretty cool, and again it's all running in my virtual
network, so. It's secure and not publicly exposed to the Internet
and less I would decide to connect it up to my application
gateway. Very cool. Yeah, and so we're excited. This is still in
a preview capacity and we're excited to release this into GA
this upcoming November.
Very cool, so where can people learn more about that?
So you can go ahead and look up RAC documentation will have it
hyperlink to this video and there is a tutorial that can get
you up and running with managed identities. An look forward to
the GA experience this upcoming November where will have
integration with other features like Azure Virtual Network as
well. Fantastic, I am learning all about ACI and what's
happening under the hood today on Azure Friday. Hey, thanks
for watching this episode of Azure Friday. Now I need you
to like it. Comment on it, tell your friends, retweet it.
Watch more Azure Friday.