Generating filesystem images with integrated containers

Generating filesystem images with integrated containers is disclosed herein. In one example, a processor device obtains a filesystem tree comprising a plurality of filesystem files, and also obtains a container image comprising a plurality of container files. Based on the filesystem tree and the container image, the processor device generates a filesystem image that comprises the filesystem tree and the plurality of container files. The processor device then stores the filesystem image on a persistent data store.

BACKGROUND

An image generation system, such as OSTree for Linux-based operating systems, enables the creation of a filesystem image that contains all filesystem files of a bootable filesystem. Using the filesystem image, the bootable filesystem can be easily distributed, atomically updated, and/or replicated on target computing devices. As the range of devices capable of executing such bootable filesystems expands (e.g., to include Systems-on-a-Chip (SoCs), Internet of Things (IoT) devices, and the like), image generation systems with expanded functionality will be desirable.

SUMMARY

The examples disclosed herein provide generating filesystem images with integrated containers. In one example, a processor device executes an image generation service that provides functionality for generating filesystem images that incorporate container images as part of the filesystem tree. In this manner, an underlying operating system as well as a container to be executed thereon may be distributed, updated, and replicated more efficiently.

In another example, a method for generating filesystem images with integrated containers is disclosed. The method comprises obtaining, by a processor device of a computing device, a filesystem tree comprising a plurality of filesystem files. The method further comprises obtaining, by the processor device, a container image comprising a plurality of container files. The method also comprises generating, by the processor device based on the filesystem tree and the container image, a filesystem image comprising the filesystem tree and the plurality of container files. The method additionally comprises storing, by the processor device, the filesystem image on a persistent data store.

In another example, a computing device for generating filesystem images with integrated containers is disclosed. The computing device comprises a system memory, and a processor device communicatively coupled to the system memory. The processor device is to obtain a filesystem tree comprising a plurality of filesystem files. The processor device is further to obtain a container image comprising a plurality of container files. The processor device is also to generate, based on the filesystem tree and the container image, a filesystem image comprising the filesystem tree and the plurality of container files. The processor device is additionally to store the filesystem image on a persistent data store.

In another example, a non-transitory computer-readable medium for generating filesystem images with integrated containers is disclosed. The non-transitory computer-readable medium stores thereon computer-executable instructions that, when executed, cause one or more processor devices to obtain a filesystem tree comprising a plurality of filesystem files. The computer-executable instructions further cause the one or more processor devices to obtain a container image comprising a plurality of container files. The computer-executable instructions also cause the one or more processor devices to generate, based on the filesystem tree and the container image, a filesystem image comprising the filesystem tree and the plurality of container files. The computer-executable instructions additionally cause the one or more processor devices to store the filesystem image on a persistent data store.

DETAILED DESCRIPTION

Conventional image generation systems, such as OSTree for Linux-based operating systems, enable the creation of filesystem images that contain all filesystem files of bootable filesystems. In addition to archiving the filesystem files necessary to operate a bootable filesystem, conventional image generation systems include functionality to ensure that subsequent updates to the filesystem image are performed atomically, and also include functionality to rollback deployment of the filesystem image on a target computing device if the deployment either fails to complete successfully or results in an inoperable system. These image generation systems thus provide a mechanism for reliably distributing, updating, and replicating bootable filesystems.

As the range of devices capable of executing such bootable filesystems expands (e.g., to include Systems-on-a-Chip (SoCs), Internet of Things (IoT) devices, and the like), image generation systems with expanded functionality will be desirable. In particular, the use of container orchestration systems (e.g., Kubernetes, as a non-limiting example) that enable the execution and management of containers (i.e., isolated user-space instances in which applications can be executed) is becoming more widespread as the number of devices capable of executing such container orchestration systems increases. However, conventional image generation systems do not provide functionality for distributing previously defined containers as part of filesystem images.

In this regard, the examples disclosed herein provide generation of filesystem images with integrated containers. In one example, a processor device executes an image generation service that provides functionality for generating filesystem images that incorporate container images as part of the filesystem tree. The functionality of the image generation service may be incorporated into an existing image generation system such as OSTree or may be implemented as a separate system. In exemplary operation, the image generation service obtains a filesystem tree comprising a plurality of filesystem files (i.e., all filesystem files necessary to boot and operate a bootable filesystem). As used herein, the term “filesystem tree” and derivatives thereof are used to refer to the directory structure in which a plurality of filesystem files are organized, as well as the plurality of filesystem files themselves. The filesystem tree in some examples may be obtained from a package file (such as a Red Hat Package Manager (RPM) package file, as a non-limiting example) that the image generation service retrieves from a package repository (using, e.g., an rpm-ostree system and a libdnf package management library, as non-limiting examples).

The image generation service also obtains a container image comprising a plurality of container files that collectively define and provide functionality for a container to be executed under a container orchestration system. According to some examples, the image generation service may obtain the container image from a container registry (e.g., an Open Containers Initiative (OCI)-compliant container registry, as a non-limiting example). The image generation service next generates, based on the filesystem tree and the container image, a filesystem image comprising the filesystem tree and the plurality of container files. The operations for generating the filesystem image in some examples may include incorporating the plurality of container files into the filesystem tree, such that replication of the filesystem tree results in both a bootable filesystem as well as an executable container. Some examples may provide that the filesystem tree is also configured to automatically execute a container based on the plurality of container files upon a subsequent reboot. This may be accomplished by, e.g., modifying a configuration file, folder, or directory within the filesystem tree that defines applications and services to execute the container upon rebooting. The image generation service then stores the filesystem image on a persistent data store (e.g., a hard disk drive (HDD), a solid-state drive (SSD), and/or a cloud-based data store, as non-limiting examples).

In some examples, the image generation service may subsequently atomically deploy the filesystem tree and the plurality of container files to a target computing device using the filesystem image. As used herein, the term “atomically deploy” and derivatives thereof refer to operations for ensuring either that the deployment of the filesystem tree and the plurality of container files is completed successfully, or, in the case of an unsuccessful deployment attempt, that the target computing device is returned to a known-safe state. Some examples may provide that a modification to a container file of the plurality of container files is identified after the filesystem image is stored (e.g., as a result of execution of the corresponding container on the target computing device). The image generation service in such examples may generate a layer indicating the modification to the container file (i.e., by identifying a difference between the original container file and the modified container file) and may modify the filesystem image to include the layer. In this manner, subsequent deployments of the filesystem image will reflect the modification to the container file.

FIG.1is a block diagram of a computing system10according to one example. The computing system10includes a computing device12that comprises a system memory14and a processor device16communicatively coupled to the system memory14. The computing device12further includes a persistent data store18, which in some examples may comprise an HDD or SSD, as non-limiting examples. The computing system10ofFIG.1also includes a target computing device20that includes a processor device22, a system memory24, and a persistent data store26. While the persistent data stores18and26are illustrated inFIG.1as integral elements of the computing device12and the target computing device20, respectively, it is to be understood that some examples may provide that the persistent data store18and/or the persistent data store26is external to the computing device12and the target computing device20, respectively, and is accessible via a network connection (e.g., a cloud-based data store). It is to be further understood that the computing device12and the target computing device20in some examples may include constituent elements in addition to those illustrated inFIG.1.

In the example ofFIG.1, the computing device12provides a package repository28, which may serve as central storage for filesystem archives such as a filesystem tree30. In some examples, the filesystem tree30may be stored as or within a package such as an RPM package. The filesystem tree30includes a plurality of filesystem files32(0)-32(F) that comprise all files needed to boot and operate a bootable filesystem. The filesystem tree30also includes a directory tree structure (not shown) that defines the organization of and relationships between the plurality of filesystem files32(0)-32(F). Although only one filesystem tree30is shown inFIG.1, it is to be understood that the package repository28in some examples may store multiple filesystem trees30.

The computing device12ofFIG.1further provides a container registry34, which in some examples may comprise an OCI-compliant container registry. The container registry34stores container images such as the container image36, which comprises a plurality of container files38(0)-38(C) that define a container of a container orchestration system (e.g., Kubernetes, as a non-limiting example). When executed, the container defined by the container files38(0)-38(C) provides an isolated user-space instance in which applications can be executed and limits the access of such applications to only the resources and devices assigned to that container. It is to be understood that, while the container registry34is shown inFIG.1as storing only one container image36, the container registry34according to some examples may store multiple container images36.

As noted above, conventional image generation systems do not provide functionality for distributing previously defined containers as part of filesystem images. Accordingly, in this regard, the processor device16executes an image generation service40, which may be incorporated into an existing image generation system such as OSTree or may be implemented as a separate system. In exemplary operation, the image generation service40obtains the filesystem tree30comprising the plurality of filesystem files32(0)-32(F). In some examples, the image generation service40may retrieve the filesystem tree30in the form of an RPM package from the package repository28using conventional package management systems and libraries (e.g., an rpm-ostree system and a libdnf package management library, as non-limiting examples).

The image generation service40also obtains the container image36comprising the plurality of container files38(0)-38(C) (e.g., from the container registry34). Some examples may provide that the mechanism for obtaining the container image36may be implemented in a manner analogous to the rpm-ostree system, but employing OCI-based mechanisms for accessing the container registry34. The image generation service40next generates, based on the filesystem tree30and the container image36, a filesystem image42that includes the filesystem tree30and the plurality of container files38(0)-38(C). In some examples, the image generation service40may generate the filesystem image42by incorporating the plurality of container files38(0)-38(C) into the filesystem tree30(i.e., based on the metadata provided by the container image36) such that replication of the filesystem tree30results in both a bootable filesystem as well as an executable container.

Some examples may provide that the image generation service40also configures the filesystem tree30to automatically execute a container based on the plurality of container files38(0)-38(C) upon a subsequent reboot. This may be accomplished by, e.g., modifying a configuration file, folder, or directory within the filesystem tree30that defines applications and services to execute upon rebooting. The image generation service40then stores the filesystem image42on the persistent data store18.

The image generation service40in some examples may subsequently atomically deploy the filesystem tree30and the plurality of container files38(0)-38(C) to the target computing device20using the filesystem image42. As seen inFIG.1, deploying the filesystem tree30may comprise writing the filesystem tree30to the persistent data store26of the target computing device20. Upon rebooting the target computing device20, the filesystem tree30provides a bootable filesystem for the target computing device20and also provides the files to execute a container44on the target computing device20.

Some examples may provide that a modification to a container file, such as the container file38(0) of the plurality of container files38(0)-38(C), is identified after the filesystem image42is stored (e.g., as a result of execution of the corresponding container44on the target computing device20). The image generation service40in such examples may generate a layer46indicating the modification to the container file38(0). The layer46in some examples may comprise an identification of a difference between the original container file38(0) and the modified container file38(0). The image generation service40may then modify the filesystem image42to include the layer46. In this manner, subsequent deployments of the filesystem image42will reflect the modification to the container file38(0).

It is to be understood that, because the image generation service40is a component of the computing device12, functionality implemented by the image generation service40may be attributed to the computing system10generally. Moreover, in examples where the image generation service40comprises software instructions that program the processor device16to carry out functionality discussed herein, functionality implemented by the image generation service40may be attributed herein to the processor device16. It is to be further understood that while, for purposes of illustration only, the image generation service40is depicted as a single component, the functionality implemented by the image generation service40may be implemented in any number of components, and the examples discussed herein are not limited to any particular number of components. Additionally, it is noted that while, for purposes of illustration and simplicity, the examples are illustrated as being implemented by a processor device set that includes a single processor device on a single computing device, in other environments, such as a distributed and/or clustered environment, the examples may be implemented on a computer system that includes a processor device set that includes a plurality of processor devices of a plurality of different computing devices, and functionality of the examples may be implemented on different processor devices of different computing devices. Thus, irrespective of the implementation, the examples may be implemented on a computer system that includes a processor device set made up of one or more processor devices of one or more computing devices.

FIGS.2A and2Bprovide a flowchart48to illustrate exemplary operations performed by the computing system10ofFIG.1for generating filesystem images with integrated containers according to one example. Elements ofFIG.1are referenced in describingFIGS.2A and2Bfor the sake of clarity. It is to be understood that, in some examples, some operations illustrated inFIGS.2A and2Bmay be performed in an order other than illustrated herein, and/or may be omitted. InFIG.2A, operations with the processor device16ofFIG.1(e.g., by executing the image generation service ofFIG.1) obtaining a filesystem tree (e.g., the filesystem tree30ofFIG.1) comprising a plurality of filesystem files (e.g., the plurality of filesystem files32(0)-32(F) ofFIG.1) (block50). In some examples, the operations of block50for obtaining the filesystem tree30may comprise obtaining the filesystem tree using a package repository such as the package repository28ofFIG.1(block52). Some examples may provide that the operations of block52for obtaining the filesystem tree30using the package repository28may comprise obtaining the filesystem tree30using an rpm-ostree system and a libdnf package management library (block54).

The image generation service40also obtains a container image (e.g., the container image36ofFIG.1) comprising a plurality of container files (e.g., the plurality of container files38(0)-38(C) ofFIG.1) (block56). According to some examples, the operations of block56for obtaining the container image36may comprise obtaining the container image36from a container registry such as the container registry34ofFIG.1(block58). The image generation service40then generates, based on the filesystem tree30and the container image36, a filesystem image (e.g., the filesystem image42ofFIG.1) comprising the filesystem tree30and the plurality of container files38(0)-38(C) (block60). In some examples, the operations of block60for generating the filesystem image42may comprise the image generation service40incorporating the plurality of container files38(0)-38(C) into the filesystem tree30(block62). Operations in some examples may then continue at block64ofFIG.2B.

Referring now toFIG.2B, some examples may provide that the image generation service40configures the filesystem tree30to automatically execute a container (e.g., the container44ofFIG.1) based on the plurality of container files38(0)-38(C) upon a subsequent reboot (block64). The image generation service40then stores the filesystem image42on a persistent data store18(block66).

According to some examples, the image generation service40may subsequently identify a modification to a container file (e.g., the container file38(0) ofFIG.1) of the plurality of container files38(0)-38(C) (block68). The image generation service40may next generate a layer (e.g., the layer46ofFIG.1) indicating the modification to the container file38(0) (block70). The image generation service40may then modify the filesystem image42to include the layer46(block72). In some examples, the image generation service40may atomically deploy the filesystem tree30and the plurality of container files38(0)-38(C) to a target computing device (e.g., the target computing device20ofFIG.1) using the filesystem image42(block74).

FIG.3is a simpler block diagram of the computing system10ofFIG.1for generating filesystem images with integrated containers, according to one example. The computing system76ofFIG.3includes a computing device78that comprises a system memory80and a processor device82communicatively coupled to the system memory80. The computing device78further includes a persistent data store84. In exemplary operation, the processor device82obtains a filesystem tree86comprising a plurality of filesystem files88(0)-88(F). The processor device82also obtains a container image90comprising a plurality of container files92(0)-92(C). The processor device82next generates, based on the filesystem tree86and the container image90, a filesystem image94that includes the filesystem tree86and the plurality of container files92(0)-92(C). The processor device82then stores the filesystem image94on the persistent data store84.

To illustrate a simplified method for generating filesystem images with integrated containers in the computing system76ofFIG.3according to one example,FIG.4provides a flowchart96. Elements ofFIG.3are referenced in describingFIG.4for the sake of clarity. InFIG.4, operations begin with the processor device82of the computing device78obtaining the filesystem tree86comprising the plurality of filesystem files88(0)-88(F) (block98). The processor device82also obtains a container image90comprising a plurality of container files92(0)-92(C) (block100). The processor device82generates, based on the filesystem tree86and the container image90, the filesystem image94comprising the filesystem tree86and the plurality of container files92(0)-92(C) (block102). The processor device82then stores the filesystem image94on the persistent data store84(block104).

FIG.5is a block diagram of a processor-based computing device106(“computing device106”), such as the computing device12ofFIG.1in some examples, suitable for implementing examples according to one example. The computing device106may comprise any computing or electronic device capable of including firmware, hardware, and/or executing software instructions to implement the functionality described herein, such as a computer server, a desktop computing device, a laptop computing device, a smartphone, a computing tablet, or the like. The computing device106includes a processor device108, a system memory110, and a system bus112. The system bus112provides an interface for system components including, but not limited to, the system memory110and the processor device108. The processor device108can be any commercially available or proprietary processor.

The system bus112may be any of several types of bus structures that may further interconnect to a memory bus (with or without a memory controller), a peripheral bus, and/or a local bus using any of a variety of commercially available bus architectures. The system memory110may include non-volatile memory114(e.g., read-only memory (ROM), erasable programmable ROM (EPROM), electrically EPROM (EEPROM), etc.), and volatile memory116(e.g., RAM). A basic input/output system (BIOS)118may be stored in the non-volatile memory114and can include the basic routines that help to transfer information among elements within the computing device106. The volatile memory116may also include a high-speed RAM, such as static RAM, for caching data.

A number of modules can be stored in the storage device120and in the volatile memory116, including an operating system122and one or more program modules124(e.g., the image generation service40ofFIG.1) which may implement the functionality described herein in whole or in part. It is to be appreciated that the examples can be implemented with various commercially available operating systems122or combinations of operating systems122. All or a portion of the examples may be implemented as a computer program product stored on a transitory or non-transitory computer-usable or computer-readable storage medium, such as the storage device120, which includes complex programming instructions, such as complex computer-readable program code, to cause the processor device108to carry out the steps described herein. Thus, the computer-readable program code can comprise software instructions for implementing the functionality of the examples described herein when executed on the processor device108. The processor device108may serve as a controller, or control system, for the computing device106that is to implement the functionality described herein.

An operator may also be able to enter one or more configuration commands through a keyboard (not illustrated), a pointing device such as a mouse (not illustrated), or a touch-sensitive surface such as a display device (not illustrated). Such input devices may be connected to the processor device108through an input device interface126that is coupled to the system bus112but can be connected by other interfaces, such as a parallel port, an Institute of Electrical and Electronic Engineers (IEEE) 1394 serial port, a Universal Serial Bus (USB) port, an IR interface, and the like.

The computing device106may also include a communications interface128suitable for communicating with a network as appropriate or desired. The computing device106may also include a video port130to interface with a display device to provide information to a user.