How Microsoft helped Docker with LinuxKit and Moby Project

Today, supporting Linux is as critical to Microsoft as it is to Red Hat and SUSE. (Linux  now runs on one out of three machines in Azure cloud.)

Surprisingly, Microsoft is doing an incredible job showing how critical Linux is to Azure’s success. On the developer side, Microsoft worked with Canonical to build a subsystem for Linux so developers can use Linux utilities and tools natively on Windows 10 without having to make compromises with virtual machines or workarounds like Cygwin. On the server and cloud side, where everything is getting containerized, Microsoft is working closely with companies like Docker to bring the Microsoft world closer to the Linux world.

Microsoft and Docker have been working together for more than three years now around adding Linux container support in Windows. One can see traces of Microsoft in many Docker products and projects, including Docker for Windows, Docker for Azure and the recently announced LinuxKit and Moby Project.

“The genesis of LinuxKit, was all that work that we did on boot2docker project. All of the original work was done by the Microsoft Open Technologies group. They were contributing all that work they started to ensure that boot2docker as an image would work well under Hyper-V,” said Taylor Brown, lead program manager for Windows Server and Hyper-V Containers.

Microsoft has been working with Docker for all these years helping the Docker team understand what pieces to use and how to better use Hyper-V as a platform. “That’s what got us to where the LinuxKit is today — a lot of boot2docker pieces, a lot of Moby pieces which lead up to that point,” said Brown.

A two-way street

Microsoft also borrowed some neat ideas from Linux containers. “Docker combines some complex kernel features into a simple-to-use, easy developer experience that we all love, and Windows teams wanted the same developer experience for Windows developers so they took the open source Docker engine, combined it with some complex Windows kernel features and created Windows Server Containers,” John Gossman, lead architect, Microsoft Azure team and a board member at the Linux Foundation told the audience at DockerCon, last week.

Working in isolation

However, Microsoft wanted to solve some more complicated problems. Whether it’s Windows Server Containers or Linux containers, they share the same kernel as the host operating system. There are instances where someone may not want to or can’t share a kernel. It could be that a developer is running a kernel on his or her development laptop that’s different from a specialized kernel running in production. Or perhaps a container requires a specific version of a kernel or driver that a developer wants to share with other containers.

One way to achieve this is through a complex mix of containers and virtual machines, but then there is added complexity and lost performance, which kind of defeats the whole purpose.

Gossman explained that Microsoft solved this problem by creating Hyper-V isolation for containers, which wraps a container in a very lightweight, optimized virtual machine designed to run nothing but containers. “Each container gets its own copy of the kernel for the isolation it needs and yet you get more performance advantage or that shared kernel container,” he said.

This technology has been available in Windows Server 2016, which worked with Linux containers, but at DockerCon, Microsoft announced  support for Hyper-V isolation to Linux containers running on Windows.

That’s where LinuxKit also comes into play. Forthcoming versions of Docker for Windows and Docker for Azure will combine LinuxKit as Hyper-V isolation for the best possible experience running Linux containers on Windows.

Customers will be able to choose whichever kernel they want to run inside that isolated box. There may be cases when someone wants a kernel from a particular vendor for their app, or a particular version of the kernel, or a particular driver. “APIs specify not only the container image you want to use, but the version of the Linux kernel you want to use in the scenario. We are working with all major Linux vendors to make sure that their kernel is available to operate in this mode,” said Gossman.

“I expect to see a lot of heterogenous deployments, where customers will have some Red Hat images to support some components that they need next to container images that are running LinuxKit. There should be no difference, it’s just Docker containers,” said Brown, “The magic of the Hyper-V isolation is that you do ‘docker run’ and we just take care of the rest of it for you.”