OS2ATC 2025 - 安全容器统一架构.pdf

1、安全容器统一架构1分享人：谈鉴锋2025.03背景：容器运行时VMrunvSandboxgVisorgVisor,Nabla,QuarkContainerMicroVM KATA,Firecracker,Cloud HypervisorLinux Containersruncrunc,crun,youki2背景：安全容器源于安全Wang,Xu,and Samuel Ortiz.Kata Containers:Hypervisor-Based Container Runtime.KubeCon North America,2017,HyperHQ&Intel.Chen,Dawn,and Zhen

2、gyu He.Container Isolation at Scale(Introducing gVisor).KubeCon Europe,May 2018,Google.Barr,Jeff.Firecracker Lightweight Virtualization for Serverless Computing.AWS re 2018,26 Nov.2018.Wang,Xu.Kata and gVisor:A Quantitative Comparison.hyper.sh,1013 Dec.2018.3AppsAppsAppsHost Linux KernelDaemonsetsSe

3、cure Container Runtime(Kata&gVisor&Firecracker)System servicesAppsL0:Final bastion,e.g.,Live-patch&eBPF-based LSML1:Jailer Barrier,e.g.,cgroup/chroot/namespace/capabilityL2:Sandbox,e.g.,Lock-in-Pop or VirtualizationGuest KernelL3:Customized kernel,e.g.,mem-safe,KSPCIPU/IPU/DPUDevice passthroughSecur

4、echannelL-1:IaaS security背景：安全容器不止于安全4性能隔离故障隔离定制内核“software interrupts a conglomerate of mostly unrelated jobs,which run in the context of a randomly chosen victimw/o the ability to put any control on them.”-Thomas Gleixner(Linux developer)安全容器是云原生基础设施必要组件！5蚂蚁的云原生节点架构节点组件L2:Virtualization&Sandbox,e.

5、g.,KVM,NanoVM,PVM MemDDR,HBM,CXL调度和资源管理可观察性内存管理调度网络安全CPUSIMD,QoS,E-coresAppsAppsPODs(kata)Functions(NanoVisor)AppsAppsPODs(NanoVisor)文件系统NICRDMA,TSOBusPCIe,QPI,NVLink在线APPSidecarsSidecarsSidecarsLinux KernelHardwarexPUGPU,NPU,LPU,离线APPAppsAppsPODs(rune)APPL3:Customized kernel,e.g.,mem-safe,KSPL1:Jai

6、ler Barrier,e.g.,cgroup/chroot/namespace/capabilityL0:Node EDR,e.g.,monitor,threat detection,authentication 6深度防御、最小攻击面、最小权限机密容器离线容器架构困境7普通容器隔离技术（runc）Unikernel隔离技术轻量级虚拟机（rund）gVisor（runsc）共享内核攻击面太大性能隔离差兼容性差镜像制作麻烦兼容性好资源灵活性启动时间/开销问题Note:Kata has improved this a