Alibaba Cloud Linux 2 (EOL)

The Alibaba Cloud Linux 2 operating system is designed for the Alibaba Cloud Apsara virtualization stack. It offers numerous optimizations and new features tailored for the Alibaba Cloud environment, including the following:

• The fastest booting Linux distribution on Alibaba Cloud.

• Deeply optimized for high-specification ECS virtual machines and ECS Bare Metal instances, especially for multitasking scenarios on large instances.

• Pre-installed with common Alibaba Cloud software packages, such as Cloud Assistant CLI and cloud-init, to reduce cloud resource management costs.

• A streamlined system with a minimal attack surface and the lowest system resource consumption.

• A comprehensive support system that provides multi-channel technical support on Alibaba Cloud.

• Timely fixes for software security vulnerabilities (CVEs).

• Supports Kernel Live Patching to ensure business continuity during vulnerability patching.

The performance benefits of running application instances on Alibaba Cloud Linux 2 include the following:

• Significantly optimized boot speed for ECS instances. This allows for rapid scale-out of compute resources when system load increases. The boot speed is 29% faster than CentOS 7.

• Optimized for multitasking scenarios on ECS instances. This improves the multitasking performance of high-specification instances by 16% for the same specifications.

• More efficient system calls, with an 11% improvement in system call performance.

• Optimized Linux network stack, with a 7.8% improvement in overall network performance compared with CentOS 7.

• Alibaba Cloud Linux 2 comes with the Bottleneck Bandwidth and Round-trip propagation time (BBR) congestion control algorithm pre-compiled. In scenarios with frequent public network access, you can change the congestion control algorithm to BBR to improve the bandwidth stability of public network access.

• Optimized encryption for the TLS protocol.

• Supports the new Budget Fair Queueing (BFQ) I/O scheduler to reduce cloud disk latency.

Alibaba Cloud's containerization services use kernel-level optimizations to increase the density of co-located container tasks without affecting the response time of online services. The Alibaba Cloud Linux 2 operating system and kernel include these optimizations. ACK uses these features to provide optimizations for multiple scenarios that help containerized services run faster and more smoothly.

• IPVS optimization

  • Scenario 1: High-specification machines (more than 64 CPUs) with many IPVS virtual IPs.

    Problem: The IPVS estimation timer periodically calculates the current rate of each connection. When there are many connections, this operation occupies the CPU for a long time. This causes delays in network packet reception and results in fluctuations of up to 200 ms in the response to the Ping command.

    Optimization: The IPVS estimation timer is executed on the node. Additionally, a sysctl command is added to disable IPVS statistics.

    Result: The fluctuations caused by the estimation timer are eliminated.

  • Scenario 2: Container rolling upgrades.

    Problem: During a container rolling upgrade, if the 5-tuple does not change, a new TCP SYN packet may hit the connection record of the old IPVS 5-tuple. If the packet needs to be scheduled to a new destination, IPVS drops the SYN packet by default. This causes SYN retransmission and a 1-second delay.

    Optimization: If a new conntrack entry already exists, the connection in the TIME_WAIT state is released from conntrack, and then scheduled and replaced with the new connection.

    Result: The switch to the new real server occurs with almost no delay.

• CoreDNS optimization

  Scenario 1: Many DNS queries inside a container cause the conntrack table to become full.

  Problem: When an application inside a container queries DNS for a fixed address or port, the corresponding conntrack entry enters stream mode. Because DNS requests are UDP-based, stateless, short-lived, and use a request-response pattern, conntrack maintains many useless UDP conntrack entries. These entries are not cleared promptly, which can cause the conntrack table to grow and degrade the performance of Network Address Translation (NAT).

  Optimization:

  • A UDP connection is set to stream mode only if it lasts for more than 2 seconds. This prevents the rapid growth of conntrack entries.

  • The default UDP conntrack time-to-live (TTL) is shortened from 180 s to 120 s. This allows entries to expire faster and reduces the impact on the conntrack table.

  Result: In the same test scenario, the number of UDP conntrack entries is reduced by half.

• Container network performance optimization

  On Alibaba Cloud Linux 2 nodes, the Terway network plug-in for the container service supports the IPVlan container network mode. In small packet scenarios, this improves network performance by 40% compared with traditional Bridge and policy-based routing. Alibaba Cloud Linux 2 comes with the BBR congestion control algorithm pre-compiled. In scenarios with frequent public network access, you can change the container's congestion control algorithm to BBR to improve the bandwidth stability of public network access. This significantly improves the performance of container public network connections and the speed of pulling images across the public network.

• Support and optimization for sandboxed containers

  Alibaba Cloud collaborates with the Kata Containers and Clear Linux communities. On ECS Bare Metal instances, you can seamlessly deploy the entire Kata Containers solution. ACK also optimizes the startup time of sandboxed container (RunV) images, which allows the overall Kata Containers solution to run properly. Based on this, ACK provides sandboxed container clusters that offer an experience almost identical to that of common clusters. This allows applications to run in a lightweight virtual machine sandbox environment. This is suitable for workload isolation between multiple users and for isolating untrusted applications. It enhances security with minimal performance impact.

• AutoScaler optimization

  Alibaba Cloud Linux 2 optimizes the startup speed for ECS instances, reducing the node startup time by 60% compared with CentOS 7. Combined with the flexible and efficient automatic scaling of ACK, when the application load increases, an ACK cluster automatically creates and starts ECS nodes to join the cluster based on the load. It also schedules and starts application instances. The rapid scale-out and startup capability of Alibaba Cloud Linux 2 ensures that compute resources can promptly meet peak traffic demands.

• Resource monitoring and control optimization

  The kernel of Alibaba Cloud Linux 2 provides fine-grained visualization and control capabilities for container scenarios, such as Pressure Stall Information (PSI), per-cgroup kswapd, and Memory Priority. In ACK clusters on Alibaba Cloud Linux 2, you can use the Cgroup controller to leverage these capabilities. This allows fine-grained configuration and dynamic updates of resources such as BufferIO Control, TCP, CPUSet, Mem, and NUMA. This helps gradually increase resource utilization while minimizing interference between applications.

• AI and data acceleration optimization

  The optimizations in Alibaba Cloud Linux 2 for large-scale models and multitasking can increase the speed of high-performance computing (HPC) tasks. The storage optimization for streaming reads and writes can also improve the read and write performance for large model files. Together, these greatly accelerate the efficiency of AI and HPC tasks. The following are actual test scenarios:

  • Loading 1,152 files (144 GB) from OSS using Alluxio with 64 threads takes 3 minutes and 25 seconds on CentOS. On Alibaba Cloud Linux 2, it takes only 2 minutes and 19.037 seconds, which is 1.6 times faster than on CentOS.

  • Running ResNet50 Batch 128 model training with data cached in Alluxio, a V100 GPU on CentOS achieves only 5,212.00 images/s. On Alibaba Cloud Linux 2, a V100 GPU can reach 8,746.59 images/s, which is 1.7 times faster than on CentOS.

• Enhanced display for container resources

  In a multi-container, single-host setup, the resources that are directly visible within a container are those of the host. This is not user-friendly for many applications. Alibaba Cloud Linux 2 optimizes the Cgroup resource display in the kernel. This allows the resources that are occupied by the container to be correctly displayed inside the container. For example, the information displayed by the TOP command and the CPUInfo and MemInfo interfaces is corrected. This greatly simplifies your monitoring needs.

• Other optimizations

  • It uses the Linux 4.19 kernel. ACK integrates the Alibaba Cloud kernel and containerization best practices into this kernel.

  • Reduces the performance loss of OverlayFS and minimizes the impact of containerization on storage performance.

  • Most sysctl configurations are namespaced. In the 4.19 kernel, most sysctl settings can be configured separately within a container. For example, different applications have different requirements for TCP timeout and retransmission time. These settings cannot be modified in the CentOS 7 kernel, but Alibaba Cloud Linux 2 supports configuring them at the pod level.