<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle18
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.EmailStyle19
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:#1F497D;}
span.EmailStyle20
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:#1F497D;}
span.EmailStyle21
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:#1F497D;}
span.EmailStyle22
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:541213287;
mso-list-type:hybrid;
mso-list-template-ids:1363868382 -1324332610 134807577 134807579 134807567 134807577 134807579 134807567 134807577 134807579;}
@list l0:level1
{mso-level-text:"%1\)";
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:.75in;
text-indent:-.25in;}
@list l0:level2
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:1.25in;
text-indent:-.25in;}
@list l0:level3
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
margin-left:1.75in;
text-indent:-9.0pt;}
@list l0:level4
{mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:2.25in;
text-indent:-.25in;}
@list l0:level5
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:2.75in;
text-indent:-.25in;}
@list l0:level6
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
margin-left:3.25in;
text-indent:-9.0pt;}
@list l0:level7
{mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:3.75in;
text-indent:-.25in;}
@list l0:level8
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:4.25in;
text-indent:-.25in;}
@list l0:level9
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
margin-left:4.75in;
text-indent:-9.0pt;}
ol
{margin-bottom:0in;}
ul
{margin-bottom:0in;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><span style="color:#1F497D">Hi Surya,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Please see my response inline.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Currently Zun have two drivers for managing containers: Docker and NovaDocker. Sandbox was initially implemented for the NovaDocker driver which we are going to deprecate soon.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Also we are working on making the sandbox optional for the Docker driver. See patch [1] for the code.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">[1] </span><a href="https://review.openstack.org/#/c/471634/">https://review.openstack.org/#/c/471634/</a><span style="color:#1F497D"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Regards,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Madhuri<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><a name="_MailEndCompose"><span style="color:#1F497D"><o:p> </o:p></span></a></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b>From:</b> Surya.Prabhakar@dell.com [mailto:Surya.Prabhakar@dell.com]
<br>
<b>Sent:</b> Wednesday, July 12, 2017 4:44 AM<br>
<b>To:</b> openstack-dev@lists.openstack.org<br>
<b>Subject:</b> [openstack-dev] [zun] sandbox and clearcontainers<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-bottom:12.0pt"><b><span lang="EN-GB" style="font-size:9.0pt;font-family:"Arial",sans-serif;color:#AAAAAA">Dell - Internal Use - Confidential
</span></b><span lang="EN-GB" style="font-size:12.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB">Hi Folks, <o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB"> I am just trying to wrap my head around zun’s sandboxing and clear containers. From what Hongbin told in Barcelona ( see the attached pic which I scrapped from his video)
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-GB"><img border="0" width="433" height="241" id="Picture_x0020_1" src="cid:image003.jpg@01D2FAF8.E8A6E1D0"></span><span lang="EN-GB"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB">current implementation in Zun is, Sandbox is the outer container and the real user container is nested inside the sandbox. I am trying to figure out how this is going to play out<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB">when we have clear containers. <o:p></o:p></span></p>
<p class="MsoNormal"><b><i><span lang="EN-GB">[Kumari, Madhuri] </span></i></b><b><i><span lang="EN-GB">The sandbox container is just an infra container that manage IaaS resources associated with a container or a group of containers. Real container is only
using the resources attached with the infra container not running inside infra container, so no other virtualization layer is involved here.</span></i></b><span lang="EN-GB"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB">I envision the following scenarios:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB"><o:p> </o:p></span></p>
<p class="MsoListParagraph" style="margin-left:.75in;text-indent:-.25in;mso-list:l0 level1 lfo2">
<![if !supportLists]><span lang="EN-GB"><span style="mso-list:Ignore">1)<span style="font:7.0pt "Times New Roman"">
</span></span></span><![endif]><span lang="EN-GB">Scenario 1: where the sandbox itself is a clear container and user will nest another clear container inside the sandbox. This is like nested virtualization.
<o:p></o:p></span></p>
<p class="MsoListParagraph" style="margin-left:.75in"><span lang="EN-GB">But I am not sure how this is going to work since the nested containers won’t get VT-D cpu flags.<o:p></o:p></span></p>
<p class="MsoListParagraph" style="margin-left:.75in;text-indent:-.25in;mso-list:l0 level1 lfo2">
<![if !supportLists]><span lang="EN-GB"><span style="mso-list:Ignore">2)<span style="font:7.0pt "Times New Roman"">
</span></span></span><![endif]><span lang="EN-GB">Scenario 2: the outer sandbox is just going to be a standard docker container without vt-d and the inside container is going to be the real clear container with vt-d. Now this
<o:p></o:p></span></p>
<p class="MsoListParagraph" style="margin-left:.75in"><span lang="EN-GB">might work well but we might be losing the isolation features for the network and storage which lies open in the sandbox. Wont this defeat the whole purpose of using clear containers.<o:p></o:p></span></p>
<p class="MsoListParagraph" style="margin-left:0in"><b><i><span lang="EN-GB">[Kumari, Madhuri]
</span></i></b><b><i><span lang="EN-GB">I have tried to run infra container as docker container and the real container as a Clear Container and it seems to work well. But I agree with your point that we might lose the advantage of using clear container.<o:p></o:p></span></i></b></p>
<p class="MsoListParagraph" style="margin-left:0in"><b><i><span lang="EN-GB">So after the sandbox is made optional, we can run a clear container directly without any sandbox. Thus solving the issue.</span></i></b><span lang="EN-GB"><o:p></o:p></span></p>
<p class="MsoListParagraph" style="margin-left:0in"><span lang="EN-GB"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB">I am just wondering what is the thought process for this design inside zun. If this is trivial and if I am missing something please shed some light
</span><span lang="EN-GB" style="font-family:Wingdings">J</span><span lang="EN-GB">.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB">Thanks<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB">Surya ( spn ) <o:p></o:p></span></p>
</div>
</body>
</html>