Library

eCommons

 

X-Containers: Breaking Down Barriers to Improve Performance and Isolation of Cloud-Native Containers

Simple item page
dc.contributor.authorShen, Zhiming
dc.contributor.authorSun, Zhen
dc.contributor.authorSela, Gur-Eyal
dc.contributor.authorBagdasaryan, Eugene
dc.contributor.authorDelimitrou, Christina
dc.contributor.authorVan Renesse, Robbert
dc.contributor.authorWeatherspoon, Hakim
dc.date.accessioned2018-08-29T21:04:30Z
dc.date.available2019-06-18T06:00:46Z
dc.date.issued2018-08-29
dc.description.abstract“Cloud-native” container platforms, such as Kubernetes, have become an integral part of production cloud environments. One of the principles in designing cloud-native applications is called “Single Concern Principle”, which suggests that each container should handle a single responsibility well. Due to the resulting change in the threat model, process isolation within the container becomes redundant in most single-concerned containers, and inter-container isolation becomes increasingly important. In this paper, we propose a new exokernel-inspired architecture called X-Containers that improves both the security and the performance of cloud-native containers. We show that, through relatively minor modifications, the Xen hypervisor can serve as an exokernel, and Linux can be turned into a LibOS. Doing so results in a highly secure and efficient LibOS platform that, unlike other available LibOSes, supports binary compatibility and multicore processing. X-Containers have up to 27× higher raw system call throughput compared to Docker containers, while also significantly outperforming recent container platforms such as Google’s gVisor, Intel’s Clear Containers, as well as Library OSes like Unikernel and Graphene on web benchmarks.en_US
dc.description.sponsorshipThis work was partially supported by the National Science Foundation (NSF) CSR-1422544, NSF NeTS CSR-1704742, the U.S. Department of Commerce, National Institute of Standards and Technology (NIST) award number 70NANB17H181, Cisco, and Huawei.en_US
dc.identifier.urihttps://hdl.handle.net/1813/58662
dc.language.isoen_USen_US
dc.rightsAttribution-NonCommercial-NoDerivatives 4.0 International*
dc.rights.urihttps://creativecommons.org/licenses/by-nc-nd/4.0/*
dc.subjectX-Containeren_US
dc.subjectCloud Computingen_US
dc.subjectCloud-Nativeen_US
dc.subjectContainersen_US
dc.subjectOperating Systemen_US
dc.subjectVirtualizationen_US
dc.titleX-Containers: Breaking Down Barriers to Improve Performance and Isolation of Cloud-Native Containersen_US
dc.typetechnical reporten_US

Files

Original bundle
Now showing 1 - 1 of 1
Thumbnail Image
Name:
x-container-tech-report.pdf
Size:
403.9 KB
Format:
Adobe Portable Document Format
Description:
Download

Collections

Computer Science Technical Reports