BabelFish: Fusing Address Translations for Containers

Skarlatos, Dimitrios; Darbaz, Umur; Gopireddy, Bhargava; Kim, Nam Sung; Torrellas, Josep

doi:10.1109/mm.2021.3073194

Cited by 2 publications

(2 citation statements)

References 4 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Hardware-based isolation. Recent work [29], [44], [45], [46], [47], [48], [49] explores new hardware to implement additional isolation for containers. SCONE [44] and ARMlock [47] place the container inside trusted execution domain based on the Intel SGX and ARM TrustZone.…”

Section: Related Workmentioning

confidence: 99%

vKernel: Enhancing Container Isolation via Private Code and Data

Huang,

Wang,

Rao

et al. 2024

IEEE Trans. Comput.

View full text Add to dashboard Cite

Container technology is increasingly adopted in cloud environments. However, the lack of isolation in the shared kernel becomes a significant barrier to the wide adoption of containers. The challenges lie in how to simultaneously attain high performance and isolation. On the one hand, kernel-level isolation mechanisms, such as seccomp, capabilities, and apparmor, achieve good performance without much overhead, but lack the support for per-container customization. On the other hand, user-level and VM-based isolation offer superior security guarantees and allow for customization since a container is assigned a dedicated kernel, however, at the cost of high overhead. We present vKernel, a kernel isolation framework. It maintains a minimal set of code and data that are either sensitive or are prone to interference in a virtual kernel instance (vKI). vKernel relies on inline hooks to intercept and redirect requests sent to the host kernel to a vKI, where container-specific security rules, functions, and data are implemented. Through case studies, we demonstrate that under vKernel user-defined data isolation and kernel customization can be supported with a reasonable engineering effort. An evaluation of vKernel with micro-benchmarks, cloud services, real-world applications show that vKernel achieves good security guarantees, but with much less overhead.

show abstract

Section: Related Workmentioning

confidence: 99%

vKernel: Enhancing Container Isolation via Private Code and Data

Huang,

Wang,

Rao

et al. 2024

IEEE Trans. Comput.

View full text Add to dashboard Cite

show abstract

“…These solutions aim to partition system resources among co-located applications without violating individual SLOs. Other works [37,38] have proposed architectural and OS extensions for containers. Overall, they operate at a layer above or below IOCost and can leverage its robust IO control to further push the co-location capabilities in datacenter environments.…”

Section: Related Workmentioning

confidence: 99%

IOCost: block IO control for containers in datacenters

Heo¹,

Schatzberg²,

Newell³

et al. 2022

Proceedings of the 27th ACM International Conference on Architectural Support for Programming Languages and Operating Systems

Self Cite

View full text Add to dashboard Cite

Resource isolation is a fundamental requirement in datacenter environments. However, our production experience in Meta's largescale datacenters shows that existing IO control mechanisms for block storage are inadequate in containerized environments. IO control needs to provide proportional resources to containers while taking into account the hardware heterogeneity of storage devices and the idiosyncrasies of the workloads deployed in datacenters. The speed of modern SSDs requires IO control to execute with low-overheads. Furthermore, IO control should strive for work conservation, take into account the interactions with the memory management subsystem, and avoid priority inversions that lead to isolation failures.To address these challenges, this paper presents IOCost, an IO control solution that is designed for containerized environments and provides scalable, work-conserving, and low-overhead IO control for heterogeneous storage devices and diverse workloads in datacenters. IOCost performs offline profiling to build a device model and uses it to estimate device occupancy of each IO request. To minimize runtime overhead, it separates IO control into a fast per-IO issue path and a slower periodic planning path. A novel work-conserving budget donation algorithm enables containers to dynamically share unused budget. We have deployed IOCost across the entirety of Meta's datacenters comprised of millions of machines, upstreamed IOCost to the Linux kernel, and open-sourced our device-profiling tools. IOCost has been running in production Permission to make digital or hard copies of part or all of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for third-party components of this work must be honored. For all other uses, contact the owner/author(s).

show abstract

BabelFish: Fusing Address Translations for Containers

Cited by 2 publications

References 4 publications

vKernel: Enhancing Container Isolation via Private Code and Data

vKernel: Enhancing Container Isolation via Private Code and Data

IOCost: block IO control for containers in datacenters

Contact Info

Product

Resources

About