Rust-based, Secure and Lightweight Container Runtime for Embedded Systems
summary
A Rust-based container runtime optimized for embedded systems implements a pre-created-container fast-startup called first setup, fine-grained access control via the Linux seccomp notify mechanism to safely emulate privileged syscalls for rootless containers, and real-time CPU affinity controls. The prototype builds to a 2.63 MB binary, avoids Go garbage-collector overhead, and in benchmarks launches containers 7.4× faster and uses ~4.4× less memory than runc, demonstrating the approach works for resource-constrained, mission-critical embedded workloads.
AI-written summary · about
chapters (23)
- 0:00Intro
- 0:22Outline of the Talk
- 1:05Container Virtualization
- 1:30What is Container Runtime?
- 2:12Container Runtime Stack
- 2:57Requirements of Embedded Systems
- 3:32Containers on Embedded Systems
- 4:42Problems of the Existing Runtimes
- 6:19Rust-based Container Runtime
- 7:07Comparison with the Existing Runtimes
- 7:50Why Rust?
- 8:47Crates for the Container Runtime
- 9:19Architecture Overview
- 10:44Real-Time (RT) Support
- 10:59Design of Fast Startup and RT Support
- 12:31Fine-Grained Access Control (FGAC)
- 13:45Seccomp Notify Feature
- 14:49Design of FGAC
- 16:57Evaluation
- 17:31Results: Start Time
- 18:04Results: Memory Usage
- 18:34Future Work
- 19:05Conclusion
related talks
26mPossibility of OCI Container Runtime with Rust
34mWriting an Embedded Operating System in Rust
05mRust Here, Rust There, Rust Everywhere! How a Crab Conquers the Cl...
17mRust in Production
26mIntroducing Rust into a Legacy Embedded System
24mWrite your own container, for fun and no profit!
36mIt's Embedded Rust Time
21mRust - Cargo Cult?