General operating systems integrate a large number of software and enable many services by default. Most of these software and services are not required for the container environment. Therefore, deploying container services based on a general operating system will not only increase system overhead, but also lead to environmental instability and an expansion of the security attack surface. Compared with traditional general-purpose operating systems, container operating systems are deeply tailored and optimized for container applications, providing a lightweight minimum running environment for containers. This article introduces some of China Mobile’s attempts at containerized systems and some of its achievements.
China Mobile launched the research and development of a container-customized operating system in 2017, deeply customized it based on the Big Cloud operating system BC-LINUX, and officially released version 1.0 in May of that year, named "Big Cloud Containerized Operating System". BC-LINUX is an enterprise-level general-purpose Linux operating system independently developed by China Mobile based on the CentOS open source community and leveraging the openness advantages of open source technology through customized means. Currently, nearly 20,000 units have been deployed within China Mobile. On the basis of the general system, the Dayun containerized operating system provides a streamlined container operating environment through kernel optimization and system tailoring and other technical means, improves the system's operating speed, achieves system minimization and performance optimization. as the picture shows.
To strike a balance between system ease of use and simplicity, Dayun containerized operating system cuts out irrelevant software packages and services while retaining the basic functions of the system. On the basis of providing the minimum operating environment for containers, Dayun containerized operating system ensures that common services and functions of the operating system are not missing, reduces system overhead, and reduces the difficulty of system operation and maintenance. Compared with general systems, Dayun containerized operating system The number of system software packages has been reduced from 3723 to 376, the number of services has been reduced from 254 to 143, and the installation image size has been reduced from 4.31G to 770M, as shown in the figure.
Dayun containerized operating system integrates Docker components and provides 11 mainstream open source middleware container images for out-of-the-box use. We provide version updates, security warnings, vulnerability fixes and technical support services for these 11 open source components, and regularly scan and update to fix security vulnerabilities in container images to ensure that there are no security issues in container images, as shown in the figure.
For container usage scenarios, Dayun containerized operating system provides an optimized customized kernel. The customized kernel is customized and developed based on the latest long-term support version 4.9 of the kernel community. The kernel is tailored for the container business and adds many function enhancements and performance optimizations for XFS, Btrfs and Overlayfs. The Dayun container operating system supports the overlay2 storage driver. Compared with overlay, the overlay2 of Dayun containerized operating system is more efficient in terms of inode usage. In addition, China Mobile's multiple patches for containers are added to the customized kernel, which realizes the separation of some network configuration parameters of the container and the host system, and meets the tuning needs of the container business system in high network concurrency scenarios, as shown in the figure.
The big cloud containerized system reduces the security attack surface of the system by cutting out unnecessary services. At the same time, the system has built-in security hardening software independently developed by China Mobile, which can comprehensively scan the system for security vulnerabilities and security configuration issues, provide security assessment results and repair suggestions, and can harden the system with one click and turn on the system security mode.
The customized kernel is based on the 4.9 kernel, and higher versions of the kernel have fixed many security vulnerabilities, such as the kernel privilege escalation vulnerability Dirty Cow (CVE-2016-5195). A system with this vulnerability can bypass the system's security policy in the container and obtain root permissions of the host system, and then can view, modify or even delete any files in the host, thus posing security risks to the host and other containers.
In response to the problem of business interruption caused by dynamic library and kernel upgrades in traditional upgrade methods, Dayun containerized operating system has launched hot patch technology. Hot patch technology is an online defect and vulnerability repair technology that does not affect the business. It can achieve online upgrades of dynamic libraries and kernels without interrupting services or restarting the system. It does not affect system performance and significantly improves business performance. System stability and availability.
Specifically, dynamic library hot upgrade solves the problem of dynamic library upgrade of business programs. It is suitable for dynamic library upgrade of all processes. It is simple and convenient to operate, has high reliability, and supports multiple re-entry and reverse operations, as shown in the figure. .
Kernel hot upgrade technology, based on the kernel's ftrace mechanism, dynamically adds detection points to realize online replacement of function-level execution processes. This technology allows kernel upgrades without restarting the system, minimizing system downtime. For important security vulnerabilities, Dayun containerized operating system can respond quickly. At the same time, the system supports rollback operations and can quickly restore the kernel to the state before the upgrade.
For containerized operating systems, Dayun can provide continuous system updates and technical support services, track security vulnerabilities in the operating system, especially Docker components, and issue security warnings and vulnerability update patch packages, as shown in the figure.
Since its release, the Dayun containerized operating system has been commercially promoted within China Mobile. The current deployment scale has reached nearly 200 nodes. It uses the Kubernetes container management platform and has been running stably for 6 months, supporting 5,000 containers. The product’s Safety, stability and reliability have been fully verified in the project.
The above is the detailed content of Analysis of China Mobile's container-customized Linux operating system. For more information, please follow other related articles on the PHP Chinese website!

linux设备节点是应用程序和设备驱动程序沟通的一个桥梁;设备节点被创建在“/dev”,是连接内核与用户层的枢纽,相当于硬盘的inode一样的东西,记录了硬件设备的位置和信息。设备节点使用户可以与内核进行硬件的沟通,读写设备以及其他的操作。

区别:1、open是UNIX系统调用函数,而fopen是ANSIC标准中的C语言库函数;2、open的移植性没fopen好;3、fopen只能操纵普通正规文件,而open可以操作普通文件、网络套接字等;4、open无缓冲,fopen有缓冲。

端口映射又称端口转发,是指将外部主机的IP地址的端口映射到Intranet中的一台计算机,当用户访问外网IP的这个端口时,服务器自动将请求映射到对应局域网内部的机器上;可以通过使用动态或固定的公共网络IP路由ADSL宽带路由器来实现。

在linux中,eof是自定义终止符,是“END Of File”的缩写;因为是自定义的终止符,所以eof就不是固定的,可以随意的设置别名,linux中按“ctrl+d”就代表eof,eof一般会配合cat命令用于多行文本输出,指文件末尾。

在linux中,可以利用“rpm -qa pcre”命令判断pcre是否安装;rpm命令专门用于管理各项套件,使用该命令后,若结果中出现pcre的版本信息,则表示pcre已经安装,若没有出现版本信息,则表示没有安装pcre。

linux查询mac地址的方法:1、打开系统,在桌面中点击鼠标右键,选择“打开终端”;2、在终端中,执行“ifconfig”命令,查看输出结果,在输出信息第四行中紧跟“ether”单词后的字符串就是mac地址。

在linux中,rpc是远程过程调用的意思,是Reomote Procedure Call的缩写,特指一种隐藏了过程调用时实际通信细节的IPC方法;linux中通过RPC可以充分利用非共享内存的多处理器环境,提高系统资源的利用率。

在linux中,交叉编译是指在一个平台上生成另一个平台上的可执行代码,即编译源代码的平台和执行源代码编译后程序的平台是两个不同的平台。使用交叉编译的原因:1、目标系统没有能力在其上进行本地编译;2、有能力进行源代码编译的平台与目标平台不同。


Hot AI Tools

Undresser.AI Undress
AI-powered app for creating realistic nude photos

AI Clothes Remover
Online AI tool for removing clothes from photos.

Undress AI Tool
Undress images for free

Clothoff.io
AI clothes remover

AI Hentai Generator
Generate AI Hentai for free.

Hot Article

Hot Tools

SAP NetWeaver Server Adapter for Eclipse
Integrate Eclipse with SAP NetWeaver application server.

SublimeText3 Linux new version
SublimeText3 Linux latest version

MinGW - Minimalist GNU for Windows
This project is in the process of being migrated to osdn.net/projects/mingw, you can continue to follow us there. MinGW: A native Windows port of the GNU Compiler Collection (GCC), freely distributable import libraries and header files for building native Windows applications; includes extensions to the MSVC runtime to support C99 functionality. All MinGW software can run on 64-bit Windows platforms.

WebStorm Mac version
Useful JavaScript development tools

VSCode Windows 64-bit Download
A free and powerful IDE editor launched by Microsoft
