ZFS and Containers

Michael Crogan will give a talk on ZFS and Containers at the OpenZFS Developer Summit 2016:

The power of ZFS (in particular: copy-on-write, hierarchies of snapshots and clones, and zfs send/receive) can be coupled with Linux container technology (I've chosen OpenVZ, but Docker+criu could work just as well) to augment the experience for both development and application deployment.

The baseline combination of OpenZFS and OpenVZ (for which I have created a Debian 7 Vagrant image) enables ecosystems of applications to be constructed as a hierarchy of clones. I've collaborated on a project that synchronises ZFS snapshot and clone hierarchies across systems (including OS container images); this work can be leveraged for both individual and team development. The technology couples dataset hierarchies with the OS and application container images that incorporate the data, to better facilitate live migration, synchronisation, and failover to the cloud. Kinds of datasets that may be injected into a running container include: home directories, work environment shared source and utilities, log directories, temporary and ephemeral data.

With ongoing and future developments to ZFS dataset encryption on Linux, the synchronisation mechanism (for instance: more robust and versatile notions for dependency graphs, and the ability to "rebase" a collection of images into a more efficient representation centered around clusters of similar functionality), deduplication layers, and with OS/application compartmentalisation as a default principle, we can enable interesting enhancements for development and production systems that currently have barriers to entry. With a few simple short commands, datasets are snapshotted, differenced, cloned, synchronised, or destroyed as needed; and containers are created or checkpointed as necessary to support the requested operation.

With this tooling and technology in place, it then becomes practical to (1) efficiently share a base filesystem (in a collaborative work setting) that's encrypted with a group key; to (2) quickly transfer the live running state of a system to a co-worker for debugging - with full-fidelity reproducibility baked in; to (3) flag a dataset or OS image as temporary or ephemeral such that the base for the image is public/shared but new files and blocks written use the custom key; to (4) flag a dataset to be of "log" type so that reading the data later requires a private archive key; and to (5) support the evolution of a separate home directory shared between containers and applications. Carefully and responsibly crafting such ecosystems of datasets facilitates more efficient, thorough, transparent, and compartmentalised backup and failover. And to contrast, the storage footprint for a privacy-focused project (Qubes OS) falls far short on this efficiency front.

I'll demonstrate the synchronisation project's current capabilities, and will elaborate upon what else is possible with ongoing extensions to ZFS and further work. An emphasis will be placed on the advantages of letting datasets and running containers automatically accumulate in orthogonal compartments that have different properties. And some advantages of using containers over virtual machines in this environment will be discussed. In the time to follow between now and the conference, I may also be able to complete work on a proof-of-concept leaner version of Qubes OS, with emphasis on the privacy aspects and the relative increase in storage efficiency using this architecture over its current one (which uses lightweight VMs and orthogonal OS images).