Lightning Talk: Optimizing Security Container Runtime's Network Performance with Modular Plugin TCP/IP Stack

on YouTube ↗07m

" summary

Presents a concrete patch: gVisor’s Sentry gets a user-level TCP/IP stack (ta-deck, FD.io, DPDK, async I/O) via a glue interface and static link so syscalls route into the library; original gVisor netstack hits ~60% of runc throughput, the virtual I/O mode matches runc, and the VFIO device-passthrough mode reaches ~1.5× runc. Adds built-in traffic audit and access-control hooks while preserving gVisor’s isolation.

AI-written summary · about

" chapters (8)

1. 0:00Introduction
2. 0:13What is Security Container Runtime
3. 0:47What is Gvisor
4. 2:18The Dilemma
5. 3:22Radice Benchmark
6. 4:14TCPIP Stack
7. 5:51Gvisor
8. 6:24Conclusion

" related talks

• 35mNanoVisor: Modernizing Container Runtime with an Architecture Refactor..Jianfeng Tan, Tianyu Zhou · Open Source Summit Europe 2023
• 17mRearchitecting the TCP Stack for I/O-Offloaded Content DeliveryYoungjin Kwon, Minlan Yu, KyoungSoo Park, Taehyun Kim, Deondre Martin Ng, Junzhi Gong · NSDI 2023
• 30mAccelerating AI Securely with GVisorLucas Manning · CloudNativeSecurityCon North America 2024
• 27mgVisor Container on Arm64: Let‘s Talk about Our Progress!Bin Lu, Haibo Xu · Linaro Connect Bangkok 2019
• 25mIsolating Kubernetes Workloads with gVisorAbdelfettah Sghiouar · DevOpsDays Copenhagen 2019
• 40mContainer Isolation at Scale (Introducing gVisor) - Dawn Chen & Zhengyu He, GoogleDawn Chen, Zhengyu He · KubeCon + CloudNativeCon Europe 2018
• 35mThe Enemy Within: Running Untrusted Code with gVisorIan Lewis · KubeCon + CloudNativeCon China 2019
• 20mNetKernel: Making Network Stack Part of the Virtualized InfrastructureKeith Winstein, Peng Cheng, Yongqiang Xiong, Tao Wang, Zhixiong Niu, Qiang Su, Hong Xu, Dongsu Han · USENIX ATC '20