一句话：提出 X-Containers，以 LibOS 和最小 exokernel 隔离单关注点容器，显著提升隔离性与系统调用吞吐。
云原生容器平台（如 Kubernetes）已成为生产云环境的重要组成部分，其设计原则之一是单关注点原则，即每个容器应只负责一项职责。本文提出 X-Containers，一种用于隔离单关注点云原生容器的新安全范式。每个容器运行在支持多进程与兼容性的 Library OS（LibOS）上，并由一个最小 exokernel 提供强隔离和较小的内核攻击面。作者实现了一种利用 Xen 半虚拟化（PV）将 Linux 内核转变为 LibOS 的 X-Containers 架构，从而获得高效 LibOS 平台，无需硬件辅助虚拟化，同时改善容器间隔离并支持二进制兼容和多进程。通过消除 seccomp 与 Meltdown 补丁等安全屏障，X-Containers 的原始系统调用吞吐量比 Docker 容器最高提升 27 倍，并在多个基准测试中达到与 Google gVisor、Intel Clear Containers 等近期容器平台相当或更优的性能。
"Cloud-native" container platforms, such as Kubernetes, have become an integral part of production cloud environments. One of the principles in designing cloud-native applications is called Single Concern Principle, which suggests that each container should handle a single responsibility well. In this paper, we propose X-Containers as a new security paradigm for isolating single-concerned cloud-native containers. Each container is run with a Library OS (LibOS) that supports multi-processing for concurrency and compatibility. A minimal exokernel ensures strong isolation with small kernel attack surface. We show an implementation of the X-Containers architecture that leverages Xen paravirtualization (PV) to turn Linux kernel into a LibOS. Doing so results in a highly efficient LibOS platform that does not require hardware-assisted virtualization, improves inter-container isolation, and supports binary compatibility and multi-processing. By eliminating some security barriers such as seccomp and Meltdown patch, X-Containers have up to 27X higher raw system call throughput compared to Docker containers, while also achieving competitive or superior performance on various benchmarks compared to recent container platforms such as Google's gVisor and Intel's Clear Containers.
DOI 原文 ·
@inproceedings{paperbot4938,
title = {X-Containers},
author = {Zhiming Shen and Zhen Sun and Gur-Eyal Sela and Eugene Bagdasaryan and Christina Delimitrou and Robbert Van Renesse and Hakim Weatherspoon},
booktitle = {ASPLOS},
year = {2019},
doi = {10.1145/3297858.3304016}
}