Investigating Media over IP Multicast Hurdles

Presenters : Greg Shay - Telos Alliance

Year : 2019

dlp_document_download : AIMS IP Showcase IBC 2019 September 2019 Curated by Video Services Forum vsf.tv 1 I P S H O W C A S E T H E AT R E AT I B C 2 0 1 9 : 1 3 –1 7 S E P T 2 0 1 9 C U R A T E D B Y Investigating Media over IP Multicast Hurdles in Containerized Platforms Greg Shay, CTO The Telos Alliance I P S H O W C A S E T H E AT R E AT I B C 2 0 1 9 : 1 3 –1 7 S E P T 2 0 1 9 Agenda •Why containerized software is important to the broadcast industry •The Problem: Why Docker and multicast don’t mix 2 AIMS IP Showcase IBC 2019 September 2019 Curated by Video Services Forum vsf.tv 2 I P S H O W C A S E T H E AT R E AT I B C 2 0 1 9 : 1 3 –1 7 S E P T 2 0 1 9 Why containerized software is important to the broadcast industry: ‒Modern IT software deployment and management •Automation of facility and maintenance •Script controlled •‘Multiple products in multiple containers’ ‒Modern delivery system •Docker Hub, global access •Better fits the modern Dev -ops model of running an automated facility. "We are selling to facility IT managers, who want products delivered to them according to how they work" 3 I P S H O W C A S E T H E AT R E AT I B C 2 0 1 9 : 1 3 –1 7 S E P T 2 0 1 9 Differences between containers and VMs: ‒Containers are lighter weight: •No built in OS overhead •Use the network I/O of the host ‒VM’s are heavier weight, images are larger files •VM includes a complete OS •Needs configuration of the OS and internal networking 4 AIMS IP Showcase IBC 2019 September 2019 Curated by Video Services Forum vsf.tv 3 I P S H O W C A S E T H E AT R E AT I B C 2 0 1 9 : 1 3 –1 7 S E P T 2 0 1 9 Containers have the convenient global delivery system of Docker Hub ‒Simple vendor version control to customer CI / CM ‒VM images lack a universal delivery system. •VM "open virtualization format" (OVF) generic image format may serve for universal delivery. •But still lack the standardized delivery and installation mechanism. 5 I P S H O W C A S E T H E AT R E AT I B C 2 0 1 9 : 1 3 –1 7 S E P T 2 0 1 9 My Wish: I would like to be able to use Docker containers for delivery of my broadcast processing products take advantage of the customer friendly Docker Hub CI/CD infrastructure. The Problem ? Docker containers do not work with Multicast ! 6 AIMS IP Showcase IBC 2019 September 2019 Curated by Video Services Forum vsf.tv 4 I P S H O W C A S E T H E AT R E AT I B C 2 0 1 9 : 1 3 –1 7 S E P T 2 0 1 9 Digging into why Docker and multicast don’t mix: ‒Fundamentally, containerized software uses the namespace feature of modern Linux kernels. ‒This allows a set of software to run in isolation, as if it had the whole machine’s resources to itself, even named pseudo -network interfaces. ‒ The named network interfaces do their job by using the Linux Kernel IP tables, which route packets internal to the kernel, to and from physical NIC ports. (Docker does not virtualize network interface hardware.) 7 I P S H O W C A S E T H E AT R E AT I B C 2 0 1 9 : 1 3 –1 7 S E P T 2 0 1 9 The root of the multicast problem is the specific design of the way that the Linux kernel handles multicast routing. ‒No fixed multicast routes can be put into the IP tables of the kernel. All multicast routing rules are dynamic. Further difficulty: Routing vs Snooping ‒The kernel assumes it is doing multicast routing (i.e. using PIM requiring configuration of PIM routing between each container and the hosting machine.) ‒However media facilities are often built with networks that are not doing true multicast routing but are built using Layer 3 snooping switches . 8 AIMS IP Showcase IBC 2019 September 2019 Curated by Video Services Forum vsf.tv 5 I P S H O W C A S E T H E AT R E AT I B C 2 0 1 9 : 1 3 –1 7 S E P T 2 0 1 9 Our desire is to have Docker containers coexist on a host machine, sharing a network and having the container hosted network act as L3 snooping switch. But the Linux kernel, assuming it is routing multicast, will not act as a snooping switch and not even pass the IGMP queries and subscription packets that have a TTL equal to 1, to the client containers, enabling the IGMP clients inside each container to subscribe and respond. 9 I P S H O W C A S E T H E AT R E AT I B C 2 0 1 9 : 1 3 –1 7 S E P T 2 0 1 9 What do to? A quick and dirty partial shortcut: ‒Run the container with " --net=host ", and the container is connected to all the networking resources of the Docker Engine host machine. •Does not isolate containers into their own IP addresses (uses the host IP) •Does not isolate containers to be able to use their own ports (ports have to be mapped) No nice structure of ‘multiple products in multiple containers’. Defeats the purpose of containerized software! 10 AIMS IP Showcase IBC 2019 September 2019 Curated by Video Services Forum vsf.tv 6 I P S H O W C A S E T H E AT R E AT I B C 2 0 1 9 : 1 3 –1 7 S E P T 2 0 1 9 What else do to? ‒ Some suggest wrapping a VM around each docker container, just to achieve the independence of multicast network routing by emulating the full network interface, and make use of the virtual switch in the VM host. •But this still defeats capturing and delivering the behavior of the containerized product in a self -contained software deliverable.  More work exploring how to make IP tables inside the Linux kernel behave as a L3 snooping switch. No goal yet ! Sometimes you make progress by moving the ball forward.. 11 I P S H O W C A S E T H E AT R E AT I B C 2 0 1 9 : 1 3 –1 7 S E P T 2 0 1 9 Thank you Thank you to our Media Partners Greg Shay, Telos Alliance greg.shay@telosalliance.com 12