Containing Windows Executables with Damon

Justen Walker
Dec 11, 2018 · 5 min read

Job Objects on Windows

Windows has had this concept of a Job Object since XP/Server 2003. They are a fundamental component of how containers are constructed.

Job Objects are an integral part of Windows Containers

Using Job Objects

The only way to interact with a Job Object is to use the Win32 API. DotNET has bindings to the Windows API — so you don’t exactly have to write C code, but the .NET code you’ll end up writing won’t look much different. The standard formula is as follows:

  1. Call SetInformationJobObject on the Job Object Handle. This API will be called multiple times with different parameters to set all the various resource constraints that should be applied.
  2. Call CreateProcess with the CREATE_SUSPENDED flag. This will create a new process with the main thread in a suspended state. This part is important, because we don’t want to run the process without first attaching it to the JobObject. This API will return a Process Handle and a Thread Handle.
  3. Call AssignProcessToJobObject with your Process Handle. This will bind the process to the Job Object and therefore apply all of the various resource constraints.
  4. Finally, call ResumeThread on your Thread Handle. This starts your main thread which is now contained within a Job Object.

Containing a process with Damon

Damon is an open-source, stand-alone binary written in Go that we at Jet created to help us contain our Windows applications running on HashiCorp Nomad. Damon does the opposite of Nomad: While Nomad wants to scale up and out to keep your service running; Damon is responsible for scaling it back and preventing it from monopolizing your system resources. Damon is meant to be used in conjunction with the raw_exec Nomad Task-Driver on Windows; but could also be used without it.

Running with PowerShell
Nomad raw_exec configuration
  1. You’ll have to create a service entry to advertise that port to your Prometheus scraper via Consul Service Discovery.

Contributions Welcome

Damon is still fairly new, and we are looking for ways to make it more useful by providing more constraint and isolation features. If you are interested in this, Pull Requests are welcome!


Jet Tech

Sharing our engineering org’s learnings & stories as we build the world’s best experience to shop curated brands and city essentials in one place.

130

130 claps
Justen Walker

Written by

Senior Software Engineer at Jet.com. Hacks around in Golang. Pronounces Gif with a hard 'G'. Puns always intended.

Jet Tech

Jet Tech

Sharing our engineering org’s learnings & stories as we build the world’s best experience to shop curated brands and city essentials in one place.