Google Launches Managed Service for Running Docker Apps on Its Platform | Hacker News Reader

Google Launches Managed Service for Running Docker Apps on Its Platform

googlecloudplatform.blogspot.com

264 pointsferrantim60 comments

More info/docs here: https://cloud.google.com/container-engine/

I'm on the Kubernetes/GKE team and happy to answer any questions you all might have.

We also all hang out on IRC at #google-containers on freenode.

>>Because this new service is officially in alpha, you’ll need to apply for access and be whitelisted to use the service. It also means the service isn’t feature complete and the whole infrastructure could melt down at any minute.

Not sure what the take away here is other than, this may one day be a feature. No information about pricing, support, or sla. My attitude is wait and see. Should it be otherwise?

Edit: Can someone tell me why this isn't a valid question? Why the down votes?

The TechCrunch article is incorrect. While it is still an early service, there is no whitelist.

It's all open source (including kubernetes) - so worst case you move it to the cloud provider of your choice. Other than Docker / k8s being a little immature, I don't see a ton of risk.

Some google-managed base images would be helpful. The last time I checked, some of the major public docker images were still shellshock-vulnerable. Pre-installed GCE tools would be helpful. Perhaps automated environment variables about region, etc.

Which images are still shellshock vulnerable? Wasn't aware that was an issue if we stick to the docker-managed images.

Which?

See https://gist.github.com/voltagex/582473e3b86ee5ae4438 - I ran some tests on the three most popular (?) official base images.

If you have found an official Docker image that is still shellshock vulnerable, the library maintainers [1] would love to hear from you as they take that stuff quite seriously. As far as I know the entire library is fully patched.

[1] https://github.com/docker-library/official-images

As one of the maintainers in question, I'd absolutely mirror this whole statement: if any of the image upstreams have an important update available that isn't applied, we're very interested in rectifying that.

My biggest question on Docker / k8s: How does one control where persistent data lives and the required performance characteristics? Example: I need SSD + a certain level of availability? Is there a good strategy for managing this?

Right now, it isn't plumbed in but it is on the roadmap.

Either (a) you have network based block device and the master/manager maps that to a machine dynamically as the container get scheduled or (b) you constrain the containers to machines that have the hardware/data you need.

(b) is less than ideal but sometimes necessary.

Some discussion: https://github.com/GoogleCloudPlatform/kubernetes/issues/598

This is THE open question for Docker right now. The first person to actually solve it is going to be in a pretty damn good place.

Docker could make most infrastructure-level "cloud" abstraction obsolete and let people run resilient, scalable clusters on hardware pretty easily. There's CoreOS, Kubernetes, and a few others in the app-instance-scheduling space, but right now, if you want persistent data storage of any kind (block, SQL, blob, whatever) then you still need to tie things down to an individual machine or use VM-level cloud technology to acheive some semblance of fault tolerance. The inability to do persistent storage in a reasonable way is, from where I sit, the main thing keeping Docker from eating the world.

When you can run Postgres in a stable/supported way in a container on my own hardware that gets scheduled around failure/crowding/etc, you no longer needs AWS, VMWare, etc. That could be huge.

This is also what's holding me back from delving into Docker more. Love the concept, and the workflow, but trying to get my head around how the persistent data storage will work is still troubling me.

Do you see this being useful for analytical workloads (ie i need a bunch of cores for a short time to run a parallel job) or more focused on scaling web apps and services?

It can be used as both. As we build out better resource isolation and QoS, you'll be able to run mixed workload on the same hardware/VMs and use "every part of the animal".

I'm kind of confused. I get that they run on the Google VMs (which need a base OS, yes?) so does this manage all of that? Can I:

pick my vm size/ pick my docker image/ and go?

AKA does this bring me one step closer to docker-oku-aaS?

Essentially that is the case.

If you just want to launch a static set of containers on a specific VM, you can use our Container VM image -- https://cloud.google.com/compute/docs/containers/container_v....

Kubernetes (and GKE) is a dynamic system to run across a cluster of machines.

Is it possible to run a KVM VM inside one of the containers? I have an application for launching and managing VMs and letting people spin up a Google container to try it out would be neat.

GCE doesn't support nested virtualization.

But if you are running Kubernetes on bare metal, there is no reason you couldn't map in /dev/kvm and have k8s run VMs for you. I haven't done it though :)

Ok, I've done VMs inside docker already which has been fine, was hoping GCE would let me do it on Google's systems.

As someone who doesn't know, why would you want to run VMs inside of a docker container? Wouldn't this have tremendous overhead relative to just running the hypervisor?

If you use the -privileged flag, docker containers can access /dev/kvm and start low-overhead KVM instances.

It's advantageous for me, because I can say "hey check out this software" and they just have to run a single docker command, compared to installing Go, apt-getting a bunch of packages, fetching our repo, compiling, etc.

Why do you need the VM (as opposed to just containers)?

Because the software I'm attempting to demonstrate/distribute is specifically designed for running VMs. That is its sole purpose--sorta like OpenStack.

We use AWS Elastic Beanstalk for Docker deployment. Can you comment on how this is different? I see it supports multiple containers per VM - are there other significant distinguishing factors?

Elastic Beanstalk is a VM centric management framework.

Kubernetes and GKE operate at a different level. It is an API for being able to schedule and manage containers instead of VMs. At this point, k8s/GKE doesn't have an idea of an "app" any more than a VM IaaS service has an idea of an app.

Moving from a VM centric view to a container centric view improves a lot of things: * Easier to create and manage images * Portability -- images can be moved between providers. Develop on your laptop with docker/k8s and deploy the exact same container image. * More transparency into compute workload. The hosting VM or cloud can see more of what is going on in the container for monitoring and logging, etc. * More efficient/higher density -- you can run more on any piece of (virtual?) hardware * More flexible resource sharing/overcommit -- as you drive density up you can get more nuanced about what workloads take get priority.

Some of this stuff is still in its infancy -- complex resource models aren't fully supported in Docker yet -- but it is where things are going, at least based on Google's experience.

Given that this is the alpha launch of Container Engine, and the Beta launch of Autoscaling and Managed VMs, what is the anticipated timeframe for this to be ready for production workloads?

I'm assuming that there'll be a beta of Container Engine in the near future, and then a stable 1.0 launch?

Stable production ready GKE will gate on Kubernetes. Our Kubernetes roadmap is here: https://github.com/GoogleCloudPlatform/kubernetes/blob/maste...

We are driving aggressively here. I hate to put a date on it but things are converging.

Ok that's fair, but just a rough idea would be incredibly helpful.

Are we talking sometime within the next 6 months / 12 months / longer?

That roadmap document doesn't really explain how the current featureset makes Kubernetes ready for an 'alpha' release on GKE.

Tech Crunch incorrectly mentions that the service requires being added to a whitelist to use. It is available for anyone to try out immediately.

Oh interesting - you appear to be correct. You need to enable it through the APIs page then you have access.

confirmed I was able to do this (simply enable the API) on an existing project in the API Console

Oddly, I get a "only available for new customers" message, even after I enable the API.

That's because the link from the GKE page is for the free Google Cloud Platform trial ($300 credit), which is only available for new customers.

Ah, that would make sense.

Does this mean that Google feels confident in running untrusted code inside containers? Or is each container actually running in an isolated VM?

It is my understanding that Docker containers are "generally" secure (https://docs.docker.com/articles/security/). But that statement isn't enough for me to use them to power a multi-user production hosting environment.

We aren't doing multi-tenant in a VM. Instead, each user/account/project has their own set of VMs implementing the cluster.

My view is that the surface area for cgroups/kernel namespaces is just too large and isn't appropriate for hostile untrusted workloads right now.

More nuanced statement on this here: http://googlecloudplatform.blogspot.com/2014/08/containers-v...

Can someone explain the difference between Apache Mesos, Apache Spark, and Kubernetes. As someone reading just announcements, and having never experimented with any of these tools, they sound like they promise the same capabilities.

Is it just that they are different open source projects aiming for the same goal ... or are their goals different?

Apache Mesos is based on Twitter's expertise in deploying their cluster, Kubernetes on Google's. They do things in different ways. Spark seems to be in the same area as Hadoop, so not relevant to the conversation.

Yep, but there's an important difference I think...

Mesos (some customizations, but largely the same as open-source Apache Mesos) IS what Twitter uses to deploy and manage their clusters. Battle-hardened at scale running diverse production workloads.

With Kubernetes, we're told that it is built using architectural and philosophical principles proven to work at scale on Google's production systems. But it's a fairly clean-room built-from-scratch implementation and although developing quickly, is still immature and untested.

No. Apache Mesos was originally developed at the UC Berkeley AMPLab as a research project. Twitter was a very early adopter, who subsequently hired the Mesos author/creator.

In simple terms:

Apache Mesos is a distributed system that is kind of a "bottom layer" for computations and storage (whether in-memory or on disk).

Apache Spark is a distributed application that runs on top of Mesos and does computations that takes advantage of cluster computing. It can do classic MapReduce or other algorithms that you write using its API.

Kubernetes is a distributed system that runs Docker in a cluster. Docker is a way to run sandboxed applications. Kubernetes can run on Mesos.

I'll give it a shot, with the disclaimer that this explanation is based on conference talks I've seen and documentation I've read.

Spark is a successor to Hadoop, aiming to perform big distributed data crunching jobs more quickly by not limiting itself to a map-reduce paradigm and by holding more data in memory.

Apache Mesos is a resource scheduler for a cluster of machines. It is architected to be agnostic about the kind of application running on it, but I get the impression it's primarily used to make things like Hadoop and Spark run on the same cluster without stepping on each other's toes (and not used so much for long-running services like a web app). An application says to Mesos "hey I'd like to run job X", outlining the resources that it needs, and then Mesos looks at the cluster to see the best place to run the job. Mesos has some Docker integration but it's weird. Instead of launching your job and creating cgroups directly as it usually does, Mesos has to run a proxy process that talks to Docker and asks it to do it. (This is because Docker no longer has standalone mode. Which is my biggest gripe about Docker.)

Kubernetes is solving a similar problem to Mesos, how to allocate resources in a cluster to all the jobs that you might want to run on it. It's explicitly focused on "containers", though not necessarily just Docker containers. (The README at https://github.com/GoogleCloudPlatform/kubernetes makes no mention of Docker.) I get the impression it's focused more on long-running processes like web servers and less on ephemeral Hadoop-style jobs.

> and not used so much for long-running services like a web app

Mesosphere Marathon, which sits on top of Mesos, makes doing long-running services easier; it starts services, restarts them if machines crash, etc etc. Where Mesos is the resource schedular, Marathon is more like a *nix init system.

Aurora is supposed to do much the same thing, but is in Incubation at the moment. There's also "Singularity", which does a bunch of stuff including managing long-running services and one-off services through an HTTP API and webapp.

Mesos is supposed to be treated sort of as a "cluster kernel", with "frameworks" which sit on top of it and use it to schedule things. It's a lot more versatile than "I want to deploy a bunch of services" - it's more along the lines of having your own EC2 that you can request resources from on-demand.

Kubernetes also fits very well with Mesos for scheduling.

Check out https://github.com/mesosphere/kubernetes-mesos

Mesos and Kubernetes share lot of commonalities: both are useful for managing (virtual) compute resources for a given application. Primarily, as an app developer, you are interesting in specifying the required resources at a high level: 10 front end instances, 20 middle tier, and 3 back end database instances. You may not care how the resources are provisioned as long as some underlying SLA is satisfied. This is useful for boosting service uptime since in any long running service the nodes may go offline anytime and the framework will re-provision the resources automatically--often within few mins.

Mesos is useful to share resources across multiple clusters (i.e., multiple departments using Hadoop within a same organization may want to share the resources), where as Kubernetes seems to focus on container applications using docker. In addition, Mesos implements dominant-resource-fairness (DRF) scheduling, which has some nice properties [0].

Lastly, Spark is just an application running on the top of Mesos or Kubernetes. Using my earlier example, Spark and Hadoop can run in a single datacenter on the top of Mesos without statically partitioning the clusters a priori each having an illusion that they own the entire datacenter.

[0] https://www.usenix.org/event/nsdi11/tech/full_papers/Hindman...

Docker has pulled off some really impressive biz dev. I can't think of too many other things that Azure, Google Cloud, and AWS all support.

Strongly agree with this. I've been interviewing for DevOps jobs and it seems like everyone thinks they need to be using Docker for some reason or another. Studying up on it has improved my interview feedback substantially.

If you're interested, I run a team at Docker and would love to chat :P

Pretty sure we're gonna see a similar offering from AWS in a week.

AWS released PaaS docker support 7 months ago: http://aws.amazon.com/blogs/aws/aws-elastic-beanstalk-for-do...

Something more is coming soon, though: https://twitter.com/jeffbarr/status/529493907839533056

Hi Joe, I guess you folks are not running containers from customers side-by-side in the same host. So if I scale up my cluster size while I have containers deployed, do you folks rebalance the load on the host machines on the fly (by stopping/relocating some containers) or do you rebalance the new containers?

Correct -- we don't do multi-tenant on the same VM. The security just isn't there in our minds.

We don't do rebalancing/rescheduling/repacking yet. Those are the types of things that we will be working on moving forward.

this is great news, esp. with the $100K google is giving to qualified startups!

I hope this have the ripple effect of allowing enterprises to feel comfortable using things like Firebase and Docker. I floated the idea of using Docker but the idea was turned down because we have no idea how it affects performance in a production environment.

Anyone know if there are plans for auto-resizing of replicas or clusters based on alarms, along the lines of AWS autoscaling?

Can we ban techcrunch please? http://googlecloudplatform.blogspot.com/2014/11/google-cloud...

pg has mentioned in the past that he would like to ban techcrunch, but couldn't do so because they provide so much coverage of his startups.

Submissions from bullshit SV news sites is the price you pay for using a site that primarily exists as a marketing exercise.

Note that 'lower quality' sites about other sections of the tech industry have been banned for years (appleinsider, winsupersite etc).

We're unlikely to ban TechCrunch, but are happy to change urls to more substantive articles when you and other users point them out.

(We changed the URL from http://techcrunch.com/2014/11/04/google-launches-managed-ser...)

Reply on news.ycombinator.com