Containers and Security on Planet X
summary
HPC needs container runtimes that preserve bare‑metal performance and low jitter, not general cloud defaults. Charliecloud uses unprivileged user namespaces so users run containers without root privileges; Shifter uses setuid plus an image gateway to sanitize images before runtime; Singularity v1/v2 has known risks while v3 is unvetted. Los Alamos builds a provisioning tool called kraken and uses vendor-supplied burst buffers (SSD nodes) to checkpoint very large jobs quickly on systems like Trinity.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 0:46What is LISA
- 1:11History of LISA
- 1:25kraken
- 3:53Corey Quinn
- 6:35What makes HPC so special
- 12:27Jitter
- 16:07Docker
- 20:26Other options
- 23:03Cloud Native Landscape
- 25:05Burst Buffer
related talks
45mCharliecloud: Unprivileged Containers for User-Defined Software Stacks in HPC
25mTowards the Hardened Cloud-Native Cornerstone: Container Runtime Protection from Secur...
31mConfidential Containers – Sensitive Data and Privacy in Cloud Native Environments
46mAutomatically Securing Linux Application Containers in Untrusted Clouds
40mKubernetes Meets Confidential Computing - The Different Ways of Scaling Sensitive Workloads
31mYour Containers Aren’t Alone: Demystifying Container Isolation
14mYour Containers Aren’t Alone: Demystifying Container Isolation
29mConfidential Containers: The Next Era of Cloud Data Security