Challenges of File System Isolation
summary
Explains why Twitter’s Apache Aurora on Apache Mesos cluster lacks file system isolation, what enabling Docker at scale looked like, and what actually broke: building a single 5 GB fat image with JVM/Python deps, prefetching it to ~30,000 hosts using a modified BitTorrent distribution (cedars/leechers), torrent traffic blacking out host network and agent heartbeats, forcing cgroup and TC policing workarounds; Docker layering tricks fail due to whiteout-induced layer bloat, disk limits restrict versioning, and partial application-level isolation wins as the pragmatic compromise.
AI-written summary · about
chapters (12)
- 0:00Intro
- 1:10Problem Statement
- 8:28What is Filesystem Isolation?
- 10:24Filesystem Isolation Levels
- 11:17Isolation - a catch
- 11:53Full Isolation
- 12:26Container Launch Delay
- 13:48Image Distribution
- 16:15Bittorrent Installation
- 19:12Port-Mapping isolator
- 20:31Leecher Network Isolation
- 26:35Filesystem Isolation Comparison
related talks
14mYour Containers Aren’t Alone: Demystifying Container Isolation
31mYour Containers Aren’t Alone: Demystifying Container Isolation
25mYou Can’t Handle the Root! Container Isolation...
31mWhat’s under the hood of Docker?
22mSandboxes all the way down - A hitchhiker's guide to platform...
33mDocker Security
46mSecuring Applications and Pipelines on a Container Platform
29mLayers of Isolation in Kubernetes