Please be quiet, we need to start now, thank you.
Quiet, please.
All right, next time we've got access,
going to be talking to us about reducing continually
major sizes with EBPF and Podman.
Hello everyone, so my name is Access Fennany.
I'm also French and you're right for that.
And today I'm going to talk about how can you tackle
the problem of bloated images.
And we will see how Podman and EBPF can be used
to target this problem.
So, why would you see today why you should
reduce your container images, how Podman and the OCI
or container initiative, spec and be used.
EBPF and containers have it can work together.
And we'll do a demo because I think that
showing my code running is probably way clearer
on the slide that I'm going to show.
So depending on the context and what you are doing
with your images, on surprise context,
usually you want to reduce your container size
just to avoid CVs.
You don't want to be called at 2 a.m. in the morning
because there is one image tag with 10 CVs
whenever it is.
And especially sometimes your images tag that
this is just shared library that is not even used.
But how can you determine what's being used and what's
not inside your image?
There is obviously the network bandwidth.
The bigger is your image, more network
it will be, it will use.
And also the starting time.
Five megabytes image will obviously start
faster than the five gigabyte one.
So how do you determine what is going to be
using your container?
But so pretty tricky problem and static analysis
may work in some languages.
But when you have a very big image with different
component, iterative range of binaries,
utility stuff, different programming language,
you may want to go into runtime analysis.
But yeah, there is different approach
but I tried for this problem because it's something
that I was thinking about pretty long time.
I tried first to create my own five system
of whose five stemming user space trying to intercept
every file which is open that this has
way too much overhead and performance.
But it does not make my application work here.
But I recently came across like a few months ago
an article from the Long-time Wentberg and Dan Wars.
They main idea was how can you limit
a container system called access.
So the occur when they first created the containers.
They limit the number of system call that the
processes inside your container can call.
They created a subset of something like 240 system
calls, but that's still a lot.
And most applications don't need that much.
So they made a tool combining
the same way.
So they created a code called the IPPF and
Podman to be able to attract
every system call that the container is doing.
And then, later on in production, you can use this list
to restrict the container and if it's called
remote execution and attacker, if they try to use
the system call but it's not in the list, it's just
to do the same for file access.
So Podman, so Podman is just a container
on giant, very similar to Docker, almost a
drop in replacement.
You can run Podman, run Podman, pull everything.
And they implement the open container initiative
spec which is spec to define how containers
should work.
And why Podman?
Because I'm working at that and I'm working on
Podman desktop, so I would have
issue if I had not used that.
So you want to, to be able to do your
runtime analysis.
You want to be able to be called,
which was your program, which is going to run the
profiting called before the container is running.
So you can use the pre-start,
how hooks in containers are a bit tricky.
So you don't want to have your container running,
when this is used, when you want to
container, you call my binary in a synchronous
manner until I return, you do not start the
container.
Because you don't want to have your container running,
do you want to run it?
Because you would probably miss some loading,
live-reason.
over things. And for example, you can define very simple
hook and your hook, your binary, we'll have some information,
which is the PID of your container. And the annotation value
that you said that is required. But containers,
you can create some processes, you can have tons of
thing happening in it. So how do you
provide everything that's happening inside one container,
you check the mountain space, in the Linux world for
containers, for isolation, the online is usually
created mountain space, this mountain space as an ID,
and every process inside your container, without
privileged or without not go outside the container,
we'll have the same mountain space. So with this ID,
you now have a way to identify process, but you want to be
able to capture everything that is happening in
the performance wise manner. So EPPF is the solution. So
to go quickly, there is a room at first
them on EPPF, it's a very big subject, very nice.
It's allow you, it allows you in the big line, to run code
in a privileged manner inside the Linux kernel. You don't need to
recompile your kernel to run some custom logic. Why it's
important? Because it's very, you can hook in
any place in most of places inside your Linux kernel, and you can
access the strict internal data structure in
some way of it. So you should do that because it's very efficient,
there is almost no overhead if you do your EPPF program
pretty nicely. And it allows you a lot of
flexibility. So there is tons of EPPF
program, there is for everything, you can hook into
system course, you can hook into five system, you can
hook into drivers, but there is one which is very interesting,
is that you can hook in through a Linux security module, and the specific
one is the file open. I tried first to hook into a
system called open, but some new application now are using open
hat, and there is, when you use exact, it's not
mandatory opening some five. So it was very hard to
be sure that everything that is read, opened, accessed,
execute, I want to catch this information. So this one, this Linux
security module, file open hook, which is a list of
applications that you can attach your EPPF program to, is what
has been used. So now you have your, you have
podman, before starting the container, it's called your binary.
Your binary will be able to load your EPPF program.
You, just in your binary, you will be able to
identify the mountain space, so you now have a way to determine
your processes from within your container, and inside the
EPPF program, every time a file is open, it's an
event, it's a task, and in this task, you can access
the mountain space. So now every time a file is open on everything
on your system, you will get a pull, you can filter
of a pull saying, okay, this is not relevant to my
problem, and then you can just send back your
information, so you receive an event, you see your
file, this file is from within the container, and
EPPF allows you to define some map that has
structured, communicate between the kernel space, and you
just trim the data, and in your user program, because you
use the annotation, the nice value, you just put an
absolute path where you want this data to be, to be
different, so next time,
okay, can I, okay, I may need to
just let me roll.
Yeah, we're a bit there, so
you could, I don't have, yeah, thanks
you, I don't have much time, so in an
idea world, you want to have your production container,
and at least you want to produce
production like use case, because let's say you have
two end points, one end point is reading a
config file, the over is not, if you only test
the one that is not opening, or
fully covering your use case, you will just get data, which
are not relevant, or not representative of what's
happening inside the container, so you could say, okay,
we could use it in the CI, you could use it with your
end-to-end test to at least have an idea.
So, for example, we could run, we could run just for
the demonstration, we have the federal
image, which is utility-based image, just like
Ubuntu, but it does, like, tons of binaries, there is a lot of things
in it, but it's expected, because it's a utility-based image.
What I want to do is, here, no overhead, I'm not using
my annotation, so nothing is happening, I'm just going to
copy paste the annotation.
So, now I'm just doing the same, but I'm adding the annotation,
and the path where I want the content to be, to be
doing the same, let's use some of the binary that we
have in it, so we can use dates, I can use
rep, I can use cat, we can see the profile,
what types could we do, we can use some binary
here, but I think that's all, we can see now in our
disk folder that we have a profiling file that has been created,
and it's not really nice to represent, but I
made a quick UI tool, which allow you
to take this file, and what it does, it just
go to the pan manager's tree, dump the image,
check all the layers, and create a tree structure, just
file tree of your system, and it combined it with the
done file that you got, and it just tells you if
a file has been opened or not, and tells you how many
percentage of the content is used or not.
The percentage are using the file size, not the number of
files, so for very small file you will not see, but
all of this could be configured. So, let's go into
our bin folder, and we can see here that we are
all in all of the binaries, the batch one is obviously used,
because it's our entry point, so we use the cat to
see the profile, we see the date, we see
zero colors, okay, that's the used, I probably
for something, and yeah, over things like
reps, so with this method you can just see everything that has
been used in your container, and when everything which has
not been used, here also we can't do
it, we can see it, one slide, why is it empty?
Next, this operation is not spotted, is it?
But the next slide, the next slide is a
thing, so probably this thing, just, okay, it's not working,
so let's name.
Hello, thank you for that presentation.
Sure, is this tool already integrated in
format, sorry, I don't know.
Hello, it does, just, it's just very,
is this tool already integrated in the
Fedora image or import map?
I don't know, I'm sorry, I can't, I don't see.
Is it already integrated in the Fedora image or import map?
Oh no, no, this is just a thing that I work on my
free time, I linked the repository, and you need to
install it yourself.
Any other question?
Thank you.