Google Launches Managed Service for Running Docker Apps on Its Platform

http://googlecloudplatform.blogspot.com/2014/11/google-cloud-platform-live-introducing-container-engine-cloud-networking-and-much-more.html

by ferrantim • 12 years ago

264 60 12 years ago

googlecloudplatform.blogspot.com

jbeda10• 12 years ago

More info/docs here: https://cloud.google.com/container-engine/

I'm on the Kubernetes/GKE team and happy to answer any questions you all might have.

We also all hang out on IRC at #google-containers on freenode.

marktangotango• 12 years ago

>Because this new service is officially in alpha, you’ll need to apply for access and be whitelisted to use the service. It also means the service isn’t feature complete and the whole infrastructure could melt down at any minute.

Not sure what the take away here is other than, this may one day be a feature. No information about pricing, support, or sla. My attitude is wait and see. Should it be otherwise?

Edit: Can someone tell me why this isn't a valid question? Why the down votes?

jbeda10• 12 years ago

The TechCrunch article is incorrect. While it is still an early service, there is no whitelist.

wstrange2• 12 years ago

It's all open source (including kubernetes) - so worst case you move it to the cloud provider of your choice. Other than Docker / k8s being a little immature, I don't see a ton of risk.

philip12092• 12 years ago

Some google-managed base images would be helpful. The last time I checked, some of the major public docker images were still shellshock-vulnerable. Pre-installed GCE tools would be helpful. Perhaps automated environment variables about region, etc.

23david4• 12 years ago

Which images are still shellshock vulnerable? Wasn't aware that was an issue if we stick to the docker-managed images.

voltagex_• 12 years ago

Which?

See https://gist.github.com/voltagex/582473e3b86ee5ae4438 - I ran some tests on the three most popular (?) official base images.

shykes• 12 years ago

If you have found an official Docker image that is still shellshock vulnerable, the library maintainers [1] would love to hear from you as they take that stuff quite seriously. As far as I know the entire library is fully patched.

[1] https://github.com/docker-library/official-images

wstrange2• 12 years ago

My biggest question on Docker / k8s: How does one control where persistent data lives and the required performance characteristics? Example: I need SSD + a certain level of availability? Is there a good strategy for managing this?

jbeda10• 12 years ago

Right now, it isn't plumbed in but it is on the roadmap.

Either (a) you have network based block device and the master/manager maps that to a machine dynamically as the container get scheduled or (b) you constrain the containers to machines that have the hardware/data you need.

(b) is less than ideal but sometimes necessary.

Some discussion: https://github.com/GoogleCloudPlatform/kubernetes/issues/598

micro_cam• 12 years ago

Do you see this being useful for analytical workloads (ie i need a bunch of cores for a short time to run a parallel job) or more focused on scaling web apps and services?

jbeda10• 12 years ago

It can be used as both. As we build out better resource isolation and QoS, you'll be able to run mixed workload on the same hardware/VMs and use "every part of the animal".

lbotos• 12 years ago

I'm kind of confused. I get that they run on the Google VMs (which need a base OS, yes?) so does this manage all of that? Can I:

pick my vm size/ pick my docker image/ and go?

AKA does this bring me one step closer to docker-oku-aaS?

jbeda10• 12 years ago

Essentially that is the case.

If you just want to launch a static set of containers on a specific VM, you can use our Container VM image -- https://cloud.google.com/compute/docs/containers/container_v....

Kubernetes (and GKE) is a dynamic system to run across a cluster of machines.

jff4• 12 years ago

Is it possible to run a KVM VM inside one of the containers? I have an application for launching and managing VMs and letting people spin up a Google container to try it out would be neat.

jbeda10• 12 years ago

GCE doesn't support nested virtualization.

But if you are running Kubernetes on bare metal, there is no reason you couldn't map in /dev/kvm and have k8s run VMs for you. I haven't done it though :)

jread2• 12 years ago

We use AWS Elastic Beanstalk for Docker deployment. Can you comment on how this is different? I see it supports multiple containers per VM - are there other significant distinguishing factors?

jbeda10• 12 years ago

Elastic Beanstalk is a VM centric management framework.

Kubernetes and GKE operate at a different level. It is an API for being able to schedule and manage containers instead of VMs. At this point, k8s/GKE doesn't have an idea of an "app" any more than a VM IaaS service has an idea of an app.

Moving from a VM centric view to a container centric view improves a lot of things: * Easier to create and manage images * Portability -- images can be moved between providers. Develop on your laptop with docker/k8s and deploy the exact same container image. * More transparency into compute workload. The hosting VM or cloud can see more of what is going on in the container for monitoring and logging, etc. * More efficient/higher density -- you can run more on any piece of (virtual?) hardware * More flexible resource sharing/overcommit -- as you drive density up you can get more nuanced about what workloads take get priority.

Some of this stuff is still in its infancy -- complex resource models aren't fully supported in Docker yet -- but it is where things are going, at least based on Google's experience.

23david4• 12 years ago

Given that this is the alpha launch of Container Engine, and the Beta launch of Autoscaling and Managed VMs, what is the anticipated timeframe for this to be ready for production workloads?

I'm assuming that there'll be a beta of Container Engine in the near future, and then a stable 1.0 launch?

jbeda10• 12 years ago

Stable production ready GKE will gate on Kubernetes. Our Kubernetes roadmap is here: https://github.com/GoogleCloudPlatform/kubernetes/blob/maste...

We are driving aggressively here. I hate to put a date on it but things are converging.

roberthbailey• 12 years ago

Tech Crunch incorrectly mentions that the service requires being added to a whitelist to use. It is available for anyone to try out immediately.

philip12092• 12 years ago

Oh interesting - you appear to be correct. You need to enable it through the APIs page then you have access.

mh-• 12 years ago

confirmed I was able to do this (simply enable the API) on an existing project in the API Console

chx• 12 years ago

Can we ban techcrunch please? http://googlecloudplatform.blogspot.com/2014/11/google-cloud...

anon1385• 12 years ago

pg has mentioned in the past that he would like to ban techcrunch, but couldn't do so because they provide so much coverage of his startups.

Submissions from bullshit SV news sites is the price you pay for using a site that primarily exists as a marketing exercise.

Note that 'lower quality' sites about other sections of the tech industry have been banned for years (appleinsider, winsupersite etc).

dang• 12 years ago

We're unlikely to ban TechCrunch, but are happy to change urls to more substantive articles when you and other users point them out.

(We changed the URL from http://techcrunch.com/2014/11/04/google-launches-managed-ser...)

gfodor• 12 years ago

Pretty sure we're gonna see a similar offering from AWS in a week.

jread2• 12 years ago

AWS released PaaS docker support 7 months ago: http://aws.amazon.com/blogs/aws/aws-elastic-beanstalk-for-do...

ceejayoz• 12 years ago

Something more is coming soon, though: https://twitter.com/jeffbarr/status/529493907839533056

lxcp• 12 years ago

Hi Joe, I guess you folks are not running containers from customers side-by-side in the same host. So if I scale up my cluster size while I have containers deployed, do you folks rebalance the load on the host machines on the fly (by stopping/relocating some containers) or do you rebalance the new containers?

jbeda10• 12 years ago

Correct -- we don't do multi-tenant on the same VM. The security just isn't there in our minds.

We don't do rebalancing/rescheduling/repacking yet. Those are the types of things that we will be working on moving forward.

TheMagicHorsey• 12 years ago

Can someone explain the difference between Apache Mesos, Apache Spark, and Kubernetes. As someone reading just announcements, and having never experimented with any of these tools, they sound like they promise the same capabilities.

Is it just that they are different open source projects aiming for the same goal ... or are their goals different?

vertex-four2• 12 years ago

Apache Mesos is based on Twitter's expertise in deploying their cluster, Kubernetes on Google's. They do things in different ways. Spark seems to be in the same area as Hadoop, so not relevant to the conversation.

23david4• 12 years ago

Yep, but there's an important difference I think...

Mesos (some customizations, but largely the same as open-source Apache Mesos) IS what Twitter uses to deploy and manage their clusters. Battle-hardened at scale running diverse production workloads.

With Kubernetes, we're told that it is built using architectural and philosophical principles proven to work at scale on Google's production systems. But it's a fairly clean-room built-from-scratch implementation and although developing quickly, is still immature and untested.

hendzen• 12 years ago

No. Apache Mesos was originally developed at the UC Berkeley AMPLab as a research project. Twitter was a very early adopter, who subsequently hired the Mesos author/creator.

shepardrtc• 12 years ago

In simple terms:

Apache Mesos is a distributed system that is kind of a "bottom layer" for computations and storage (whether in-memory or on disk).

Apache Spark is a distributed application that runs on top of Mesos and does computations that takes advantage of cluster computing. It can do classic MapReduce or other algorithms that you write using its API.

Kubernetes is a distributed system that runs Docker in a cluster. Docker is a way to run sandboxed applications. Kubernetes can run on Mesos.

bjt• 12 years ago

I'll give it a shot, with the disclaimer that this explanation is based on conference talks I've seen and documentation I've read.

Spark is a successor to Hadoop, aiming to perform big distributed data crunching jobs more quickly by not limiting itself to a map-reduce paradigm and by holding more data in memory.

Apache Mesos is a resource scheduler for a cluster of machines. It is architected to be agnostic about the kind of application running on it, but I get the impression it's primarily used to make things like Hadoop and Spark run on the same cluster without stepping on each other's toes (and not used so much for long-running services like a web app). An application says to Mesos "hey I'd like to run job X", outlining the resources that it needs, and then Mesos looks at the cluster to see the best place to run the job. Mesos has some Docker integration but it's weird. Instead of launching your job and creating cgroups directly as it usually does, Mesos has to run a proxy process that talks to Docker and asks it to do it. (This is because Docker no longer has standalone mode. Which is my biggest gripe about Docker.)

Kubernetes is solving a similar problem to Mesos, how to allocate resources in a cluster to all the jobs that you might want to run on it. It's explicitly focused on "containers", though not necessarily just Docker containers. (The README at https://github.com/GoogleCloudPlatform/kubernetes makes no mention of Docker.) I get the impression it's focused more on long-running processes like web servers and less on ephemeral Hadoop-style jobs.

vertex-four2• 12 years ago

and not used so much for long-running services like a web app

Mesosphere Marathon, which sits on top of Mesos, makes doing long-running services easier; it starts services, restarts them if machines crash, etc etc. Where Mesos is the resource schedular, Marathon is more like a *nix init system.

Aurora is supposed to do much the same thing, but is in Incubation at the moment. There's also "Singularity", which does a bunch of stuff including managing long-running services and one-off services through an HTTP API and webapp.

Mesos is supposed to be treated sort of as a "cluster kernel", with "frameworks" which sit on top of it and use it to schedule things. It's a lot more versatile than "I want to deploy a bunch of services" - it's more along the lines of having your own EC2 that you can request resources from on-demand.

wowmsi• 12 years ago

Mesos and Kubernetes share lot of commonalities: both are useful for managing (virtual) compute resources for a given application. Primarily, as an app developer, you are interesting in specifying the required resources at a high level: 10 front end instances, 20 middle tier, and 3 back end database instances. You may not care how the resources are provisioned as long as some underlying SLA is satisfied. This is useful for boosting service uptime since in any long running service the nodes may go offline anytime and the framework will re-provision the resources automatically--often within few mins.

Mesos is useful to share resources across multiple clusters (i.e., multiple departments using Hadoop within a same organization may want to share the resources), where as Kubernetes seems to focus on container applications using docker. In addition, Mesos implements dominant-resource-fairness (DRF) scheduling, which has some nice properties [0].

Lastly, Spark is just an application running on the top of Mesos or Kubernetes. Using my earlier example, Spark and Hadoop can run in a single datacenter on the top of Mesos without statically partitioning the clusters a priori each having an illusion that they own the entire datacenter.

[0] https://www.usenix.org/event/nsdi11/tech/full_papers/Hindman...

yim• 12 years ago

this is great news, esp. with the $100K google is giving to qualified startups!

deweller• 12 years ago

Does this mean that Google feels confident in running untrusted code inside containers? Or is each container actually running in an isolated VM?

It is my understanding that Docker containers are "generally" secure (https://docs.docker.com/articles/security/). But that statement isn't enough for me to use them to power a multi-user production hosting environment.

jbeda10• 12 years ago

We aren't doing multi-tenant in a VM. Instead, each user/account/project has their own set of VMs implementing the cluster.

My view is that the surface area for cgroups/kernel namespaces is just too large and isn't appropriate for hostile untrusted workloads right now.

More nuanced statement on this here: http://googlecloudplatform.blogspot.com/2014/08/containers-v...

krschultz• 12 years ago

Docker has pulled off some really impressive biz dev. I can't think of too many other things that Azure, Google Cloud, and AWS all support.

RenegadeofFunk• 12 years ago

Strongly agree with this. I've been interviewing for DevOps jobs and it seems like everyone thinks they need to be using Docker for some reason or another. Studying up on it has improved my interview feedback substantially.

jchonphoenix• 12 years ago

If you're interested, I run a team at Docker and would love to chat :P

omouse• 12 years ago

I hope this have the ripple effect of allowing enterprises to feel comfortable using things like Firebase and Docker. I floated the idea of using Docker but the idea was turned down because we have no idea how it affects performance in a production environment.

tomcart• 12 years ago

Anyone know if there are plans for auto-resizing of replicas or clusters based on alarms, along the lines of AWS autoscaling?

Google Launches Managed Service for Running Docker Apps on Its Platform

Related Stories