Please be quiet, we need to start now, thank you.
Quiet, please.
All right, next time we've got access,
going to be talking to us about reducing continually
major sizes with EBPF and Podman.
Hello everyone, so my name is Access Fennany.
I'm also French and you're right for that.
And today I'm going to talk about how can you tackle
the problem of bloated images.
And we will see how Podman and EBPF can be used
to target this problem.
So, why would you see today why you should
reduce your container images, how Podman and the OCI
or container initiative, spec and be used.
EBPF and containers have it can work together.
And we'll do a demo because I think that
showing my code running is probably way clearer
on the slide that I'm going to show.
So depending on the context and what you are doing
with your images, on surprise context,
usually you want to reduce your container size
just to avoid CVs.
You don't want to be called at 2 a.m. in the morning
because there is one image tag with 10 CVs
whenever it is.
And especially sometimes your images tag that
this is just shared library that is not even used.
But how can you determine what's being used and what's
not inside your image?
There is obviously the network bandwidth.
The bigger is your image, more network
it will be, it will use.
And also the starting time.
Five megabytes image will obviously start
faster than the five gigabyte one.
So how do you determine what is going to be
using your container?
But so pretty tricky problem and static analysis
may work in some languages.
But when you have a very big image with different
component, iterative range of binaries,
utility stuff, different programming language,
you may want to go into runtime analysis.
But yeah, there is different approach
but I tried for this problem because it's something
that I was thinking about pretty long time.
I tried first to create my own five system
of whose five stemming user space trying to intercept
every file which is open that this has
way too much overhead and performance.
But it does not make my application work here.
But I recently came across like a few months ago
an article from the Long-time Wentberg and Dan Wars.
They main idea was how can you limit
a container system called access.
So the occur when they first created the containers.
They limit the number of system call that the
processes inside your container can call.
They created a subset of something like 240 system
calls, but that's still a lot.
And most applications don't need that much.
So they made a tool combining
the same code for the IPPF and Podman to be able to
at runtime capture every system call that
the container is doing.
And then later on in production you can use this list
to restrict the container and either is called
remote execution and attacker.
If you try to use the system call that is not
in the list it just crush the container.
And this idea is something that yeah,
it would be used to do the same for file access.
So Podman is just a container online.
Very similar to Docker, almost a drop in
replacement.
You can run Podman run Podman tool everything.
And they implement the open container initiative
spec which is spec to define how containers
should work.
And why Podman?
Because I'm working at Red Hat and I'm working on
Podman disturb.
So I would have issue if I had not used that.
So you want to be able to do your run time
analysis.
You want to be able to be called.
It was your program which is going to run the
profiting called before the container is running.
So you can use the pre-start.
How oops in containers are tricky.
They use the find an annotation.
You tell Podman or a container of respect to
spec.
When this annotation is used, when you run a container you
call my binary in a synchronous manner.
And until I return you do not start the container.
Because you don't want to have your container running
doing already stuff and then set up your profiting because
would probably miss some loading, live-a-reason,
or the things.
And for example, you can define very simple hook
and your hook, your binary, we'll have some information,
which is the PID of your container.
And the annotation value that you said that is required.
But containers, you can create some processes.
You can have tons of things happening in it.
So how do you provide everything that's happening inside
one container?
You check the mountain space in the Linux world
for containers, for isolation.
The online is usually create a mountain space.
This is my next space as an ID.
And every process inside your container.
Without privilege, though, we does not go outside the container.
We'll have the same mountain space.
So with this ID, you now have a way to identify
process, but you want to be able to capture everything
that is happening in a performance wise manner.
So EBPF is the solution.
So to go quickly, there is a room at first
them on EBPF.
It's a very big subject, very nice.
It's allow you, it allows you in the big line,
to run code in a privileged manner inside the Linux kernel.
You don't need to recompile your kernel
to run some custom logic.
Why it's important?
Because it's very, you can hook in any place
in most of places inside your Linux kernel.
And you can access the strict internal data structure
in some way of it.
So you should do that because it's very efficient.
There is almost no overhead if you do your EBPF program
pretty nicely.
And it allows you a lot of flexibility.
So there is tons of EBPF program.
There is for everything.
You can hook into system calls.
You can hook into five system.
You can hook into drivers.
But there is one which is very interesting
is that you can hook in two Linux security module
and the specific one is the file open.
I tried, I first to hook into the system
will open that some new application now
are using open hat.
And there is, when you use exec,
it's not mandatory opening some five.
So it was very hard to be sure that everything
that is read, opened, accessed, execute.
I want to catch this information.
So this one, this Linux security module,
file open hook, which is the list of things
that you can attach your EBPF program to,
is what has been used.
So now you have your, you have put man.
Before starting the container, it's called your binary.
Your binary will be able to load your EBPF program.
You are just in your binary,
you will be able to identify the mountain space.
So you now have a way to determine every process
is from within your container.
And inside the EBPF program, every time a file is open,
it's an event, it's a task.
And in this task, you can access the mountain space.
So now, every time a file is open on everything
on your system, you will get a pull.
You can filter a pull saying, OK, this is not relevant
to my problem.
And then you can just send back your information.
So you will see the event, you see a file.
This file is from within the container.
And EBPF allows you to define some map that has
structured, communicate between the kernel space
and the user space.
And you just trim the data.
And in your user program, because you
use the annotation, the nice value, you just put an absolute
path where you want this data to be dumped.
So next slide.
Demo time, OK, can I?
OK, I may need to just let me roll.
Yeah, webiture.
So I don't have, yeah, thanks, you.
I don't have much time.
So in an idea world, you want to have your production
container.
And at least when a production like use case, because let's
say you have two endpoint, one endpoint,
is reading a config file if your version is not.
If you only test the one that is not opening
or fully covering your use case, you will just get data,
which are not relevant or not representative
of what's happening inside your container.
So you could say, OK, you could use it in the CI,
or you could use it with your end-to-end test
to at least have an idea.
So for example, we could run just for this demonstration.
We have this federal image, which is utility-based image,
just like Ubuntu.
But it does, like, tons of binaries.
There is a lot of things in it.
But it's expected, because it's a utility-based image.
But what I want to do is, here,
no overhead, I'm not using my annotation.
So nothing is happening.
I'm just going to copy paste the annotation.
So now I'm just doing the same, but I'm
adding the annotation and the path where
I want the content to be dumped.
So doing the same, let's use some of the binary
that we have in it.
So we can use dates.
I can use a wrap-up.
I can use cat.
We can see the profile.
What types could we do?
We can use some binary with here.
But I think that's all.
We can see now in our disk folder,
that we have a profiling file that has been created.
It's just a JSON.
It's not really nice to represent.
But I made a quick UI tool, which allow you
to take this file.
And what it does is just go to the PanManages3,
dump the image, check all the layers,
and create a tree structure, just a file tree of your system.
And it combined it with the dump file that you got.
And it just tells you if a file has been opened or not.
And tells you how many percentage of the content is used or not.
The percentage are using the file size, not the number of files.
So for very small file, you will not see,
but all of this could be configured.
So let's go into bin folder.
And we can see here that we are all in all of the binaries.
The bash one is obviously used, because it's our entry point.
So we use the cat to see the profile.
We see the date, we see zero colors, as we use,
probably for something.
And yeah, over things like DREP.
So with this method, you can just see everything
that has been used in your container.
And when everything, which has not been used here,
also we can't do profiles, so we can see it.
One slide.
Why is it empty?
Next, this operation is not spotted.
Easy.
But the next slide is a thing, so Paul is nearing it.
Just, okay, it's not working.
Thanks, Paul is nearing.
Thank you for your presentation.
Hello.
Thank you for your presentation.
I have two questions.
Is this tool already integrated in format?
I'm sorry, I don't know.
Hello.
No, it does, just, it's just very, is this tool already integrated
in the Fedora image or in Podma?
I don't know, I'm sorry, I can't, I don't see it.
Is it already integrated in the Fedora image or in Podma?
Oh, no, no.
This is just a thing that I work on my free time.
I linked the repository and you need to install it yourself.