DOCSLIB.ORG

Secure Compute Customization

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Secure Compute Customization ORNL/TM-2016/710 Secure Enclaves: An Isolation-centric Approach for Creating Secure High Performance Computing Environments Approved for public release. Distribution is unlimited. Ferrol Aderholdt Blake Caldwell Susan Hicks Scott Koch Thomas Naughton Daniel Pelfrey James Pogge Stephen L. Scott Galen Shipman Lawrence Sorrillo June 2015 DOCUMENT AVAILABILITY Reports produced after January 1, 1996, are generally available free via US Department of Energy (DOE) SciTech Connect. Website: http://www.osti.gov/scitech/ Reports produced before January 1, 1996, may be purchased by members of the public from the following source: National Technical Information Service 5285 Port Royal Road Springfield, VA 22161 Telephone: 703-605-6000 (1-800-553-6847) TDD: 703-487-4639 Fax: 703-605-6900 E-mail: [email protected] Website: http://www.ntis.gov/help/ordermethods.aspx Reports are available to DOE employees, DOE contractors, Energy Technology Data Exchange representatives, and International Nuclear Information System representatives from the following source: Office of Scientific and Technical Information PO Box 62 Oak Ridge, TN 37831 Telephone: 865-576-8401 Fax: 865-576-5728 E-mail: [email protected] Website: http://www.osti.gov/contact.html This report was prepared as an account of work sponsored by an agency of the United States Government. Neither the United States Government nor any agency thereof, nor any of their em- ployees, makes any warranty, express or implied, or assumes any legal liability or responsibility for the accuracy, completeness, or usefulness of any information, apparatus, product, or process disclosed, or represents that its use would not infringe privately owned rights. Reference herein to any specific commercial prod- uct, process, or service by trade name, trademark, manufacturer, or otherwise, does not necessarily constitute or imply its endorse- ment, recommendation, or favoring by the United States Govern- ment or any agency thereof. The views and opinions of authors expressed herein do not necessarily state or reflect those of the United States Government or any agency thereof. ORNL/TM-2016/710 Computing & Computational Sciences Directorate DoD-HPC Program Secure Enclaves: An Isolation-centric Approach for Creating Secure High Performance Computing Environments Ferrol Aderholdt2, Blake Caldwell1, Susan Hicks1, Scott Koch1, Thomas Naughton1, Daniel Pelfrey1, James Pogge2, Stephen L. Scott1;2, Galen Shipman2 and Lawrence Sorrillo1 1 Oak Ridge National Laboratory Oak Ridge, TN 37831 2 Tennessee Technological University Cookeville, TN, 38501 Date Published: June 2015 Prepared by OAK RIDGE NATIONAL LABORATORY P.O. Box 2008 Oak Ridge, Tennessee 37831-6285 managed by UT-Battelle, LLC for the US DEPARTMENT OF ENERGY under contract DE-AC05-00OR22725 CONTENTS List of Figures ............................................ x List of Tables ............................................. xi Executive Summary1 1 Introduction 5 1.1 Project Scope.......................................... 6 1.1.1 Customizable Computing Resources.......................... 6 1.1.2 Threat Model...................................... 7 1.2 Report Outline ......................................... 8 2 Background 9 2.1 Terminology........................................... 9 2.1.1 Virtualization...................................... 9 2.1.2 Networking....................................... 9 2.2 Virtualization Classification................................... 11 2.2.1 OS Level Virtualization................................. 11 2.2.2 System-level Virtualization............................... 11 2.3 SDN and Network Function Virtualization........................... 12 2.4 Storage Architectures...................................... 13 2.4.1 The Lustre Storage Architecture............................ 13 2.4.2 The GPFS Storage Architecture ............................ 16 2.5 Security Classifications..................................... 18 2.6 Supporting Security Technologies ............................... 19 2.6.1 NIST .......................................... 19 2.6.2 FIPS........................................... 20 2.6.3 GSSAPI......................................... 20 2.6.4 Kerberos ........................................ 20 2.7 System Management Tools................................... 20 2.7.1 Puppet.......................................... 21 2.7.2 OpenStack ....................................... 21 3 Virtualization 22 3.1 OS level virtualization ..................................... 22 3.1.1 Namespaces....................................... 22 3.1.2 Cgroups......................................... 24 3.1.3 Linux-VServer ..................................... 25 iii 3.1.4 OpenVZ......................................... 26 3.1.5 LXC........................................... 27 3.1.6 Docker ......................................... 27 3.2 System level virtualization ................................... 27 3.2.1 Xen........................................... 27 3.2.2 KVM.......................................... 28 3.3 Virtualization and Security Mechanisms............................ 29 3.3.1 sVirt........................................... 29 3.3.2 SELinux ........................................ 29 3.3.3 AppArmor ....................................... 30 3.3.4 Capabilities....................................... 30 4 Reconfigurable Networks 32 4.1 Typical Networking Environment................................ 32 4.2 Static Networks Involving VRF and Preconfigured VLANS.................. 32 4.3 Software Interfaces for Reconfigurable Networks ....................... 33 4.4 Traditional SDN......................................... 33 4.5 Hybrid SDN........................................... 34 4.6 Overlay Network ........................................ 34 4.7 SDN with OpenStack...................................... 35 4.8 Implementing Neutron Routers................................. 35 4.9 Networking with LXD ..................................... 38 5 Security in HPC Storage 39 5.1 Lustre.............................................. 39 5.1.1 Isolation......................................... 39 5.1.2 Authentication ..................................... 39 5.1.3 Authorization...................................... 40 5.1.4 Integrity......................................... 40 5.1.5 Features in Development................................ 40 5.1.6 Gaps .......................................... 41 5.2 GPFS .............................................. 41 5.2.1 Authentication ..................................... 41 5.2.2 Authorization...................................... 42 5.2.3 Encryption ....................................... 42 5.2.4 Features & Gaps .................................... 43 5.3 Discussion............................................ 43 5.3.1 Comparisons of Security with Lustre and GPFS.................... 43 5.3.2 Performance in Lustre and GPFS............................ 44 6 Bridging Technologies for Secure Storage 45 6.1 Virtualization .......................................... 45 6.2 VLAN/Network Segmentation................................. 46 6.3 I/O Forwarding ......................................... 46 6.3.1 NFS........................................... 46 6.3.2 VirtFS.......................................... 46 iv 6.3.3 DIOD.......................................... 47 7 OpenStack Implementation Details 48 7.1 Core OpenStack Components.................................. 48 7.1.1 Horizon – Dashboard.................................. 49 7.1.2 Nova – Compute .................................... 49 7.1.3 Neutron – Networking ................................. 49 7.1.4 Keystone – Identity Services.............................. 49 7.1.5 Glance – Image Service ................................ 49 7.1.6 Swift – Object Storage................................. 49 7.1.7 Cinder – Block Storage................................. 52 7.2 Emerging OpenStack Components............................... 54 7.2.1 Manila – Filesystem-As-A-Service........................... 54 7.2.2 Magnum – Containers-As-A-Service.......................... 54 7.2.3 LXD – System-Containers-As-A-Service ....................... 55 7.2.4 LXD vs. Magnum ................................... 55 8 Secure Enclaves System Architecture 57 8.1 Isolation-Centric Architecture ................................. 57 8.2 Instances of the Isolation-Centric Architecture......................... 59 8.2.1 Parallel filesystem with host-based subtree limitations for VM............ 59 8.2.2 Parallel filesystem with host-based subtree limitations for VE ............ 60 9 Evaluation 62 9.1 Secure Enclave Testbed Description .............................. 62 9.1.1 SDN in Testbed..................................... 63 9.2 User namespaces ........................................ 65 9.2.1 Shared-storage use case ................................ 65 9.3 HPCCG............................................. 69 9.3.1 Description....................................... 69 9.3.2 Setup .......................................... 69 9.3.3 Discussion & Observations............................... 71 9.4 iperf: TCP Bandwidth...................................... 76 9.4.1 Description....................................... 76 9.4.2 Setup .......................................... 76 9.4.3 Discussion & Observations............................... 76 9.5 On-demand Network Enclaving via SDN & OpenStack’s Neutron .............. 77 9.5.1 Description....................................... 77 9.5.2 Setup .........................................
Load more

Recommended publications
  • In Search of the Ideal Storage Configuration for Docker Containers
    In Search of the Ideal Storage Configuration for Docker Containers Vasily Tarasov1, Lukas Rupprecht1, Dimitris Skourtis1, Amit Warke1, Dean Hildebrand1 Mohamed Mohamed1, Nagapramod Mandagere1, Wenji Li2, Raju Rangaswami3, Ming Zhao2 1IBM Research—Almaden 2Arizona State University 3Florida International University Abstract—Containers are a widely successful technology today every running container. This would cause a great burden on popularized by Docker. Containers improve system utilization by the I/O subsystem and make container start time unacceptably increasing workload density. Docker containers enable seamless high for many workloads. As a result, copy-on-write (CoW) deployment of workloads across development, test, and produc- tion environments. Docker’s unique approach to data manage- storage and storage snapshots are popularly used and images ment, which involves frequent snapshot creation and removal, are structured in layers. A layer consists of a set of files and presents a new set of exciting challenges for storage systems. At layers with the same content can be shared across images, the same time, storage management for Docker containers has reducing the amount of storage required to run containers. remained largely unexplored with a dizzying array of solution With Docker, one can choose Aufs [6], Overlay2 [7], choices and configuration options. In this paper we unravel the multi-faceted nature of Docker storage and demonstrate its Btrfs [8], or device-mapper (dm) [9] as storage drivers which impact on system and workload performance. As we uncover provide the required snapshotting and CoW capabilities for new properties of the popular Docker storage drivers, this is a images. None of these solutions, however, were designed with sobering reminder that widespread use of new technologies can Docker in mind and their effectiveness for Docker has not been often precede their careful evaluation.
    [Show full text]
  • Resource Management: Linux Kernel Namespaces and Cgroups
    Resource management: Linux kernel Namespaces and cgroups Rami Rosen [email protected] Haifux, May 2013 www.haifux.org 1/121 http://ramirose.wix.com/ramirosen TOC Network Namespace PID namespaces UTS namespace Mount namespace user namespaces cgroups Mounting cgroups links Note: All code examples are from for_3_10 branch of cgroup git tree (3.9.0-rc1, April 2013) 2/121 http://ramirose.wix.com/ramirosen General The presentation deals with two Linux process resource management solutions: namespaces and cgroups. We will look at: ● Kernel Implementation details. ●what was added/changed in brief. ● User space interface. ● Some working examples. ● Usage of namespaces and cgroups in other projects. ● Is process virtualization indeed lightweight comparing to Os virtualization ? ●Comparing to VMWare/qemu/scaleMP or even to Xen/KVM. 3/121 http://ramirose.wix.com/ramirosen Namespaces ● Namespaces - lightweight process virtualization. – Isolation: Enable a process (or several processes) to have different views of the system than other processes. – 1992: “The Use of Name Spaces in Plan 9” – http://www.cs.bell-labs.com/sys/doc/names.html ● Rob Pike et al, ACM SIGOPS European Workshop 1992. – Much like Zones in Solaris. – No hypervisor layer (as in OS virtualization like KVM, Xen) – Only one system call was added (setns()) – Used in Checkpoint/Restart ● Developers: Eric W. biederman, Pavel Emelyanov, Al Viro, Cyrill Gorcunov, more. – 4/121 http://ramirose.wix.com/ramirosen Namespaces - contd There are currently 6 namespaces: ● mnt (mount points, filesystems) ● pid (processes) ● net (network stack) ● ipc (System V IPC) ● uts (hostname) ● user (UIDs) 5/121 http://ramirose.wix.com/ramirosen Namespaces - contd It was intended that there will be 10 namespaces: the following 4 namespaces are not implemented (yet): ● security namespace ● security keys namespace ● device namespace ● time namespace.
    [Show full text]
  • Containers – Namespaces and Cgroups
    Containers – namespaces and cgroups --- Ajay Nayak Motivation Why containers? • Important use-case: implementing lightweight virtualization • Virtualization == isolation of processes • Traditional virtualization: Hypervisors • Processes isolated by running in separate guest kernels that sit on top of host kernel • Isolation is “all or nothing” • Virtualization via containers • Permit isolation of processes running on a single kernel be per-global- resource --- via namespaces • Restrict resource consumption --- via cgroups Outline • Motivation • Concepts • Linux Namespaces • UTS • UID • Mount • C(ontrol) groups • Food for thought Introduction Concepts • Isolation • Goal: Limit “WHAT” a process can use • “wrap” some global system resource to provide resource isolation • Namespaces jump into the picture • Control • Goal: Limit “HOW MUCH” a process can use • A mechanism for aggregating/partitioning sets of tasks, and all their future children, into hierarchical groups • Assign specialized behaviour to the group • C(ontrol) groups jump into the picture https://github.com/nayakajay/linux-namespaces Namespaces Linux namespaces • Supports following NS types: (CLONE_FLAG; symlink) • Mount (CLONE_NEWNS; /proc/pid/ns/mnt) • UTS (CLONE_NEWUTS; /proc/pid/ns/uts) • IPC (CLONE_NEWIPC; /proc/pid/ns/ipc) • PID (CLONE_NEWPID; /proc/pid/ns/pid) • Network (CLONE_NEWNET; /proc/pid/ns/net) • User (CLONE_NEWUSER; /proc/pid/ns/user) • Cgroup (CLONE_NEWCGROUP; /proc/pid/ns/cgroup) • Time (CLONE_NEWTIME; /proc/pid/ns/time) <= very new! # Magic symlinks, which
    [Show full text]
  • Security of OS-Level Virtualization Technologies: Technical Report
    Security of OS-level virtualization technologies Elena Reshetova1, Janne Karhunen2, Thomas Nyman3, N. Asokan4 1 Intel OTC, Finland 2 Ericsson, Finland 3 University of Helsinki, Finland 4 Aalto University and University of Helsinki, Finland Abstract. The need for flexible, low-overhead virtualization is evident on many fronts ranging from high-density cloud servers to mobile devices. During the past decade OS-level virtualization has emerged as a new, efficient approach for virtualization, with implementations in multiple different Unix-based systems. Despite its popularity, there has been no systematic study of OS-level virtualization from the point of view of security. In this report, we conduct a comparative study of several OS- level virtualization systems, discuss their security and identify some gaps in current solutions. 1 Introduction During the past couple of decades the use of different virtualization technolo- gies has been on a steady rise. Since IBM CP-40 [19], the first virtual machine prototype in 1966, many different types of virtualization and their uses have been actively explored both by the research community and by the industry. A relatively recent approach, which is becoming increasingly popular due to its light-weight nature, is Operating System-Level Virtualization, where a number of distinct user space instances, often referred to as containers, are run on top of a shared operating system kernel. A fundamental difference between OS-level virtualization and more established competitors, such as Xen hypervisor [24], VMWare [48] and Linux Kernel Virtual Machine [29] (KVM), is that in OS-level virtualization, the virtualized artifacts are global kernel resources, as opposed to hardware.
    [Show full text]
  • Container-Based Virtualization
    Container-Based Virtualization Advanced Operating Systems Luca Abeni [email protected] Virtualized Resources • Virtual Machine: efficient, isolated duplicate of a physical machine • Why focusing on physical machines? • What about abstract machines? • Software stack: hierarchy of abstract machines • ... • Abstract machine: language runtime • Abstract machine: OS (hardware + system library calls) • Abstract machine: OS kernel (hardware + syscalls) • Physical machine (hardware) Advanced Operating Systems Container-Based Virtualization Hardware Virtualization • Can be full hardware virtualization or paravirtualization • Paravirtualization requires modifications to guest OS (kernel) • Can be based on trap and emulate • Can use special CPU features (hardware assisted virtualization) • In any case, the hardware (whole machine) is virtualized! • Guests can provide their own OS kernel • Guests can execute at various privilege levels Advanced Operating Systems Container-Based Virtualization OS-Level Virtualization • The OS kernel (or the whole OS) is virtualized • Guests can provide the user-space part of the OS (system libraries + binaries, boot scripts, ...) or just an application... • ...But continue to use the host OS kernel! • One single OS kernel (the host kernel) in the system • The kernel virtualizes all (or part) of its services • OS kernel virtualization: container-based virtualization • Example of OS virtualization: wine Advanced Operating Systems Container-Based Virtualization Virtualization at Language Level • The language runtime
    [Show full text]
  • C-Balancer: a System for Container Profiling and Scheduling
    1 C-Balancer: A System for Container Profiling and Scheduling Akshay Dhumal∗, Dharanipragada Janakiramy Department of Computer Science, Indian Institute of Technology Madras Email: ∗[email protected], [email protected] Abstract—Linux containers have gained high popularity in that can be grouped under namespaces are process PID, file recent times. This popularity is significantly due to various advan- system mount points, interprocess communication, network, tages of containers over Virtual Machines (VM). The containers etc. The resource management for a container is done by are lightweight, occupy lesser storage, have fast boot up time, easy to deploy and have faster auto-scaling. The key reason control groups (cgroups) [5], that limits the resource usage behind the popularity of containers is that they leverage the per process group. Using cgroups, it is possible to bound the mechanism of micro-service style software development, where resources (CPU, memory, I/O) of a container. The OS based applications are designed as independently deployable services. container virtualization significantly gained mass attention and There are various container orchestration tools for deploying and adoption with the release of Docker, which is a container managing the containers in the cluster. The prominent among them are Docker Swarm, and Kubernetes. However, they do orchestration and management tool designed to simplify the not address the effects of resource contention when multiple creation and deployment of containers on a single host. With containers are deployed on a node. Moreover, they do not provide the growing usage and popularity, the containers were seen as support for container migration in the event of an attack or a replacement for VM in public and private cloud operations.
    [Show full text]
  • Multiple Instances of the Global Linux Namespaces
    Multiple Instances of the Global Linux Namespaces Eric W. Biederman Linux Networx [email protected] Abstract to create a clean implementation that can be merged into the Linux kernel. The discussion has begun on the linux-kernel list and things are Currently Linux has the filesystem namespace slowly progressing. for mounts which is beginning to prove use- ful. By adding additional namespaces for pro- cess ids, SYS V IPC, the network stack, user ids, and probably others we can, at a trivial 1 Introduction cost, extend the UNIX concept and make novel uses of Linux possible. Multiple instances of a namespace simply means that you can have two 1.1 High Performance Computing things with the same name. For servers the power of computers is growing, and it has become possible for a single server I have been working with high performance to easily fulfill the tasks of what previously re- clusters for several years and the situation is quired multiple servers. Hypervisor solutions painful. Each Linux box in the cluster is ref- like Xen are nice but they impose a perfor- ered to as a node, and applications running or mance penalty and they do not easily allow re- queued to run on a cluster are jobs. sources to be shared between multiple servers. Jobs are run by a batch scheduler and, once For clusters application migration and preemp- launched, each job runs to completion typically tion are interesting cases but almost impossibly consuming 99% of the resources on the nodes hard because you cannot restart the application it is running on.
    [Show full text]
  • Linux Containers: an Emerging Cloud Technology
    Linux Containers: An Emerging Cloud Technology Asad Javed Aalto University Department of Computer Science Abstract—Linux containers, commonly known as LXC, has system becomes more efficient in terms of processing, and become a popular approach for creating virtual environment applications run in an isolated form irrespective of the other inside a large computer system. It is a lightweight virtualization applications [7] [8]. infrastructure, which creates multiple virtual Linux systems simultaneously on a single host machine. Linux kernel features The rest of the paper is organized as follows. Section II are used to provide isolated environment for applications within describes the difference between traditional hypervisor-based multiple systems. The main goal of LXC is to create environment virtualization and LXC approach. Section III presents kernel as close as possible to the standard Linux system, thus providing features which are used by containers in order to provide scalable and performance efficient systems, thereby considering isolation and scalability. An application of LXC named Docker as an emerging cloud technology. along with its usage will be illustrated in Section IV. Finally, This paper presents a thorough survey about LXC along with the paper ends with a conclusion in Section V. In addition, a two well-known and important kernel features including separate document has been provided [16] which demonstrates namespaces and cgroups. In this paper, the comparison between LXC and how to use them with proper commands. container-based and hypervisor-based virtualization is also been made in order to completely understand this phenomenon. At the end, Docker platform is explained which is an open source II.
    [Show full text]
  • IBM Research Report Docker and Container Security White Paper
    RC25625 (WAT1607-027) July 15, 2016 Computer Science IBM Research Report Docker and Container Security White Paper Salman Baset, Stefan Berger, James Bottomley, Canturk Isci, Nataraj Nagaratnam1, Dimitrios Pendarakis, J. R. Rao, Gosia Steinder, Jayashree Ramanatham1 IBM Research Division Thomas J. Watson Research Center P.O. Box 218 Yorktown Heights, NY 10598 USA 1IBM Cloud Research Division Almaden – Austin – Beijing – Brazil – Cambridge – Dublin – Haifa – India – Kenya – Melbourne – T.J. Watson – Tokyo – Zurich Docker and Container Security White Paper Contributors: Salman Baset, Stefan Berger, James Bottomley, Canturk Isci, Nataraj Nagaratnam, Dimitrios Pendarakis, JR Rao, Gosia Steinder, Jayashree Ramanatham Introduction This paper presents IBM's comprehensive point of view of security and privacy for Cloud Computing services based on container technologies, in particular Docker containers. The objective is to highlight benefits as well as security challenges for Docker containers, highlight ongoing efforts that address these challenges and to motivate additional work that the Docker community and IBM are undertaking to further strengthen the security of the Docker container ecosystem. Potential users of Docker container based cloud services can use this paper to evaluate the benefits and risks associated with deploying various workloads on Docker containers, understand the evolution of Docker containers and decide what additional security mechanisms and tools to employ to further reduce security risks. The paper starts with an overview of the applicable threat model and then compares the security properties of base technologies such as Linux containers, Docker, as well hypervisors, which are the basis of Infrastructure as a Service (IaaS) offerings. Next we describe some of the gaps in security for Docker containers and how IBM has helped and continues to help the community to address them.
    [Show full text]
  • Namespaces + Cgroups => Linux Containers
    Linux containers and Docker Elvin Sindrilaru IT Storage Group - CERN GridKa School 2016 Outline • Understanding Linux containers • Linux namespaces • Linux cgroups • Docker containers • Containers orchestration • Security considerations • Benefits 30/08/2016 Linux containers and Docker 3 What is a container? "Cmglee Container City 2" by Cmglee - Own work. Licensed under CC BY-SA 3.0 via Wikimedia Commons 30/08/2016 Linux containers and Docker 4 Linux containers • Based on two technologies • Linux namespaces • Linux control groups (cgroups) 30/08/2016 Linux containers and Docker 5 Linux namespaces (1) • The purpose of a namespace is to wrap a particular global system resource in an abstraction that makes it appear to the process within the namespace that they have their own isolated instance of the global resource. 30/08/2016 Linux containers and Docker 6 Linux namespaces (2) • Currently there are 6 namespaces implemented in the Linux Kernel: • Mount namespaces – isolate the set of file-system mount points seen by a group of processes (Linux 2.6.19) • UTS namespaces – isolate two system identifiers – nodename and domainname. (UNIX Time-sharing System) • IPC namespaces – isolate inter-process communication resources e.g. POSIX message queues 30/08/2016 Linux containers and Docker 7 Linux namespaces (3) • Network namespaces – provides isolation of system resources associated with networking. Each network namespace has its own network devices, IP addresses, port numbers etc. • PID namespaces – isolate process ID number space. Processes in different PID namespaces can have the same PID number. • User namespace – isolates the process user and group ID number spaces. A process’s UID and GID can be different inside and outside a user namespace i.e a process can have full root privileges inside a user namespace, but is unprivileged for operations outside the namespace.
    [Show full text]
  • Security Namespace : Making Linux Security Frameworks Available to Containers
    Security Namespace : Making Linux Security Frameworks Available to Containers Yuqiong Sun David Safford Mimi Zohar Symantec Research Labs GE Global Research IBM Research Dimitrios Pendarakis Zhongshu Gu Trent Jaeger IBM Research IBM Research Pennsylvania State University Abstract 1 Introduction Lightweight virtualization (i.e., containers) offers a vir- tual host environment for applications without the need Lightweight virtualization (i.e., containers) offers a vir- for a separate kernel, enabling better resource utiliza- tual host environment for applications without the need tion and improved efficiency. It is broadly used in com- for a separate kernel, enabling better resource utiliza- putation scenarios where a dense deployment and fast tion and improved efficiency. However, the shared ker- spin-up speed is required, such as microservice archi- nel also prevents containers from taking advantage of se- tecture [39] and serverless computation (e.g., Amazon curity features that are available to traditional VMs and Lambda [26]). Many commercial cloud vendors [23, 20, hosts. Containers cannot apply local policies to gov- 1] have adopted the technology. ern integrity measurement, code execution, mandatory access control, etc. to prevent application-specific se- The key difference between containers and traditional curity problems. Changes have been proposed to make VMs is that containers share the same kernel. While this kernel security mechanisms available to containers, but enables better resource utilization, it also prevents con- such changes are often adhoc and expose the challenges tainers from taking advantage of security features in ker- of trusting containers to make security decisions without nel that are available to traditional VMs or hosts. Con- compromising host system or other containers.
    [Show full text]
  • Linux Kernel Namespaces and Cgroups
    Resource management: Linux kernel Namespaces and cgroups Rami Rosen [email protected] Haifux, May 2013 www.haifux.org 1/121 http://ramirose.wix.com/ramirosen TOC Network Namespace PID namespaces UTS namespace Mount namespace user namespaces cgroups Mounting cgroups links Note: All code examples are from for_3_10 branch of cgroup git tree (3.9.0-rc1, April 2013) 2/121 http://ramirose.wix.com/ramirosen General The presentation deals with two Linux process resource management solutions: namespaces and cgroups. We will look at: ● Kernel Implementation details. ●what was added/changed in brief. ● User space interface. ● Some working examples. ● Usage of namespaces and cgroups in other projects. ● Is process virtualization indeed lightweight comparing to Os virtualization ? ●Comparing to VMWare/qemu/scaleMP or even to Xen/KVM. 3/121 http://ramirose.wix.com/ramirosen Namespaces ● Namespaces - lightweight process virtualization. – Isolation: Enable a process (or several processes) to have different views of the system than other processes. – 1992: “The Use of Name Spaces in Plan 9” – http://www.cs.bell-labs.com/sys/doc/names.html ● Rob Pike et al, ACM SIGOPS European Workshop 1992. – Much like Zones in Solaris. – No hypervisor layer (as in OS virtualization like KVM, Xen) – Only one system call was added (setns()) – Used in Checkpoint/Restart ● Developers: Eric W. Biederman, Pavel Emelyanov, Al Viro, Cyrill Gorcunov, more. – 4/121 http://ramirose.wix.com/ramirosen Namespaces - contd There are currently 6 namespaces: ● mnt (mount points, filesystems) ● pid (processes) ● net (network stack) ● ipc (System V IPC) ● uts (hostname) ● user (UIDs) 5/121 http://ramirose.wix.com/ramirosen Namespaces - contd It was intended that there will be 10 namespaces: the following 4 namespaces are not implemented (yet): ● security namespace ● security keys namespace ● device namespace ● time namespace.
    [Show full text]