Running CloudABI applications on a FreeBSD based Kubernetes cluster - Ed Schouten
Channel: EuroBSDcon
Date: 2019-10-16

Description:

Two years ago, I gave a talk at EuroBSDCon in Stockholm, where I
presented a project I started working on that same year, called
CloudABI. CloudABI is a framework that allows you to design POSIX-like
programs that are very strongly sandboxed. CloudABI is comparable to
FreeBSD’s sandboxing technique Capsicum, but differs in the sense that
sandboxing has to be turned on as soon as the first instruction of
your program starts. This has a couple of interesting implications:

 You can safely run programs that you don’t trust at all, as long as
you don’t provide it access to file descriptors of resources that
should remain off-limits. This makes it a very useful building block
for a multi-tenant cloud/cluster computing service.
By having Capsicum always enabled, we can remove all of the features
that conflict with Capsicum. This allows you to modify applications to
work well with sandboxing a lot more easily. It is easy to make an
inventory of which modification need to be made, simply by looking at
compiler errors generated by the absence of the incompatible features.
Software becomes easier to test and manage. This effectively brings
the principle of Dependency Injection from object oriented programming
to full-scale programs.

In this talk, I’m going to discuss how I’ve added support for running
CloudABI-based applications directly on top of Kubernetes, an Open
Source cluster management suite. An interesting aspect of this is that
it effectively removes the dependency on Docker and makes Kubernetes
work on FreeBSD. After giving a crash course on Kubernetes, I will
present the software that I have developed to make this work.

Speaker biography:

Ed Schouten has been a developer at the FreeBSD project since 2008.
Initially, he focussed on terminals, TTYs and console drivers. Later
on he maintained a branch of FreeBSD called ClangBSD, whose purpose it
was to replace FreeBSD’s system compiler, GCC, with Clang. Nowadays,
he spends most of his time working on CloudABI.