.png){kind=icon}
.png){kind=icon}
Return
Cordon: Enhancing security through kernel-level control in containerized computing environments
.png){kind=icon}
PRE
AI
DOI：10.1016/j.cose.2025.104644.png)
.png){kind=icon}
Original request for help.png){kind=icon}
Share.png){kind=icon}
Save
Abstract
En 中文
Containers have become a foundational technology across a variety of computing environments, enabling an era of agility, efficiency, and scalability due to their inherent advantages. Simultaneously, containers confront escalating security threats, with vulnerabilities being exploited to compromise host machines and broaden attack impacts. Existing security mechanisms predominantly rely on host-based mandatory access control, which contradicts the autonomy and flexibility requirements of dynamic and scalable containerized computing environments. This paper introduces Cordon, a novel framework aimed at providing autonomous and flexible control management within the context of containerized computing, effectively addressing the limitations of existing security mechanisms. Cordon is designed to counter common attack vectors in containerized environments by implementing file access control, capability management, and system call interception, thereby enabling comprehensive container-aware security enforcement at the kernel level. Furthermore, Cordon supports multi-container management, enabling the application of security policies across various dimensions of container resources, a feature that allows for the batch security management of containers of the same type, such as multiple container instances deployed under the same Kubernetes deployment. We develop a prototype implementation of Cordon and evaluate its effectiveness, generality, and performance overhead. Our evaluation demonstrates that Cordon effectively blocks various container attacks while maintaining acceptable overhead.
Keywords:
container security
access control
capability management
system call interception
Kubernetes
Journal
C
IF:
5.4
Papers:
4.6K
Citations:
1.4W