CLOUD COMPUTING

Lightweight virtualization – Containers, namespaces, cgroups

&
Deployment of cloud native applications through Docker, UnionFS

Dr. Prafullata Kiran Auradkar

Department of Computer Science and Engineering

Acknowledgements:
Significant information in the slide deck presented through the Unit 2 of the course have been created by Dr. H.L. Phalachandra and would like to acknowledge and
thank him for the same. There have been some information which I might have leveraged from the content of Dr. K.V. Subramaniam’s lecture contents too. I may have
supplemented the same with contents from books and other sources from Internet and would like to sincerely thank, acknowledge and reiterate that the credit/rights for
the same remain with the original authors/publishers only. These are intended for classroom presentation only.
 CLOUD COMPUTING
Containers – Definitions

▪ Linux Containers or LXC is an operating-system-level virtualization method for running multiple isolated
Linux systems (containers) which can run multiple workloads, on a control host running a single linux OS
instance
▪ LXC provides a virtual environment that has its own process and network space and does not create a full-
fledged virtual machine.
▪ LXC uses Linux kernel cgroups and namespace isolation functionality to achieve the same.
Motivation
▪ VMs support the objective of virtualizing the physical systems and allowing multiple tenants/applications
to be isolated and share the physical resources along with Access control
▪ One of the challenges as observed is, this isolation achieved by or provided by VM is expensive
▪ Traditional OSs supporting multiple application processes, but share a disk, with all the processes capable
of seeing the entire filesystem with access control built on top, and also share a network.
▪ Containers using a light weight mechanism, provide this virtualization extending the isolation provided by
our traditional OS Lxc (tools) is an user space toolset for creating & managing Linux Containers – different from LXC Linux containers
CLOUD COMPUTING
Container Characteristics

▪ Containers sit on top of a physical server and its host OS.

▪ Each container shares the host OS kernel and, usually, the binaries
and libraries too, but as read-only. This reduces the management
overhead where a single OS needs to be maintained for bug fixes,
patches, and so on.
▪ Containers are thus exceptionally “light”—they are only megabytes
in size and take just seconds to start, versus gigabytes and minutes
for a VM.
▪ Container creation is similar to process creation and it has
speed, agility and portability.
▪ Thus containers have higher provisioning performance
CLOUD COMPUTING
Containers (Cont.)

A basic computer stack

running two programs
that were started from
the command line

• Notice that the command-line interface, or CLI, runs in what is called user space
memory, just like other programs that run on top of the operating system.
• Ideally, programs running in user space can’t modify kernel space memory.
• Broadly speaking, the operating system is the interface between all user programs
and the hardware that the computer is running on.
CLOUD COMPUTING
Contrasting Containers vs VMs

1. Each VM includes a separate OS image, which adds

overhead in memory and storage footprint.
Containers reduce management overhead as they share a
common OS, only a single OS needs to be maintained for
bug fixes, patches, and so on.
2. In terms of performance, VMs have to boot when provisioned
making it slower, and also have I/O performance overhead
Containers have higher performance as its creation is similar
to process creation, so boots quickly and it has speed, agility
and portability
3. VMs are more flexible as Hardware is virtualized to run
multiple OS instances.
Containers run on a single OS and also can support only
Ubuntu containers of that type of OS where its running or
containers cannot be of different OS variants
4. VMs consume more resources and come up slower than Containers which come up more quickly and consume fewer
resources
CLOUD COMPUTING
VM vs Docker

More resource usage Less resource usage

CLOUD COMPUTING
Docker

▪ Docker is an open platform tool which makes it easier to create, test,

ship, deploy and to execute applications using containers.
▪ Docker containers allow us to separate the applications from the
infrastructure enabling faster deployment of applications/software
▪ It significantly reduces the time between writing code and running it in
production by providing methodologies for shipping, testing and deploying code quickly
▪ It can be considered as a tool that helps to package and run an application in a loosely
isolated environment called a container.
▪ It could be looked at as a PaaS product that uses OS level virtualization to deliver S/W
packages
▪ Docker provides the isolation and security to allow many containers to run on a single server
or virtual machine
▪ Its typical to find between 8 -18 containers running simultaneously on a single server/VM
CLOUD COMPUTING
Docker (Cont.)

▪ Containers created using Docker can contain everything needed to run an application, so
you do not need to rely on what is currently installed on the host system
▪ Docker allows these containers to be shared in a way that it would work identically.
▪ Docker can be used with network applications such as web servers, databases, mail servers,
with terminal applications like text editors, compilers, network analysis tools, and scripts.
▪ In some cases, it’s even used to run GUI applications such as web browsers and
productivity software.
▪ Docker runs on Linux software on most systems.
▪ Docker is also available as a native application for both macOS and Windows
▪ Docker can run native Windows applications on modern Windows server machines.
CLOUD COMPUTING
Docker Benefits

Portability, Shipping Applications Portability

Developers use Version Control Systems (VCS) like Git. DevOps also uses VCS for docs, scripts and Dockerfiles.
DevOps could use Dockerfile to describes how to build the image, and something like [Link] to describe how to orchestrate them.
CLOUD COMPUTING
Docker Architecture

▪ Docker uses a client-server architecture.

▪ The Docker client talks to the Docker daemon, which does the heavy lifting of building, running, and
distributing your Docker containers.
▪ The Docker client and daemon can run on
the same system, or you can connect a
Docker client to a remote Docker daemon.
▪ Docker client and daemon communicate
using a REST API, over UNIX sockets or a
network interface.
▪ Another Docker client is Docker Compose,
that lets you work with applications consisting
of a set of containers.

Reference:[Link]
CLOUD COMPUTING
Docker Architecture

The Docker daemon

▪ The Docker daemon (dockerd) listens for Docker API
requests and manages Docker objects such as images,
containers, networks, and volumes.
▪ A daemon can also communicate with other daemons to
manage Docker services.
The Docker client
▪ The Docker client (docker) is the primary way that many
Docker users interact with Docker.
▪ When you use commands such as docker run, the client sends these commands
to ’dockerd’ (docker daemon), which carries them out.
▪ The docker command uses the Docker API.
▪ The Docker client can communicate with more than one daemon.
CLOUD COMPUTING
Docker Architecture

Docker Host
▪ Docker Host has the Docker Daemon running and can host (like a private hub/registry) or connect
(like to a public docker_hub/registry) to a Docker Registry which stores the Docker Images.
▪ The Docker Daemon running within Docker Host is responsible for the Docker Objects images and
containers.
Docker Objects :
There are objects like
▪ Images
▪ Containers
▪ Networks
▪ Volumes
▪ Plugins and other objects which are created and used while using docker.
CLOUD COMPUTING
Docker Objects : Images

Images : This is a read-only template with instructions for creating a Docker container. This could be
based on another image (available in the registry) with additional customizations. Eg. Image for a
Webserver .. Original image of Ubuntu customized with installation and configuration of the
webserver which is created only as a read-only image which can be deployed and an application can
be run in the same.
This is done using a Dockerfile a script file which defines the syntax to indicate steps needed to
create the image (and run using a run command).
Each instruction in a Dockerfile creates a layer in the image.
These Dockerfiles are distributed along with software that the author wants to be put into an image.
In this case, you’re not technically installing an image. Instead, you’re following instructions to build
an image.
CLOUD COMPUTING
Docker Objects : Images – More on Dockerfile
▪ Distributing a Dockerfile is similar to distributing image files using your own distribution mechanisms. A
common pattern is to distribute a Dockerfile with software from common version-control systems like Git.
• If you have Git installed, you can try this by running an example from a public repository:
o git clone [Link]
o docker build -t dia_ch3/dockerfile:latest ch3_dockerfile
In this example, you copy the project from a public source repository onto your computer and then build and
install a Docker image by using the Dockerfile included with that project. The value provided to the -t option
of docker build is the repository where you want to install the image.
▪ Building images from Dockerfile is a light way to move projects around that fits into existing workflows. Could
lead to an unfavourable experience in case of a drift in dependencies between the time when the Dockerfile
was authored and when an image is built on a user’s computer.
▪ Docker Images can be removed or cleaned up with
o docker rmi dia_ch3/dockerfile
o rm -rf ch3_dockerfile Docker Commands – Video Ref: [Link]
CLOUD COMPUTING
Docker Objects : Images - layers

▪ Specification for a Docker Image is stored in Dockerfile

• Should be only one for a container
• Only the definition of the image
▪ Image is built from Dockerfile
▪ Specifies the read-only file systems in which various programs
are installed E.g. web server + libraries
▪ Each instruction in a Dockerfile creates a layer in the image.
▪ A layer is set of files and file metadata that is packaged and
distributed as an atomic unit.
• Internally, Docker treats each layer like an image, and layers are often called intermediate images.
• You can even promote a layer to an image by tagging it.
• Most layers build upon a parent layer by applying filesystem changes to the parent.
• Whenever there is a change in the Dockerfile and the image is rebuilt, only the incremental changes are
rebuilt (making it light weight, small and fast when compared to other virtualized technologies)
CLOUD COMPUTING
Docker Objects : Images & Docker Registries
▪ Image + temporary R/W file system
• Used as temporary storage
• Deleted when container is destroyed
▪ Multiple containers can use the same image & their own
temporary storage
Docker registries:
• A Docker registry stores Docker images.
• Docker Hub is a public registry that anyone can use, and
Docker is configured to look for images on Docker Hub by
default.
• You can even run your own private registry.
• When you use the docker pull or docker run commands, the
required images are pulled from your configured registry.
• When you use the docker push command, your image is
pushed to your configured registry.
[Link]
CLOUD COMPUTING
Docker Objects : Containers

▪ Docker Containers are the ready applications created from Docker Images.
Or you can say they are running instances of the Images and they hold the
entire package needed to run the application Or it could also be looked at
as a runnable instance of an image Or an execution environment (sandbox).
▪ We can create, start, stop, move, or delete a container using the Docker API or CLI.
▪ A container can be connected to one or more networks. Storage could be attached to it, or even new image
could be created based on its current state.
▪ A container is relatively well isolated from other containers and its host machine and this isolation can also
be controlled. Processes in the container cannot access non-shared objects of other containers, and can only
access a subset of the objects (like files) on the physical machine.
▪ Docker creates a set of name spaces when a container is created. These namespaces restrict what the
objects processes in a container can see e.g. a subset of files
▪ A container is defined by its image and the configuration options provided to it when its created or started.
When a container is removed, any changes to its state that are not stored in persistent storage will disappear
 CLOUD COMPUTING
Docker running three containers on a basic Linux computer system

▪ Running Docker means running two

programs in user space.
• The first is the Docker engine that
should always be running.
• The second is the Docker CLI. This is the
Docker program that users interact
with to start, stop, or install software
▪ Each container is running as a child process
of the Docker engine, wrapped with a
container, and the delegate process is
running in its own memory subspace of the
user space.
• Programs running inside a container Docker can be looked at as a set of PaaS products
that use OS-level virtualization to deliver software in
can access only their own memory and
packages called containers.
resources as scoped by the container.
CLOUD COMPUTING
Running a program with Docker

▪ What happens after running

docker run
▪ The image itself is a collection
of files and metadata which
includes the specific program
to execute and other relevant
configuration details

▪ Running docker run a

second time.
▪ The image is already
installed, so Docker can start
the new container right
away.
CLOUD COMPUTING
Namespaces – What’s in a Name in CS?

▪ If you can’t name an object, you can’t access it. E.g. Web site – if name is hidden, can’t access
▪ Paging : Processes can access only pages in its name spaces but cannot access physical page 1 (i.e. frame number 1 in
the diagram)
▪ Namespaces are a feature of the Linux kernel that partitions kernel resources such that one set of
processes sees one set of resources and another set of processes sees a different set of resources.
▪ A namespace wraps a global system resource in an abstraction that makes it appear to the processes within the
namespace that they have their own isolated instance of the global resource
▪ The feature works by having the same namespace (with a name) for a group of resources and
processes, but those namespaces refer to distinct resources
▪ A physical computer can have more than one namespaces (two or more)
▪ All the resources that a process sees can be considered a namespace
• The files seen by a process is the file namespace
• The network connections are part of network namespace
• Container Access is restricted to only subset of objects (e.g., files) on the physical machine using
these namespaces. Restriction is applied on what can be seen by the object processes in a container e.g.
• To restrict process (and container) to a subset of files use file namespace
 CLOUD COMPUTING
Docker used Namespaces
▪ Docker builds containers at runtime using 10 major system features. Docker commands can be
used to illustrate and modify features to suit the needs of the contained software and to fit the
environment where the container will run.
▪ The specific features are as follows (a few of them are discussed in a little more detail):
• PID namespace—Process isolation through identifiers (PID number) – not aware of what
happens outside its own processes
• UTS namespace—allows for having multiple hostnames on a single physical host - Host and
domain name (as other things like IP can change)
• MNT namespace—isolate a set of mount points such that processes in different namespaces
cannot view each others files. (almost like chroot) (Filesystem access & structure)
• IPC namespace—provides isolation to container process communication over shared
memory and having an ability to invite other processes to read from the shared memory
[Link]
CLOUD COMPUTING
Docker used Namespaces (Cont.)

• NET namespace—allow processes inside each namespace instance to have access to a new
IP address along with the full range of ports - Network access and structure
• USR namespace—provides user name-UID mapping isolating changes in names from the
metadata within a container
• chroot syscall—Controls the location of the filesystem root
• cgroups—Controlling and accounting resources –rather than a hierarchical cgroup creation,
there is a new cgroup with a root directory created to isolate resources and not allow
navigation
• CAP drop—Operating system feature restrictions
• Security modules—Mandatory access controls

[Link]
CLOUD COMPUTING
Access Control of objects : Illustration of name space (in this case MNT)

• Processes Container 1 Container 2

• in container 1 can access
• Shared files in /usr
• Non-shared /mnt
/
• Cannot access /mnt2
• in container 2 can access mnt usr mnt2

• Shared files in /usr bin src

• Non-shared /mnt2
• Cannot access /mnt
dir1 dir2 Dir3
• These are two different namespaces
CLOUD COMPUTING
Linux Filesystems before Namespaces

• / is the root file system

• Contains vmunix – the OS
• usr, bin, src are all subdirectories

• O1, O2 are volumes containing /

different versions of an application
mnt usr mnt2
(e.g., Oracle)
• Mounted at /mnt and /mnt2 bin src
O1 O2
• This namespace is visible to all
processes
dir1 dir2 Dir3
• Access to files and directories
controlled by access rights
CLOUD COMPUTING
Linux Filesystems after Namespaces

• File namespace: mount namespace

• O1, O2 are volumes containing different versions
of an application (e.g., Oracle)
• Mounted at /mnt and /mnt2
• This namespace is visible to all processes /

• Access to files and directories controlled by mnt

mnt usr
2
access rights
bin src
• Which namespace is process in? O1 O2
• Look at /proc/pid/ns
• ls –l for /proc/pidx/mnt may show as below
(4026531840 is the namespace id) dir1 dir2 dir3

• lrwxrwxrwx. 1 mtk mtk 0 Jan 8 04:12 mnt -> mnt:[4026531840]

CLOUD COMPUTING
Illustration of Namespace Operations : E.g. MNT Namespace

Creation of Namespace Programs to be joining into a namespace

• To create a namespace, must create a Allows program to join an existing namespace
process with that namespace int setns
• pid = clone(childFunc, stackTop, • (int fd, // namespace to join
CLONE_NEWNS | SIGCHLD, argv[1]); • int nstype); // type of ns
• Creates a new child, like fork()
• NEWNS flag indicates that child has a new int unshare (int flags); // which namespace
mount namespace • CLONE_NEWNS specifies mount namespace

• Child can do mount and umount to modify • Similar to clone(); allows caller to create a new
namespace
namespace
CLOUD COMPUTING “global” (i.e.
root) namespace
UTS (Unix Time Sharing) Namespace UTS NS

globalhost
• Per namespace [Link]

• Hostname
• NIS domain name (Network Information Service)
“green”
• Reported by commands such as hostname namespace
UTS NS
• Processes in namespace can change UTS values – only reflected
in the child namespace greenhost
[Link]
• Allows containers to have their own FQDN (Fully qualified
Domain Name)
“red”
namespace
UTS NS
UTS namespace is about isolating hostnames.
The UTS namespace is used to isolate two specific elements of the system that redhost
[Link]
relate to the uname system call.
The UTS(UNIX Time Sharing) namespace is named after the data structure used to
store information returned by the uname system call.
CLOUD COMPUTING
NET namespace
“global” (i.e. root)
• It’s a virtual network barrier encapsulating a process to isolate its namespace
NET NS
network connectivity (in/out) and resources (i.e. network interfaces, lo: UNKNOWN…
eth0: UP…
eth1: UP…
route tables and rules) from linux core and other processes. br0: UP…

app1 IP:5000
• It allow processes inside each namespace instance to have access to app2 IP:6000
app3 IP:7000

per namespace network objects “green” namespace

• Network devices (ethernets)

NET NS

lo: UNKNOWN…

• Bridges
eth0: UP…

app1 IP:1000

• Routing tables
app2 IP:7000

• IP addresses “red” namespace

• ports NET NS

lo: UNKNOWN…
• Various commands support network namespace such as ip eth0: DOWN…
eth1: UP

app1 IP:7000
app2 IP:9000
 CLOUD COMPUTING
NET

▪ A VETH (virtual Ethernet) configuration as shown can be used when namespaces need to communicate to the
main host namespace or between each other.
▪ veths – create veth pair, move one inside the namespace and configure
▪ Acts as a pipe between the 2
namespaces
▪ The VETH (virtual Ethernet) device
is a local Ethernet tunnel.
▪ Devices are created in pairs
▪ Packets transmitted on one device in
the pair are immediately received on
the other device.
▪ When either device is down, the link
state of the pair is down.
[Link]
networking
CLOUD COMPUTING
Filesystem root - chroot name space
• The OS has a file system started at root
• /bin, and so on, contain programs and libraries
• If you want to run a program which uses a different version of /bin and so on
• This can be achieved using chroot
• Mount new /bin on some place (say /mnt)
• Issue chroot /mnt command
• command will then see the root as /mnt, not the real root
• Using this technique, can give each process on system its own file system
• Changes the root directory for currently running processes as well as it children for
• Search paths Often used when building system images
• Relative directories ▪ chroot to temp directory
• Using chroot can be escaped given proper capabilities, thus pivot_root is often ▪ Download and install packages in chroot
used instead
▪ Compress chroot as a system root FS
• chroot; points the processes file system root to new directory
• pivot_root; detaches the new root and attaches it to process root directory
• pivot_root info at [Link]
CLOUD COMPUTING
Cgroups (or Control groups)

• Cgroup is a linux feature to limit, police, and account the resource usage for a set of processes.
Docker uses cgroups to limit the system resources.
• Cgroups - provides mechanisms (fine grain control) to allocate, monitor and limit resources such
as CPU time, system memory, block IO or disk bandwidth, network bandwidth, or combinations
of these resources — among user-defined groups of tasks (processes) running on a system.
• Cgroups works on resource types. So it works by dividing resources into groups and then assigning
tasks to those groups, deny access to certain resources, and even reconfigure our cgroups
dynamically on a running system.
• When you install Docker binary on a linux box like ubuntu it will install cgroup related packages
and create subsystem directories.
• Hardware resources can be appropriately divided up among tasks and users, increasing overall
efficiency.
CLOUD COMPUTING
Linux cgroups - Functionality

• Access
• which devices can be used per cgroup

• Resource limiting
• memory, CPU, device accessibility, block I/O, etc.

• Prioritization
• who gets more of the CPU, memory, etc.

• Accounting
• resource usage per cgroup
• Control
• freezing & check pointing
• Injection
• packet tagging
CLOUD COMPUTING
Linux cgroups - usage

• cgroups are hierarchically structured where each of the groups are created for a
resource with a number.
• Tasks are assigned to cgroups
• Each cgroups has a resource limitation
• There is a hierarchy for each resource
CLOUD COMPUTING
What resources can we limit?

All of the following can be limited for a Cgroup

• Memory
• CPU

• Block IO
• Devices (which of the devices and allowing creation of devices ..)
• Network
CLOUD COMPUTING
cgroup Examples

Each cgroup has a resource limitation associated with it

CLOUD COMPUTING
What resources can we limit?

• When a process creates a child process, the child

process stays in the same cgroup
• Good for servers such as NFS
• Typical operation
• Receive request
• Fork child to process request
• Child terminates when request complete
• All children will have resource limitation
of parent => the resource limitation of
parent will apply to processing requests
Try the following on your docker command line:

docker run -d --name mycontainer --cpus="0.5" ubuntu sleep 1000

docker run -d --name mycontainer --memory=100m ubuntu sleep 1000
docker exec mycontainer cat /sys/fs/cgroup/cpu/cpu.cfs_quota_us
docker exec mycontainer cat /sys/fs/cgroup/memory/memory.limit_in_bytes
docker stats mycontainer
docker rm -f mycontainer

Example With stress test:

docker run -d --name mem_test --memory=100m ubuntu sleep 1000

docker exec -it mem_test apt update && apt install -y stress
docker exec -it mem_test stress --vm 1 --vm-bytes 150m --timeout 30s
(The container should be killed by the Out of Memory (OOM) killer.)

docker logs mem_test

docker ps -a | grep mem_test
(It should show Exited (137), meaning it was terminated due to OOM.)
CLOUD COMPUTING
Container Filesystem

• Programs running inside containers know nothing about image layers.

• From inside a container, the filesystem operates as though it’s not running in a container or
operating on an image.
• From the perspective of the container, it has exclusive copies of the files provided by the
image. This is made possible with something called a union filesystem (UFS).
• Docker uses a variety of union filesystems and will select the best fit for your system.
• A union filesystem is part of a critical set of tools that combine to create effective
filesystem isolation.
• The other tools are MNT namespaces and the chroot system call.
 CLOUD COMPUTING
Union Filesystem

▪ Union is a type of a filesystem that can create an illusion of merging contents of several
directories (created in layers) into one without modifying its original (physical) sources
which can be shown in single, merged view
▪ Union file system operates by creating layers, making them very lightweight and fast.
▪ Docker Engine uses UnionFS to provide the building blocks for containers.
▪ Docker Engine can use multiple UnionFS variants, including AUFS, overlay2, btrfs, vfs,
and DeviceMapper.

Reference:[Link] [Link]
 CLOUD COMPUTING
unionfs features - Layering
▪ unionfs permits layering of file systems /Fruits

• /Fruits contains files Apple, Tomato

Apple Tomatoes
• /Vegetables contains Carrots, Tomato
mount –t unionfs –o dirs=/Fruits:/Vegetables none /mnt/healthy /Vegetables
• /mnt/healthy has 3 files – Apple, Tomato, Carrots
• Tomato comes from /Fruits (1st in dirs option) Carrots Tomatoes

▪ As if /Fruits is layered on top of /Vegetables

CoW layer
▪ -o cow option on mount command enables copy on write
/Fruits
• If change is made to a file
Apple Tomatoes
• Original file is not modified
• New file is created in a hidden location /Vegetables
▪ If /Fruits is mounted ro (read-only), then changes will be recorded in a
Carrots Tomatoes
temporary layer
[Link]
CLOUD COMPUTING
Docker and UnionFS

Incremental Images
▪ Union FS
• Files from separate FS (branches) can be overlaid
• Forming a single coherent FS
• Branches may be read-only or read-write
▪ Docker Layers
• Each layer is mounted on top of prior
layers
• First layer = base image (scratch, busybox,
ubuntu, …)
• A read-only layer = an image
• The top read-write layer = container [Link]
CLOUD COMPUTING
Weaknesses of Union Filesystem

▪ Different filesystems have different rules about file attributes, sizes, names, and
characters.
▪ Union filesystems are in a position where they often need to translate between the rules
of different filesystems. In the best cases, they’re able to provide acceptable translations.
In the worst cases, features are omitted.
▪ Union filesystems use a pattern called copy-on-write, and that makes implementing
memory-mapped files (the mmap system call) difficult.
▪ Most issues that arise with writing to the union filesystem can be addressed without
changing the storage provider. These can be solved with volumes
▪ The union filesystem is not appropriate for working with long-lived data or sharing data
between containers, or a container and the host.
CLOUD COMPUTING
Summary

• Use namespaces for controlling resource access

• Docker has developed their own namespace technology called namespaces to
provide the isolated workspace called the container.
• When you run a container, Docker creates a set of namespaces for that
container.
• These namespaces provide a layer of isolation.
• Use cgroups for resource sharing
 CLOUD COMPUTING
Container Software

1. Docker
2. AWS Fargate
3. Google Kubernetes Engine
4. Amazon ECS
5. LXC
6. Microsoft Azure
7. Google Cloud Platform
8. Core OS
CLOUD COMPUTING
Additional References

Containers vs VMs
[Link]

Docker container
[Link]
[Link]

Understanding Linux containers

[Link]
[Link]
[Link]
 CLOUD COMPUTING
Additional Reading

• [Link]
US/Red_Hat_Enterprise_Linux/6/html/Resource_Management_Guide/sec-
Relationships_Between_Subsystems_Hierarchies_Control_Groups_and_Tasks.html
• [Link]
• [Link]
• Cgroups, namespaces and beyond: What are containers made from – Jerome
Pettazzoni, Docker
[Link]
• [Link]
US/Red_Hat_Enterprise_Linux/6/html/Resource_Management_Guide/sec-
Relationships_Between_Subsystems_Hierarchies_Control_Groups_and_Tasks.html
THANK YOU

Prafullata Kiran Auradkar

Department of Computer Science and Engineering
prafullatak@[Link]