Engine-Agnostic Evaluation of Container Isolation Characteristics

This is the authors' abstract. We don't add key points for this paper.

Containers have become a widely used mechanism for isolation of software workloads on the same physical platform in cloud and edge computing scenarios. However, the isolation guarantees provided by containers result from multiple, interacting mechanisms for process isolation and virtualization at the kernel level. These mechanisms are often configured through a container engine with its own engine-level configuration semantics. Consequently, deciding whether a particular container configuration provides the level of isolation required in a given scenario is a non-trivial taskThe present work proposes an approach to assess the isolation characteristics of a container in an engine-agnostic way. To this end, we evaluate the container and host views of the configuration of process isolation mechanisms for a given container at the kernel user-space API-level. The approach for configuration assessment we propose makes the isolation characteristics that are provided by a container transparent. This enables, for instance, container engine administrators to assess container configurations prior to large-scale deployment in an efficient manner. Also, the proposed approach makes container isolation characteristics comparable among container engines and enables verification of the container isolation configuration at runtime.