Sub-Millisecond Startup for Serverless Computing with Initialization-Less Booting

Total Page:16

File Type:pdf, Size:1020Kb

Sub-Millisecond Startup for Serverless Computing with Initialization-Less Booting Session 6A: Datacenter/cloud power/performance — Managing ASPLOS’20, March 16–20, 2020, Lausanne, Switzerland the beast. Physics Experiments (with a particular eye on CERN LHC) Catalyzer: Sub-millisecond Startup for Serverless Computing with Initialization-less Booting Dong Duyz, Tianyi Yuyzx, Yubin Xiayz, Binyu Zangyz, Guanglu Yanx, Chenggang Qinx, Qixuan Wux, Haibo Chenyz y Shanghai Key Laboratory of Scalable Computing and Systems, Shanghai Jiao Tong University z Institute of Parallel and Distributed Systems, Shanghai Jiao Tong University x Ant Financial Services Group Abstract Catalyzer has been adopted by Ant Financial, and we also Serverless computing promises cost-efficiency and elasticity present lessons learned from industrial development. for high-productive software development. To achieve this, CCS Concepts • Computer systems organization → the serverless sandbox system must address two challenges: Cloud computing; • Software and its engineering → strong isolation between function instances, and low startup Operating systems. latency to ensure user experience. While strong isolation can be provided by virtualization-based sandboxes, the ini- Keywords serverless computing; startup latency; check- tialization of sandbox and application causes non-negligible point and restore; operating system startup overhead. Conventional sandbox systems fall short in ACM Reference Format: low-latency startup due to their application-agnostic nature: Dong Du, Tianyi Yu, Yubin Xia, Binyu Zang, Guanglu Yan, Cheng- they can only reduce the latency of sandbox initialization gang Qin, Qixuan Wu, Haibo Chen. 2020. Catalyzer: Sub-millisecond through hypervisor and guest kernel customization, which Startup for Serverless Computing with Initialization-less Booting. is inadequate and does not mitigate the majority of startup In Proceedings of the Twenty-Fifth International Conference on Archi- overhead. tectural Support for Programming Languages and Operating Systems This paper proposes Catalyzer, a serverless sandbox sys- (ASPLOS ’20), March 16–20, 2020, Lausanne, Switzerland. ACM, New tem design providing both strong isolation and extremely York, NY, USA, 15 pages. https://doi.org/10.1145/3373376.3378512 fast function startup. Instead of booting from scratch, Cat- alyzer restores a virtualization-based function instance from 1 Introduction a well-formed checkpoint image and thereby skips the ini- Serverless computing, the new trending paradigm in cloud tialization on the critical path (init-less). Catalyzer boosts the computing, liberates developers from the distraction of man- restore performance by on-demand recovering both user-level aging servers and has already been supported by many memory state and system state. We also propose a new OS platforms, including Amazon Lambda [2], IBM Cloud Func- primitive, sfork (sandbox fork), to further reduce the startup tion [1], Microsoft Azure Functions [3] and Google Cloud latency by directly reusing the state of a running sandbox in- Functions [7]. In serverless computing, the unit of compu- stance. Fundamentally, Catalyzer removes the initialization tation is a function. When a service request is received, the cost by reusing state, which enables general optimizations serverless platform allocates an ephemeral execution sand- for diverse serverless functions. The evaluation shows that box and instantiates a user-defined function to handle the Catalyzer reduces startup latency by orders of magnitude, request. This computing model shifts the responsibility of achieves <1ms latency in the best case, and significantly dynamically managing cloud resources to cloud providers, reduces the end-to-end latency for real-world workloads. allowing the developers to focus purely on their application logic. Besides, cloud providers can manage their resources more efficiently. Permission to make digital or hard copies of all or part of this work for The ephemeral execution sandboxes are typically con- personal or classroom use is granted without fee provided that copies tainers [1], virtual machines [20, 44] or recently proposed are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights lightweight virtualization designs [6, 8, 19, 35, 37, 41, 45]. for components of this work owned by others than the author(s) must However, container instances suffer from isolation issues be honored. Abstracting with credit is permitted. To copy otherwise, or since they share one kernel, which is error-prone. Virtual republish, to post on servers or to redistribute to lists, requires prior specific machines can achieve better isolation but are too heavy to permission and/or a fee. Request permissions from [email protected]. run serverless functions. Lightweight virtualization designs ASPLOS ’20, March 16–20, 2020, Lausanne, Switzerland like Google gVisor [8] and Amazon FireCracker [6] achieve © 2020 Copyright held by the owner/author(s). Publication rights licensed to ACM. high performance, easy resource management and strong iso- ACM ISBN 978-1-4503-7102-5/20/03...$15.00 lation by customizing the host-guest interfaces, e.g., gVisor https://doi.org/10.1145/3373376.3378512 uses a process abstraction interface. 467 Session 6A: Datacenter/cloud power/performance — Managing ASPLOS’20, March 16–20, 2020, Lausanne, Switzerland the beast. Physics Experiments (with a particular eye on CERN LHC) 1 gVisor The result shows the Catalyzer can achieve <1ms startup la- Catalyzer 0.8 tency on C-hello (best case), and <2ms to boot Java SPECjbb, 0.6 1000x speedup over baseline gVisor. We also present eval- 0.4 uations on server machines and share our lessons learned 0.2 from industrial development at Ant Financial. CDF of serverless functions 0 0 10 20 30 40 50 60 65.54 Execution Time/Latency (%) The main contributions of this paper are as follows: • Figure 1. Distribution of Execution/Overall latency ratio in A detailed analysis of latency overhead on serverless serverless computing. The ratio of all functions in gVisor can not computing (§2). even achieve 65.54%. The startup is cold boot. • A general design of Init-less booting that boosts startup of diverse serverless applications (§3 and §4). • An implementation of Catalyzer on a state-of-the-art Executing serverless functions with low latency is critical serverless sandbox system, Google gVisor (§5). for user experience [21, 24, 28, 32, 38], and is still a signifi- • An evaluation with micro-benchmarks and real-world cant challenge for virtualization-based sandbox design. To serverless applications proving the efficiency and prac- explain the severity, we conduct an end-to-end evaluation on ticability of Catalyzer (§6). three benchmarks, DeathStar [22], E-business microservices, • The experience of deploying Catalyzer on real plat- and image processing functions, and divide the latency into forms (§6.9). “execution” part and “boot” part (§6.4). We calculate the “Ex- ecution/Overall” ratio of the tested 14 serverless functions, 2 Serverless Function Startup Breakdown and present the CDF in Figure 1. The ratio of 12 functions In this section, we evaluate and analyze the startup latency (out of 14) in gVisor can not even achieve 30%, indicating of serverless platforms with different system sandboxes (i.e., that the startup dominates the overall latency. Long startup gVisor, FireCracker, Hyper Container, and Docker) and dif- latency, especially for virtualization-based sandbox, has be- ferent language runtimes. Based on evaluation and analysis, come a significant challenge for serverless platforms. we present our motivation that serverless functions should Existing VM-based sandboxes [6, 8, 37] reduce the startup be executed with an initialization-less approach. latency through hypervisor customization, e.g., FireCracker can boot a virtual machine (microVM) and a minimized Linux 2.1 Background kernel in 100ms. However, none of them can reduce the appli- Serverless Platform. In serverless computing, the devel- cation initialization latency like JVM or Python interpreter oper sends a function to the serverless platform to execute. setup time. Our studies on serverless functions (written by We use the term handler function to represent the target five programming languages) show that most of the startup function, which could be written in different languages. The latency comes from application initialization (Insight I). handler function is compiled offline together with a wrapper, This paper proposes Catalyzer, a general design to boost which does initialization and invokes the handler function. startup for serverless computing. The key idea of Catalyzer is Wrapped programs (consist of the wrapper and handler func- to restore an instance from a well-formed checkpoint image tion) execute safely within sandboxes, which can be con- and thereby skip the initialization on the critical path. The tainers [5, 40] or virtual machines (VM) [6, 8, 10]. There is a design is based on two additional insights: First, a server- gateway program running on each server as a daemon, which less function in execution stage typically accesses only a small accepts “invoke function” requests, and starts a sandbox with fraction of memory and files used in the initialization stage two arguments: a configuration file and a rootfs containing (Insight II), thus we can on-demand recover both appli- both the wrapped program and runtime libraries. The argu- cation state (e.g., data in memory) and system state (e.g., file ments are
Recommended publications
  • Benchmarking, Analysis, and Optimization of Serverless Function Snapshots
    Benchmarking, Analysis, and Optimization of Serverless Function Snapshots Dmitrii Ustiugov∗ Plamen Petrov Marios Kogias† University of Edinburgh University of Edinburgh Microsoft Research United Kingdom United Kingdom United Kingdom Edouard Bugnion Boris Grot EPFL University of Edinburgh Switzerland United Kingdom ABSTRACT CCS CONCEPTS Serverless computing has seen rapid adoption due to its high scala- • Computer systems organization ! Cloud computing; • In- bility and flexible, pay-as-you-go billing model. In serverless, de- formation systems ! Computing platforms; Data centers; • velopers structure their services as a collection of functions, spo- Software and its engineering ! n-tier architectures. radically invoked by various events like clicks. High inter-arrival time variability of function invocations motivates the providers KEYWORDS to start new function instances upon each invocation, leading to cloud computing, datacenters, serverless, virtualization, snapshots significant cold-start delays that degrade user experience. To reduce ACM Reference Format: cold-start latency, the industry has turned to snapshotting, whereby Dmitrii Ustiugov, Plamen Petrov, Marios Kogias, Edouard Bugnion, and Boris an image of a fully-booted function is stored on disk, enabling a Grot. 2021. Benchmarking, Analysis, and Optimization of Serverless Func- faster invocation compared to booting a function from scratch. tion Snapshots . In Proceedings of the 26th ACM International Conference on This work introduces vHive, an open-source framework for Architectural Support for Programming Languages and Operating Systems serverless experimentation with the goal of enabling researchers (ASPLOS ’21), April 19–23, 2021, Virtual, USA. ACM, New York, NY, USA, to study and innovate across the entire serverless stack. Using 14 pages. https://doi.org/10.1145/3445814.3446714 vHive, we characterize a state-of-the-art snapshot-based serverless infrastructure, based on industry-leading Containerd orchestra- 1 INTRODUCTION tion framework and Firecracker hypervisor technologies.
    [Show full text]
  • Qualifikationsprofil #10309
    QUALIFIKATIONSPROFIL #10309 ALLGEMEINE DATEN Geburtsjahr: 1972 Ausbildung: Abitur Diplom, Informatik, (TU, Kaiserslautern) Fremdsprachen: Englisch, Französisch Spezialgebiete: Kubernetes KENNTNISSE Tools Active Directory Apache Application Case CATIA CVS Eclipse Exchange Framework GUI Innovator ITIL J2EE JMS LDAP Lotus Notes make MS Exchange MS Outlook MS-Exchange MS-Office MS-Visual Studio NetBeans OSGI RACF SAS sendmail Together Turbine UML VMWare .NET ADS ANT ASP ASP.NET Flash GEnie IDES Image Intellij IDEA IPC Jackson JBOSS Lex MS-Visio ODBC Oracle Application Server OWL PGP SPSS SQS TesserAct Tivoli Toolbook Total Transform Visio Weblogic WebSphere YACC Tätigkeiten Administration Analyse Beratung Design Dokumentation KI Konzeption Optimierung Support Vertrieb Sprachen Ajax Basic C C# C++ Cobol Delphi ETL Fortran Java JavaScript Natural Perl PHP PL/I PL-SQL Python SAL Smalltalk SQL ABAP Atlas Clips Delta FOCUS HTML Nomad Pascal SPL Spring TAL XML Detaillierte Komponenten AM BI FS-BA MDM PDM PM BW CO FI LO PP Datenbanken Approach IBM Microsoft Object Store Oracle Progress Sybase DMS ISAM JDBC mySQL DC/Netzwerke ATM DDS Gateway HBCI Hub Internet Intranet OpenSSL SSL VPN Asynchronous CISCO Router DNS DSL Firewall Gateways HTTP RFC Router Samba Sockets Switches Finance Business Intelligence Excel Konsolidierung Management Projektleiter Reporting Testing Wertpapiere Einkauf CAD Systeme CATIA V5 sonstige Hardware Digital HP PC Scanner Siemens Spark Teradata Bus FileNet NeXT SUN Switching Tools, Methoden Docker Go Kubernetes Rational RUP
    [Show full text]
  • Gvisor Is a Project to Restrict the Number of Syscalls That the Kernel and User Space Need to Communicate
    SED 820 Transcript EPISODE 820 [INTRODUCTION] [0:00:00.3] JM: The Linux operating system includes user space and kernel space. In user space, the user can create and interact with a variety of applications directly. In kernel space, the Linux kernel provides a stable environment in which device drivers interact with hardware and manage low-level resources. A Linux container is a virtualized environment that runs within user space. To perform an operation, a process in a container in user space makes a syscall, which is a system call into kernel space. This allows the container to have access to resources like memory and disk. Kernel space must be kept secure to ensure the operating system’s integrity. Linux includes hundreds of syscalls. Each syscall represents an interface between the user space and the kernel space. Security vulnerabilities can emerge from this wide attack surface of different syscalls and most applications only need a small number of syscalls to provide their required functionality. gVisor is a project to restrict the number of syscalls that the kernel and user space need to communicate. gVisor is a runtime layer between the user space container and the kernel space. gVisor reduces the number of syscalls that can be made into kernel space. The security properties of gVisor make it an exciting project today, but it is the portability features of gVisor that hint at a huge future opportunity. By inserting an interpreter interface between containers and the Linux kernel, gVisor presents the container world with an opportunity to run on operating systems other than Linux.
    [Show full text]
  • Surviving Software Dependencies
    practice DOI:10.1145/3347446 is additional code a programmer wants Article development led by queue.acm.org to call. Adding a dependency avoids repeating work: designing, testing, de- bugging, and maintaining a specific Software reuse is finally here unit of code. In this article, that unit of but comes with risks. code is referred to as a package; some systems use the terms library and mod- BY RUSS COX ule instead. Taking on externally written depen- dencies is not new. Most programmers have at one point in their careers had to go through the steps of manually Surviving installing a required library, such as C’s PCRE or zlib; C++’s Boost or Qt; or Java’s JodaTime or JUnit. These pack- ages contain high-quality, debugged Software code that required significant exper- tise to develop. For a program that needs the functionality provided by one of these packages, the tedious work of manually downloading, in- Dependencies stalling, and updating the package is easier than the work of redeveloping that functionality from scratch. The high fixed costs of reuse, however, mean manually reused packages tend to be big; a tiny package would be easier to reimplement. FOR DECADES, DISCUSSION of software reuse was more A dependency manager (a.k.a. pack- common than actual software reuse. Today, the situation age manager) automates the download- ing and installation of dependency is reversed: developers reuse software written by others packages. As dependency managers every day, in the form of software dependencies, and the make individual packages easier to download and install, the lower fixed situation goes mostly unexamined.
    [Show full text]
  • Firecracker: Lightweight Virtualization for Serverless Applications
    Firecracker: Lightweight Virtualization for Serverless Applications Alexandru Agache, Marc Brooker, Andreea Florescu, Alexandra Iordache, Anthony Liguori, Rolf Neugebauer, Phil Piwonka, and Diana-Maria Popa, Amazon Web Services https://www.usenix.org/conference/nsdi20/presentation/agache This paper is included in the Proceedings of the 17th USENIX Symposium on Networked Systems Design and Implementation (NSDI ’20) February 25–27, 2020 • Santa Clara, CA, USA 978-1-939133-13-7 Open access to the Proceedings of the 17th USENIX Symposium on Networked Systems Design and Implementation (NSDI ’20) is sponsored by Firecracker: Lightweight Virtualization for Serverless Applications Alexandru Agache Marc Brooker Andreea Florescu Amazon Web Services Amazon Web Services Amazon Web Services Alexandra Iordache Anthony Liguori Rolf Neugebauer Amazon Web Services Amazon Web Services Amazon Web Services Phil Piwonka Diana-Maria Popa Amazon Web Services Amazon Web Services Abstract vantage over traditional server provisioning processes: mul- titenancy allows servers to be shared across a large num- Serverless containers and functions are widely used for de- ber of workloads, and the ability to provision new func- ploying and managing software in the cloud. Their popularity tions and containers in milliseconds allows capacity to be is due to reduced cost of operations, improved utilization of switched between workloads quickly as demand changes. hardware, and faster scaling than traditional deployment meth- Serverless is also attracting the attention of the research com- ods. The economics and scale of serverless applications de- munity [21,26,27,44,47], including work on scaling out video mand that workloads from multiple customers run on the same encoding [13], linear algebra [20, 53] and parallel compila- hardware with minimal overhead, while preserving strong se- tion [12].
    [Show full text]
  • Architectural Implications of Function-As-A-Service Computing
    Architectural Implications of Function-as-a-Service Computing Mohammad Shahrad Jonathan Balkind David Wentzlaff Princeton University Princeton University Princeton University Princeton, USA Princeton, USA Princeton, USA [email protected] [email protected] [email protected] ABSTRACT Network Serverless computing is a rapidly growing cloud application model, popularized by Amazon’s Lambda platform. Serverless cloud ser- Scheduling vices provide fine-grained provisioning of resources, which scale Platform (priorwork) automatically with user demand. Function-as-a-Service (FaaS) appli- Queueing Management cations follow this serverless model, with the developer providing 35% decrease in IPC Interference their application as a set of functions which are executed in response due to interference 6x variation due to to a user- or system-generated event. Functions are designed to Memory BW invocation pattern 20x MPKI for be short-lived and execute inside containers or virtual machines, Branch MPKI >10x exec time short functions introducing a range of system-level overheads. This paper studies for short functions Cold Start Server the architectural implications of this emerging paradigm. Using (500ms cold start) Up to 20x (thispaper) Container the commercial-grade Apache OpenWhisk FaaS platform on real slowdown servers, this work investigates and identifies the architectural im- Native plications of FaaS serverless computing. The workloads, along with Execution Figure 1: We characterize the server-level overheads of the way that FaaS inherently interleaves short functions from many Function-as-a-Service applications, compared to native exe- tenants frustrates many of the locality-preserving architectural cution. This contrasts with prior work [2–5] which focused structures common in modern processors.
    [Show full text]
  • The Aurora Operating System
    The Aurora Operating System Revisiting the Single Level Store Emil Tsalapatis Ryan Hancock Tavian Barnes RCS Lab, University of Waterloo RCS Lab, University of Waterloo RCS Lab, University of Waterloo [email protected] [email protected] [email protected] Ali José Mashtizadeh RCS Lab, University of Waterloo [email protected] ABSTRACT KEYWORDS Applications on modern operating systems manage their single level stores, transparent persistence, snapshots, check- ephemeral state in memory, and persistent state on disk. En- point/restore suring consistency between them is a source of significant developer effort, yet still a source of significant bugs inma- ACM Reference Format: ture applications. We present the Aurora single level store Emil Tsalapatis, Ryan Hancock, Tavian Barnes, and Ali José Mash- (SLS), an OS that simplifies persistence by automatically per- tizadeh. 2021. The Aurora Operating System: Revisiting the Single sisting all traditionally ephemeral application state. With Level Store. In Workshop on Hot Topics in Operating Systems (HotOS recent storage hardware like NVMe SSDs and NVDIMMs, ’21), June 1-June 3, 2021, Ann Arbor, MI, USA. ACM, New York, NY, Aurora is able to continuously checkpoint entire applications USA, 8 pages. https://doi.org/10.1145/3458336.3465285 with millisecond granularity. Aurora is the first full POSIX single level store to han- dle complex applications ranging from databases to web 1 INTRODUCTION browsers. Moreover, by providing new ways to interact with Single level storage (SLS) systems provide persistence of and manipulate application state, it enables applications to applications as an operating system service. Their advantage provide features that would otherwise be prohibitively dif- lies in removing the semantic gap between the in-memory ficult to implement.
    [Show full text]
  • Containerd: Integration
    containerd: integration Lantao Liu (Google) Wei Fu (Alibaba Cloud) containerd status containerd matures ● 5th project to graduate from CNCF ● Broad support from companies ● All major cloud providers using containerd ● Support Linux and Windows platform Architecture Client-Server Design Client - High level operations using client - New functionality, interfaces may change (rarely) Server - Low level interfaces to resources over GRPC - Stable API, guaranteed 1.x compatibility Backend Service Interface - Provides access to all components - Low level components wrapped by metadata store - Provides namespacing (content/Snapshotter/Image/Container) Snapshotter Snapshotters - COW filesystems - Union FS and Block Device implementations - Container RW Layer Metrics Metric API - Metrics exposed through Prometheus API - Exposes metrics for containerd process & container level metrics Kubernetes Runtime Support Kubernetes Runtime Support - CRI gRPC API exposed from containerd - Kubelet can be configured to use containerd as runtime Summary ● Stable gRPC interface ● Kubernetes Runtime Support Smart Client Model gRPC API Smart Client - Mirrors internal component interfaces - General-Purpose interface - Snapshots, Content, Containers, Task, Events, etc - Direct access to the component (e.g. Snapshots) Pull Image Diff Content Snapshotter Image Registry Client Service Service Service Service Get manifest store manifest each layer Get layer store layer each layer prepare snapshot apply diff read layer mount & unpack layer descriptor commit snapshot create
    [Show full text]
  • Linux Kernel Debugging Advanced Operating Systems 2020/2021
    Linux Kernel Debugging Advanced Operating Systems 2020/2021 Vlastimil Babka Linux Kernel Developer, SUSE Labs [email protected] Agenda – Debugging Scenarios • Debugging production kernels – Post-mortem analysis: interpreting kernel oops/panic output, creating and analyzing kernel crash dumps – Kernel observability – dynamic debug, tracing, alt-sysrq dumps, live crash session • Debugging during individual kernel development – Debug prints – printk() facilitiy – Debugger (gdb) support • Finding (latent) bugs during collaborative development – Optional runtime checks configurable during build – Testing and fuzzing – Static analysis 2 Enterprise Linux Distro and Bugs (incl. Kernel) • The software installation (e.g. ISO) itself is free (and open source, obviously) • Customers pay for support subscription – Delivery of (tested by QA) package updates – fixing known bugs, CVE’s… but not more! – Getting reported bugs fixed • Bugs specific to customer’s workload, hardware, “luck”, large number of machines… • Upstream will also fix reported bugs, but only with latest kernel and no effort guarantees • Dealing with kernel bugs, e.g. crashes – Find out the root cause (buggy code) with limited possibilities (compared to local development) • Typically no direct access to customer’s system or workload • Long turnarounds for providing a modified debug kernel and reproducing the bug – Write and deliver a fix (upstream first!) or workaround; fix goes to next update • Possibly a livepatch in some cases – Is a lot of fun ;-) 3 Kernel Oops - The Real World Example
    [Show full text]
  • Bring Security to the Container World, and More
    01,1001.01 100 010 , , 100 , 1 100 , 1 “All problems in computer science can be solved by another level of indirection, except of course for the problem of too many indirections.” ----David Wheeler .- • :.’:. • : . • ...,:. • :....,:.: .,-.,. ., • .’. What’s Kata Containers • /// • // • /.,/ ./A • /.,/. • ,/.,/// Kata Containers is Virtualized Container :- • • : : • - • : • • app centric OS feature package runtime .,- • -,, • • • , , • , , system view OS supervisor isolation hardware aware* Containerization Virtualization app centric OS feature system view OS supervisor package runtime isolation hardware aware* View Point From application to OS; The From hardware to OS; intercept environment of an app the instructions of guest system Design Goal Kernel ABI, including syscall A machine like the host, could interfaces, procfs/sysfs, etc. run a kernel on top of it Implementati Inside kernel, a feature of the A supervisor of the kernel, a on scheduler scheduler of the schedulers • Namespace Virtual Machine – • Process Process Process – Process VM is a type of container Guest Kernel indeed Host Kernel * Industry Compatible Enhanced Networking Direct Device Support Run Custom Kernel More Secure :-:-: • : ! - ::: ! :-:- - ! :- • : " ,-:-:- Docker " --B Image runC " : -: : : -- - : Docker Docker Image runC Image * Intel® Clear Containers Announced project Release 1.0 May 2015 Dec 2017 May 2018 *Other names and brands may be claimed as the property of others. Multi Architecture Direct
    [Show full text]
  • X-Containers: Breaking Down Barriers to Improve
    Session: Cloud II ASPLOS’19, April 13–17, 2019, Providence, RI, USA X-Containers: Breaking Down Barriers to Improve Performance and Isolation of Cloud-Native Containers Zhiming Shen Zhen Sun Gur-Eyal Sela∗ Cornell University Cornell University University of California, Berkeley Eugene Bagdasaryan Christina Delimitrou Robbert Van Renesse Cornell University Cornell University Cornell University Hakim Weatherspoon Cornell University Abstract CCS Concepts • Security and privacy → Virtualiza- “Cloud-native” container platforms, such as Kubernetes, have tion and security; • Software and its engineering → become an integral part of production cloud environments. Operating systems. One of the principles in designing cloud-native applica- Keywords Containers; X-Containers; Cloud-Native; Li- tions is called Single Concern Principle, which suggests that brary OS; exokernel each container should handle a single responsibility well. In this paper, we propose X-Containers as a new security ACM Reference Format: paradigm for isolating single-concerned cloud-native con- Zhiming Shen, Zhen Sun, Gur-Eyal Sela, Eugene Bagdasaryan, tainers. Each container is run with a Library OS (LibOS) Christina Delimitrou, Robbert Van Renesse, and Hakim Weath- that supports multi-processing for concurrency and compat- erspoon. 2019. X-Containers: Breaking Down Barriers to Improve Performance and Isolation of Cloud-Native Containers. In 2019 Ar- ibility. A minimal exokernel ensures strong isolation with chitectural Support for Programming Languages and Operating Sys- small kernel attack surface. We show an implementation tems (ASPLOS ’19), April 13–17, 2019, Providence, RI, USA. ACM, New of the X-Containers architecture that leverages Xen para- York, NY, USA, 15 pages. https://doi.org/10.1145/3297858.3304016 virtualization (PV) to turn Linux kernel into a LibOS.
    [Show full text]
  • Kata Containers and Gvisor a Quantitative Comparison
    & a Quantitative Comparison Xu Wang hyper.sh; Kata Containers Architecture Committee Fupan Li hyper.sh; Kata Containers Upstream Developer “All problems in computer science can be solved by another level of indirection, except of course for the problem of too many indirections.” ----David Wheeler Agenda • Secure Containers, or Linux ABI Oriented Virtualization • Architecture Comparison • Benchmarks • The Future of the Secure Container Projects What’s Kata Containers • A container runtime, like runC • Built w/ virtualization tech, like VM • Initiated by hyper.sh and Intel® • Hosted by OpenStack Foundation • Contributed by Huawei, Google, MSFT, etc. Kata Containers is Virtualized Container What’s gVisor • A container runtime, like runC, too • A user-space kernel, written in Go • implements a substantial portion of the Linux system surface • Developed in Google and was open-sourced in mid-2018 gVisor implements Linux by way of Linux. The Similarity • OCI compatible container runtime • Linux ABI for container applications Container App • Support OCI runtime spec (docker, k8s, zun…) Linux ABI • Extra isolation layer Handling BLACK BOX OCIInterface • Guest Kernel, or say, Linux* in Linux Linux ABI • Do not expose system interface of the host to the container apps Host OS • Goals General Architecture of Kata Containers and gVisor • Less overhead, better isolation Architecture Comparison Run Kata Containers • Employ existing VMM (or improved) and standard Linux kernel • Per-container shims and per-sandbox proxy are stand-alone binaries, or built-in as library (such as in containerd shim v2 implementation) • An agent in guest OS based on libcontainer runC-like IO-stub process shim cmdline for container Apps Container App shim proxy Kata Agent Kata runtime Container App No proxy when virt-serial Guest Linux Kernel vscok enabled or vsock VMM (e.g.
    [Show full text]