Secure Containers in Embedded Deployments
summary
Claims that containers stay as the packaging layer while an embedded hypervisor enforces isolation so real‑time and safety are preserved; implements this with Xen on ARM, a custom rkt stage1 that launches tiny Linux VMs, 9PFS to share the container root, and paravirt networking so a container nginx inside a VM listens on host port 80. Prototype runs successfully on Arm64; Xen can be built under ~60k LOC and target devices need roughly ≥1 GB RAM for practical use.
AI-written summary · about
chapters (15)
- 0:00Introduction
- 0:16The problem
- 1:55Packaging and Runtime
- 4:23Good and Bad
- 6:21Recommendations
- 7:12The Bottom Line
- 8:42Embedded Use Case
- 13:45Example
- 16:45Componentization
- 23:12Does Xen run containers
- 24:05How does it work
- 25:56Rocket
- 27:15Networking
- 29:15Meltdown
- 31:33Demo
related talks
47mContainer Security
14mYour Containers Aren’t Alone: Demystifying Container Isolation
31mYour Containers Aren’t Alone: Demystifying Container Isolation
46mDesigning Secure Containerized Applications for Embedded Linux Devices
37mA New Secure Container Solution on Arm Platform: gVisor
32mLotsa security - confining the extra security layer
41mDesigning Secure Containerized Applications for Embedded Linux Devices
14mA kernel? In a Container? Explain Yourself!