.png){kind=icon}
返回
vKernel: Enhancing Container Isolation via Private Code and Data
.png){kind=icon}
OA
AI
DOI：10.1109/TC.2024.3383988.png)
.png){kind=icon}
原文求助.png){kind=icon}
分享.png){kind=icon}
收藏
摘要
En 中文
Container technology is increasingly adopted in cloud environments. However, the lack of isolation in the shared kernel becomes a significant barrier to the wide adoption of containers. The challenges lie in how to simultaneously attain high performance and isolation. On the one hand, kernel-level isolation mechanisms, such as seccomp, capabilities, and apparmor, achieve good performance without much overhead, but lack the support for per-container customization. On the other hand, user-level and VM-based isolation offer superior security guarantees and allow for customization, since a container is assigned a dedicated kernel, but at the cost of high overhead. We present vKernel, a kernel isolation framework. It maintains a minimal set of code and data that are either sensitive or prone to interference in a vKernel Instance (vKI). vKernel relies on inline hooks to intercept and redirect requests sent to the host kernel to a vKI, where container-specific security rules, functions, and data are implemented. Through case studies, we demonstrate that under vKernel user-defined data isolation and kernel customization can be supported with a reasonable engineering effort. An evaluation of vKernel with micro-benchmarks, cloud services, real-world applications show that vKernel achieves good security guarantees, but with much less overhead.
Keyword:
Kernel
Containers
Security
Codes
Virtual machine monitors
Interference
Virtualization
Container
kernel
isolation
performance
期刊
IF:
3.8
论文数:
5.4K
被引数:
9.8K
机构
引用论文
.png){kind=icon}
Consequences of Outsourcing Strategies On Employee Quality of Work Life, Attitudes, and PerformanceOAAI
OAAI分享收藏Stochastic static fault slip inversion from geodetic data with non-negativity and bound constraints具有非负性和约束约束的大地测量数据的随机静态断层滑动反演
OAAI
OAAI分享收藏
查看更多内容