Building a Global-Scale Multi-Tenant Cloud Platform on AWS and Docker: Lessons Learned

Felix Gessert, Florian Bücklers
{fg,fb}@baqend.com
Building a Global-Scale Multi-
Tenant Cloud Platform on AWS and
Docker: Lessons Learned
@baqendcom

Docker
Concepts
Clustering: AWS ECS vs.
Docker Swarm
Part One Part Two Part Three
Baqend & Our
Infrastructure

Average: 9,3s
The Latency Problem
Loading…

Average: 9,3s
The Latency Problem
Loading…
-1% Revenue
100 ms

Average: 9,3s
The Latency Problem
Loading…
-1% Revenue
-9% Visitors
400 ms

Average: 9,3s
The Latency Problem
Loading…
-1% Revenue
-9% Visitors
500 ms
-20% Traffic

If perceived speed is such an
import factor
...what causes slow page load times?

State of the Art
Twobottlenecks: latencyund processing

State of the Art
Processing Time

State of the Art
High Latency
Processing Time

Problem: Network Latency
I. Grigorik, High performance browser networking.
O’Reilly Media, 2013.

Problem: Netzwerklatenz
I. Grigorik, High performance browser networking.
O’Reilly Media, 2013.
2× Bandwidth = Same Load Time
½ Latency ≈ ½ Load Time

Low-Latency
Data is served by ubiquitous web-caches

Low-Latency
Low Latency

Low-Latency
Low Latency
Less Processing

Scaling
Scalable and highlyavailable

5 Years
Research & Development
New Algorithms
Solve Consistency Problem
Innovation
Problem: changescause stale data

5 Years
New Algorithms
Stale
Data
Innovation
Problem: changescause stale data

Innovation
Solution: Baqendproactivelyrevalidates data
Bloomfilter
update1 0 11 0 0 10 1 1
5 Years
New Algorithms

Innovation
Bloomfilter
updateIs still fresh? 1 0 11 0 0 10 1 1
5 Years
New Algorithms

Innovation
F. Gessert, F. Bücklers, und N. Ritter, „ORESTES:a Scalable
Database-as-a-Service Architecture for Low Latency“, in
CloudDB 2014, 2014.
F. Gessert und F. Bücklers, „ORESTES: ein System für horizontal
skalierbaren Zugriff auf Cloud-Datenbanken“, in Informatiktage
2013, 2013.
F. Gessert, S. Friedrich, W. Wingerath, M. Schaarschmidt, und
N. Ritter, „Towards a Scalable and Unified REST API for Cloud
Data Stores“, in 44. Jahrestagung der GI, Bd. 232, S. 723–734.
F. Gessert, M. Schaarschmidt, W. Wingerath, S. Friedrich, und
N. Ritter, „The Cache Sketch:Revisiting Expiration-based
Caching in the Age of Cloud Data Management“, in BTW 2015.
F. Gessert und F. Bücklers, Performanz- und
Reaktivitätssteigerung von OODBMS vermittels der Web-
Caching-Hierarchie. Bachelorarbeit, 2010.
F. Gessert und F. Bücklers, KohärentesWeb-Caching von
Datenbankobjektenim Cloud Computing. Masterarbeit 2012.
W. Wingerath, S. Friedrich, und F. Gessert, „Who Watches the
Watchmen? On the Lack of Validation in NoSQL
Benchmarking“, in BTW 2015.
M. Schaarschmidt, F. Gessert, und N. Ritter, „Towards
Automated Polyglot Persistence“, in BTW 2015.
S. Friedrich, W. Wingerath, F. Gessert, und N. Ritter, „NoSQL
OLTP Benchmarking: A Survey“, in 44. Jahrestagungder
Gesellschaftfür Informatik, 2014, Bd. 232, S. 693–704.
F. Gessert, „Skalierbare NoSQL- und Cloud-Datenbanken in
Forschung und Praxis“, BTW 2015

Page-Load Times
What impact doescaching have in practice?

Page-Load Times
What impact doescaching have in practice?0,7s
1,8s
2,8s
3,6s
3,4s
CALIFORNIEN
0,5s
1,8s
2,9s
1,5s
1,3s
FRANKFURT
0,6s
3,0s
7,2s
5,0s
5,7s
SYDNEY
0,5s
2,4s
4,0s
5,7s
4,7s
TOKYO

How is this used from a
develeoper‘s
perspective?
Backend-as-a-Service

DB.Tankstellen.find()
.near("location", myLoc, 5000)
.lessThen("closing", time)
.greaterThen("opening", time)
.descending("price")
.resultList();

Baqend Architecture
OurInfrastructure
Content-Delivery-
Network
Polyglot Storage

Baqend Architecture
OurInfrastructure
Content-Delivery-
Network
Database-as-a-Service Middleware:
Caching, Transactions, Schemas,
Invalidation Detection, …

Baqend Architecture
OurInfrastructure
Content-Delivery-
Network
Standard HTTP Caching

Baqend Architecture
OurInfrastructure
Content-Delivery-
Network
Unified REST API

Baqend Architecture
Our Infrastructure
Content-Delivery-
Network
IaaS-Cloud
on

Baqend Architecture
Our Infrastructure
Content-Delivery-
Network
IaaS-Cloud
on
CDN
on

n
Orestes
1
mongos
1
1
1
ZooKeeper
BBQ Manager
Swarm Manager
1
syslog
1
mongos
Docker Cluster
n
Node
Docker Link
HTTPS on
Random Port
metadata
data
Docker Daemon
Users
HTTP/HTTPS
Forbidden
Docker DaemonDocker Daemon
Virtual Private Cloud
1 Logging
Server
1 Management
Server
N App Servers
SSL

 Route 53, EC2, ASGs, IAM etc.
 Elastic LoadBalancer: TCP Balancing for Logging
◦ Not suited for multi-tenant SSL termination: ELB cannot
dynamically route to an IP:port pair
 RedisElastiCache: Metadata Storage
◦ Easy to use but very limited: no Redis cluster support, no
append-only files, bad snapshotting
 What we don‘t use:
◦ Beanstalk: supports Docker but needs a dedicated EC2 instance
◦ Cloudfront: useless invalidations, expensive
◦ DynamoDB: difficult to scale, very limited queries
AWS Services
Serviceswe use

 Every tenant needs a private JVM and Node.JS process

Containerization
Why we needcontainers& cluster management
Baqend
Server
Customer‘s
Business
Logic

 Every tenant needs a private JVM and Node.JS process
 Provisioning new instances needs to be fast & easy:
Containerization
Why we needcontainers& cluster management
Baqend
Server
Customer‘s
Business
Logic
Launch
App
BBQ
Manager
Start
Configure databases,
CDN, etc.

Problem: Many Technology Choices
Emerging Frameworksand Tools
 Cluster Managers & Orchestration Tools:

Google Kubernetes Apache Mesos Docker Swarm

Container Cloud Platforms:
Amazon Elastic
Container Service
RancherTutum Google Container
Engine

Container Cloud Platforms:
Amazon Elastic
Container Service
RancherTutum Google Container
Engine
and many more: Azure Container
Service (Microsoft), Nomad
(HashiCorp), Diego (Cloud Foundry),
Fleet (CoreOs), ContainerShip, YARN
(Hadoop), …

Live Demo: Launching a container

Docker Concepts
What is Docker?
Source: https://docs.docker.com/engine/introduction/understanding-docker/
 The docker image can be hosted and transferred to different
hosts (DockerRegistry)
 The docker image can be executedas a new container on any
machine that runs a Dockerdaemon
 Updatesare handled by just stopping and starting a new
container
 Docker typically
isolates a single
application
 An applicationis built
into a Dockerimage
(including the OS)

 Docker runs on all common Linux distributions
 Docker can be installed from Docker’s own package
repository
 The Docker daemon can be configured by editing
/etc/default/docker
 The Docker daemon allows many useful configurations:
◦ Inter-container communication
◦ Docker remote REST API
◦ Labeling
◦ DNS configuration
◦ IP forwarding (disables internet for containers)
◦ SSL encryption for the Docker damon
Docker Architecture
Howto set up a Dockerhost

The Dockerfile
Howto builda Dockerimage
FROM ubuntu:latest
ENV DEBIAN_FRONTEND noninteractive
# java
RUN apt-get install -y software-properties-common &&
add-apt-repository -y ppa:webupd8team/java &&
apt-get update &&
echo debconf shared/accepted-oracle-license-v1-1 select true
| debconf-set-selections &&
apt-get install -y oracle-java8-installer
# extract and install packages
ADD baqend-package*.tgz /opt
ADD config.json /opt/baqend/
EXPOSE 8080
WORKDIR /opt/baqend/
ENTRYPOINT ["java", "-classpath", "/opt/baqend/lib/*", "info.orestes.Launcher"]
CMD ["--config", "config.json"]

 Filesystem: by using multiple read-only file systems and
mounting a read-write file system on top
 Data volumes: mount additional physical volumes into
the container
 CPU: by CPU shares and core limitation
 Memory: by defining memory constraints
 Network: by using virtual networks
 Systemprivileges: such as port binding, execution
rights, inter process communication, etc.
 Logging: by using docker logging capabilities or external
loggers (json, syslog, aws, etc...)
How a Docker container works
Isolation,performance, light-weight

 Most constraints are set when the container is started
Docker Options
Imposingconstraints on containers
--add-host=[] Add a custom host-to-IP mapping (host:ip)
--cpu-shares=0 CPU shares (relative weight)
--cpu-quota=0 Limit CPU CFS (Completely Fair Scheduler) quota
-e, --env=[] Set environment variables
-l, --label=[] Set metadata on the container (e.g., --label=key=value)
--link=[] Add link to another container
-m, --memory="" Memory limit
--memory-swap="" Total memory (memory + swap), '-1' to disable swap
--name="" Assign a name to the container
--net="bridge" Connects a container to a network
'bridge': creates a new network stack on the docker bridge
'none': no networking for this container
'container:<name|id>': reuses another container network stack
'host': use the host network stack inside the container
'NETWORK': connects the container to user-created network
--oom-kill-disable=false Whether to disable OOM Killer for the container or not
-p, --publish=[] Publish a container's port(s) to the host
--read-only=false Mount the container's root filesystem as read only
--restart="no" Restart policy (no, on-failure[:max-retry], always)
-v, --volume=[] Bind mount a volume

 Docker containers can talk to each other by default
 Communication between containers can be restricted
by the daemon option: –-icc=false
 Docker containers can discover other linked containers
by their names
Docker Networking
Making containerstalk to each other
EXPOSE 8080
docker run --name="orestes" orestes docker run --link="orestes" node
Can access orestes:8080
Port 8080 not published,
(can’t be accessed from host
or other containers)

 Docker containers can talk to each other by default
 Communication between containers can be restricted
by the daemon option: –-icc=false
 Docker containers can discover other linked containers
by their names
Docker Networking
Making containerstalk to each other
EXPOSE 8080
docker run --name="orestes"
-p 0.0.0.0:80:8080 orestes
docker run --link="orestes" node
Can access orestes:8080
Port 8080 is published and
can be accessed on the host
port 80

 AWS provides ECS-optimizedAMIs for simple deployment
 ECS manages EC2 instances by running an ECS Agent on each instance
 ECS can automatically deploy and scale new Docker containers
specified by a Task definition across the ECS Cluster
Elastic Container Service
HowAmazonECSworks
ECS Cluster
Docker Daemon
ECS Agent
Docker Daemon
ECS Agent
Docker Daemon
ECS Agent

 ECS groups containers into Tasks and deploys them
together
 A Task definitiondescribes:
◦ The Docker images
◦ Resource requirements
◦ Environment variables
◦ Network links
◦ Data Volumes
 ECS Services can be used to keep a specified number of
Tasks running
 ECS can autoscale a Service when it is used with an ELB
ECS: Tasks and Services
Defininggroupsof containers

 ECS has used an outdated version of docker, now it’s 1.9, yeah!
 Tasks can now be parametrized using commandline args
 Previously only environment variables could be passed while
starting a Task
 Environment variables are exposed to linked containers, this can
be a security issue!
Limitations that AWS fixed
Old Docker, Parameterization
docker run --name="orestes"
--env SECRET=7kekfjd9e
docker run --link="orestes" node
Can access env
ORESTES_SECRET
Untrusted ProcessSecured Process
https://docs.docker.com/engine/userguide/networking/default_network/dockerlinks/#environment-variables

 ECS uses hard memory constraints (run –m) for Tasks to
schedule container placement
 This allocates a fixed amountof memoryon the EC2 instance
and can’t be exceeded by the process
 This is very ugly for shared, multi tenant applications:
◦ Setting the constraint too low causes Docker to kill the process on
memory peaks
◦ Setting the value too high limits the number of containers that can be
launched per EC2 instance
 Neither Docker’s memory swapping nor unlimited memory
usage is allowed by ECS
Current Limitation: Memory Constraints
RestrictingRAM consumption

 Docker has introduced a new network API, which allows
to create custom virtual networks
Current Limitation: Networking
Docker‘snew network API not supported
 BridgeNetworksconnect
groups of containers together
and isolate them from other
groups on the same host
 OverlayNetworksuse a key-
value store to connect
containers across different
host machines
Source: https://docs.docker.com/engine/userguide/networking/dockernetworks/

 Very simplesetup,thanks to
the optimized ECS AMI
 Task abstraction makes it
really comfortable to start
multiple containers together
 Services ensures that the
desired count of tasks are
always up and running
 Automatically starts newEC2
instancesif no capacity is left
for new containers
 Can be combined with an ELB
for a high availability setup
 Many Docker options aren’t
available
 Service Tasks can’t be
parametrized
 Runningthe sameServices for
different tenants on the same
EC2 instance is not possible
 Only the legacy networking is
supported
 New featureswill always be
delayed since they must first
be implemented in ECS

 Docker Swarm is Docker’s nativesolution for cluster
management
 Docker Swarm uses a discovery serviceto manage the
shared state of the cluster
 The following backends for discovery are supported:
◦ Docker Hub (for development only)
◦ Static file
◦ etcd
◦ consul
◦ zookeeper
◦ IP list or a range pattern of IPs
Docker Swarm
A replacementfor ECS

Swarm Architecture
Clustermanagement withDockerSwarm
Docker Swarm Cluster
Docker Daemon
Swarm Agent
Expose 2375
Docker Daemon
Swarm Agent
Expose 2375
Docker Daemon
Swarm Agent
Expose 2375
ZooKeeper ZooKeeper
Swarm Manager
Docker Client

 The Swarm manager acts as a proxy of the Docker
Remote API
◦ All Docker run options are available in Swarm, too
 Docker Swarm can be combined with overlaynetworks
◦ Containers can connect to others by just using the containers
name (servicediscovery)
◦ Works across Docker hosts, availability zones and external
hosts
 Containers can use any other service without defining
them in a group (such as a Task)
Swarm is Docker
Fixing the shortcomingsof ECS

 Docker hosts can be added and removed to the Swarm
Cluster silently
 Swarm provides an API to gather CPU usage and
memory consumption of hosts or containers
 Swarm provides no concept to scale services within
containers
Autoscaling in Swarm
Scale-out and scale-in

 LabeledDocker daemons can be used by the manager
to run specific containers only on specific hosts
 Containers can be launched:
◦ On the same host where other containers are running
◦ In a specific availability zone
◦ On hosts with special capabilities (RAM, CPU or SSD)
 The Docker daemon can restartfailed containers using
a restart policy --restart="yes"
 Containers will also be restarted if the docker host
restarts
 Failed machines must be handled manually
High Availability in Swarm
Handling failures and outages

 Swarm requires that the Docker daemon is exposed via
TCP
 In most setups this will be a security issue since you can
easily get root permission on the Docker host
 Also containers can access the exposed API by default
 Therefore it is recommended to always secure the
Docker daemons on each host with SSL
 Docker supports SSL client, server and both
authentication mechanisms
 SSL server authentication is not very practical since it
requires a signed certificate for each host
Securing Swarm Hosts
Securitypitfalls

Securing Swarm Hosts
Securitypitfalls
 Securing a Swarm cluster requires signed SSL certificates on all
docker hosts, on the swarm manager and the docker client
Docker Swarm Cluster
Docker Daemon
Expose 2375
Docker Daemon
Expose 2375
Docker Daemon
Expose 2375
Swarm Manager
Docker Client
Certificate
Authority
Client
Certificate
Server
Certificates
Server/Client
Certificate

Wrap-up: Docker Swarm
ProsandCons
 Swarmis Docker, all Docker
options are available
 LabelingDocker hosts,
allows to deploy containers
on specific hosts
 OverlayNetworksallow
containers to communicate
across hosts
 ServiceDiscoveryacross
containers is made really
simple
 Complexsetupand many
componentsare required
for a completesetup
 No built-in way for
autoscalingservices
 Still many bugs
 The Docker Swarm API
integrationinto Docker is
not yet completed

Conclusions
ECSvs Swarm
 SimpleSetup
 Taskand Servicedefinition
makes it easy to deploy
and update containers
 Detect failuresand restart
failed tasks within services
 Integratedinto other AWS
Services such as Elastic
Load Balancers and Auto
Scaling Groups
 Complex Setup
 Many configuration options
for deploying containers
 Is compatibleto the Docker
API, allows to use all
Docker clients
 Supports Docker’s network
API
 No Vendor Lock-In

Ziel mit InnoRampUp
Want to try Baqend?
Download Community
Edition
Invited-Beta Cloud Instance
support@baqend.com
Baqend Cloud launching
this February

Building a Global-Scale Multi-Tenant Cloud Platform on AWS and Docker: Lessons Learned

More Related Content

What's hot (20)

Similar to Building a Global-Scale Multi-Tenant Cloud Platform on AWS and Docker: Lessons Learned (20)

More from Felix Gessert (8)

Recently uploaded (20)

Building a Global-Scale Multi-Tenant Cloud Platform on AWS and Docker: Lessons Learned