Iron: Isolating Network-based CPU in Container Environments

on YouTube ↗22m

" summary

Shows that unaccounted network stack CPU lets noisy containers steal core time and builds Iron, a Linux kernel patchset that accounts per-packet and batch CPU cost by tagging skbs with an 8-byte container pointer, charging time into cgroup runtime, and returning it via scheduler state. Evaluated on a 48-container cluster with MapReduce victims and terasort-like interferers, Iron drops penalty factors from as high as 6x (receivers) or 4.45x (UDP) to about 1.04, using queue stripping poll-drop and minimal scheduler changes.

AI-written summary · about

" chapters (17)

1. 0:00Intro
2. 0:18Virtualization
3. 2:17Isolation is Broken
4. 3:03Practical Implications
5. 3:53How is Isolation Broken?
6. 5:03How did Linux get here?
7. 6:06Sender Side
8. 8:16Experiment Setup
9. 9:29Receiver Side
10. 9:58Scenarios When Isolation Breaks
11. 10:34Outline
12. 11:13Iron - Accounting
13. 13:04Iron - Enforcement Scheduler Integration
14. 15:26Iron - Enforcement Dropping Packets
15. 16:52Receiver Interference With Iron
16. 17:23Impact on Big Data Applications
17. 17:54Summary