Container Service for Kubernetes:Use Alibaba Cloud Linux 2 (EOL)

IP Virtual Server (IPVS)

Scenario 1: High-vCPU instances with large numbers of virtual IPs

On instances with more than 64 vCPUs running in IPVS mode, the IPVS estimation timer periodically computes the transmission rate of each connection. Under a large number of concurrent connections, this computation monopolizes the CPU for extended periods, delaying packet reception and producing ping times of 200 ms.

ACK schedules the estimation timer to a dedicated node and adds a sysctl entry to disable it, eliminating the latency caused by the timer.

Scenario 2: Rolling updates

During a rolling update, if the 5-tuple of a new TCP SYN packet matches an existing IPVS conntrack record, IPVS drops the packet instead of forwarding it to the new destination. This causes SYN retransmission and a 1-second latency spike.

ACK resolves this by releasing TIME_WAIT connections from the conntrack table when new conntrack entries exist, replacing them with new connections. Network traffic switches to new real servers with near-zero latency.

CoreDNS

Scenario: High DNS query volume filling the conntrack table

When applications send DNS queries to static addresses or ports, conntrack entries enter stream mode. Because DNS uses UDP—a stateless protocol—these entries accumulate quickly. If they are not removed in time, the conntrack table fills up and degrades NAT performance.

ACK applies two fixes:

• UDP conntrack entries enter stream mode only after a connection persists for more than 2 seconds, preventing rapid accumulation from short-lived queries.

• The validity duration of UDP conntrack entries is reduced from 180 seconds to 120 seconds.

In the testing environment, these changes reduce the number of UDP conntrack entries by 50%.

Container networking

The Terway network plugin supports the IPVLAN driver, which improves network performance in short-packet communications by 40% compared to the traditional bridge interface and policy-based routing (PBR).

For workloads that require frequent Internet access, configure the BBR congestion control algorithm on containers to improve bandwidth stability and accelerate image pulls from the Internet.

Container security

Alibaba Cloud has established partnerships with the Kata Containers and Clear Linux communities. ACK optimizes runV container boot time so that Kata Containers works as expected on ECS bare metal instances. ACK also provides clusters that run sandboxed containers, offering an experience similar to standard clusters. Deploy applications in lightweight sandboxed environments to isolate workloads across tenants or to run untrusted applications with minimal performance impact.

AutoScaler

When the cluster is overloaded, AutoScaler scales out ECS instances to handle the load. Alibaba Cloud Linux 2 reduces ECS instance boot time by an average of 60% compared to CentOS 7, which means new nodes become available faster and computing capacity scales out before traffic spikes cause service degradation.

Resource monitoring and control

The Alibaba Cloud Linux 2 kernel provides fine-grained resource visibility and control for containers, including Pressure Stall Information (PSI) metrics, per-cgroup kswapd, and memory priority. In ACK clusters, use CGroup Controllers to configure these capabilities and make on-the-fly adjustments using tools such as BufferIO Control, TCP, CPUSet, Mem, and NUMA. This improves resource utilization and reduces interference between co-located applications.

AI and data acceleration

Alibaba Cloud Linux 2 optimizes streaming reads and writes for large model files, which accelerates AI training and high-performance computing workloads on large-sized instances. Benchmark results from the staging environment:

Resource visibility

When multiple containers share a host, resource contention becomes difficult to observe. Alibaba Cloud Linux 2 enhances the kernel's cgroup implementation to expose per-container resource usage. Commands such as top, cpuinfo, and meminfo reflect the actual resources available to each container rather than the host totals, making resource planning more accurate.

Kernel and storage optimizations

• Reduces OverlayFS performance overhead, minimizing storage-layer overhead from containerization.

• In Linux kernel 4.19, most sysctls are namespaced. Set different TCP timeout and retransmit timeout values per pod to match the requirements of each application—something not possible with CentOS 7.