sli.do

• #awsvmm #awsvmm #awsvmm #awsvmm #awsvmm #awsvmm #awsvmm
• #awsvmm #awsvmm #awsvmm #awsvmm #awsvmm #awsvmm #awsvmm
• #awsvmm #awsvmm #awsvmm #awsvmm #awsvmm #awsvmm #awsvmm
• 議程中有任何問題、好奇、疑問，都可以隨時丟進 sli.do
• US$25 AWS Credits 問券連結，也放在 sli.do 裡頭喔

Ernest Chiang

Worked on process integration engineering in semiconductor industry @tsmc.

Doing product and technology integration in fitness industry @pafers.

Off Work TGO Networks Taipei. AWS Community Hero. Mozillian. AIESECer.

Outline

• Problems & Solutions
• Firecracker
• Virtualization & Containerization
• Lambda & Fargate
• Firecracker & containerd
• Live Demo
  • Getting started with Firecracker in 2 Minutes
  • Creating 4,000 microVMs in 90 seconds
• Firecracker & Open Source Projects

What is Firecraker

Firecracker is an open source VMM that is purpose-built for creating and managing secure, multi-tenant container and function-based services.

What is Firecraker

Firecracker is an open source VMM that is purpose-built for creating and managing secure, multi-tenant container and function-based services.

What problem is AWS helping to solve?

What problem is AWS helping to solve?

What problem is AWS helping to solve?

Multiple functions
on multiple environments
from multiple accounts.

What is Firecracker

• Open source virtualization technology (microVM)
• Security and isolation of traditional VMs
• Speed and density of containers
• Low resource overhead
• Developed at Amazon

Benefits of Firecracker

Benefits of Firecracker

Virtualization (1/3)

In computing, virtualization refers to the act of creating a virtual (rather than actual) version of something, including virtual computer hardware platforms, storage devices, and computer network resources.

Virtualization (2/3)

Creating a virtual version of something:

• CPU
• Memory
• Device/IO (Storage, NIC)

Virtualization (3/3)

Hypervisor (1/6)

A hypervisor (or virtual machine monitor, VMM, virtualizer) is computer software, firmware or hardware that creates and runs virtual machines.

Hypervisor (2/6)

In 1974, Gerald J. Popek and Robert P. Goldberg classified two types of hypervisor:

• Type-1, native or bare-metal hypervisors
• Type-2 or hosted hypervisors

Hypervisor (3/6)

The distinction between these two types is not always clear.
For instance, Linux's Kernel-based Virtual Machine (KVM) and FreeBSD's bhyve are kernel modules that effectively convert the host operating system to a type-1 hypervisor.

Hypervisor (4/6)

At the same time, since Linux distributions and FreeBSD are still general-purpose operating systems, with applications competing with each other for VM resources, KVM and bhyve can also be categorized as type-2 hypervisors.

Hypervisor (5/6)

Hypervisor (6/6)

KVM

Kernel-based Virtual Machine (KVM) is a virtualization module in the Linux kernel that allows the kernel to function as a hypervisor.

Containerization

Operating-system-level virtualization, also known as containerization, refers to an operating system feature in which the kernel allows the existence of multiple isolated user-space instances. Such instances, called containers, partitions, virtual environments (VEs) or jails (FreeBSD jail or chroot jail), may look like real computers from the point of view of programs running in them.

Containerization

Host-facing REST API

Firecracker

• Started with a branch of crosvm
  • Removed >50% of the code
• 96% fewer lines of code than QEMU
• Simplified device model
  • no BIOS, no PCI, etc
• Apache 2.0 license

Security Models (1/2)

Security Models (2/2)

Firecracker

• In production in AWS Lambda
  • Millions of workloads
  • Trillions of requests/month

Lambda worker architecture

Lambda worker isolation

Lambda isolation comparison

Lambda isolation using Firecracker

Allocate Workloads:

More efficient:

Fargate configurations

Firecracker & containerd

• containerd to manage containers as Firecracker microVMs.
• Multi-tenant hosts
• OCI image format
• Work with popular orchestration frameworks
  • Kubernetes and Amazon ECS
• Define a future: light as container, secure as VM

OCI Image & OCI Runtime

• containerd
• runc
  • is a CLI tool for spawning and running containers according to the OCI specification.

Firecracker & containerd Architecture

Getting started with Firecracker

• Firecracker on AWS bare metal
• Firecracker on other clouds with bare metal (e.g., Packet)
• Firecracker on GCP nested-virt
• Firecracker on Azure nested-virt
• Firecracker on your dev machine (physical/nested-virt)

Getting started with Firecracker

• Firecracker on AWS bare metal
• Firecracker on other clouds with bare metal (e.g., Packet)
• Firecracker on GCP nested-virt
• Firecracker on Azure nested-virt
• Firecracker on your dev machine (physical/nested-virt)

Live Demo #1

Getting Started with Firecracker in 2 Minutes:

Firecracker on VirtualBox on macOS on Macbook Pro

https://github.com/dwchiang/firecracker-workshops/tree/master/01-getting-started

Live Demo #2

Creating 4,000 microVMs in 90 Seconds:

Firecracker on EC2 Bare Metal instance

https://github.com/dwchiang/firecracker-workshops/tree/master/02-4000-microVMs

Savings on Spot Instance

Firecracker Integration with Open Source Projects

• Kata Containers
• UniK
• OSv
• Weave Ignite

Weave Ignite

• Open source VMM with a container UX
• Combines Firecracker microVMs with OCI images
• Works using GitOps
  • ignite gitops <repo>

Who would use Firecracker?

• Teams building compute services
• Teams integrating Firecracker with container stacks
• Developers & security engineers who want to contribute

Firecracker Security Model

Community

• Cloud Native Taiwan User Group
  • Facebook: https://www.facebook.com/groups/cloudnative.tw
• AWS User Group Taiwan
  • Facebook: https://www.facebook.com/groups/awsugtw
• Taiwan CDK Meetup
  • Facebook: https://www.facebook.com/groups/cdkmeetuptw

Reference: Firecracker

• Project Homepage: https://firecracker-microvm.github.io/
• Project GitHub: https://github.com/firecracker-microvm/firecracker
• Project Roadmap: https://github.com/firecracker-microvm/firecracker/projects/13

Reference: Firecracker

• Youtube: Firecracker: A Secure and Fast microVM for Serverless Computing, 2019-0717, by Meena Gowdar (@meejamb) & Arun Gupta (@arungupta)
• Youtube: NSDI '20 - Firecracker: Lightweight Virtualization for Serverless Applications, 2020-02, by Marc Brooker at NSDI 20
  • Paper (PDF): Firecracker: Lightweight Virtualization for Serverless Applications

Reference: Firecracker

• Blog: 深度解析 AWS Firecracker 原理篇 – 虚拟化与容器运行时技术 by 莫梓元.
• Blog: 深度解析 AWS Firecracker 实战篇 – 一起动手点炮竹 by 莫梓元.
• Workshop: IGNITE YOUR FIRECRACKER WORKSHOP - AWS TKO 2020
• Workshop: Firecracker Workshop Collections
• Slide: Deep Dive into Firecracker Using Lightweight Virtual Machines to Enhance the Container Security Boundary - AWS Summit Sydney, 2019

Reference: Firecracker

• Demo: A demo running 4000 Firecracker microVMs
• Docs: Firecracker Design (firecracker-microvm/firecracker)
• Docs: Getting started (firecracker-microvm/firecracker)
• Youtube: Running AWS Firecracker in your localmachine, by Abhijith PK, 2018.

Reference: ecosystems

• Weave Ignite is an open source Virtual Machine (VM) manager with a container UX and built-in GitOps management.
  • https://github.com/weaveworks/ignite
• OSv is an open-source versatile modular unikernel designed to run single unmodified Linux application securely as microVM on top of a hypervisor, when compared to traditional operating systems which were designed for a vast range of physical machines.
  • https://github.com/cloudius-systems/osv

Reference: ecosystems

• Kata Containers is an open source project and community working to build a standard implementation of lightweight Virtual Machines (VMs) that feel and perform like containers, but provide the workload isolation and security advantages of VMs.
  • https://github.com/kata-containers/kata-containers

Reference: ecosystems

• crosvm
• rust-vmm
  ...
• Cloud Hypervisor

Reference: Virtualization

• Youtube: Linux 核心設計_發展動態回顧 (2020-05-23) by jserv
• Slide: Embedded Virtualization applied in Mobile Devices by jserv, 2012.

Open Source at AWS

• https://aws.amazon.com/opensource/

Firecracker design principles

• Multitenant
• Any vCPU and memory combination
• Oversubscription permissible
• Steady mutation rate: 100+ microVMs/host/sec
• Limited only by hardware resources
• Host-facing REST API
• Minimalist guest device model