Restricted Address Spaces for Container Security
summary
Uses the MMU to give namespaces separate kernel page tables so kernel objects can be hidden from other containers; implements GFP_EXCLUSIVE and slab_exclusive flags to allocate pages excluded from the direct map and adds a 2MB page cache strategy to avoid heavy fragmentation when splitting 1GB/2MB pages. Prototype targets the network namespace as an isolated network namespace, runs memcached/apache/nginx/iperf benchmarks, shows mostly single-digit perf loss (under ~10%) and compares favorably to VM PCI passthrough.
AI-written summary · about
chapters (19)
- 0:00Introduction
- 0:17Container images
- 1:07Container hardware resolution
- 2:09Container vulnerability
- 3:12Parent namespace
- 4:30Network namespace
- 5:33Unmapped
- 6:10Management
- 7:07Related Use Cases
- 8:23Kernel Page Tables
- 9:54Direct Map
- 12:43Benchmarks
- 14:19Cache
- 17:54GFP Exclusive
- 19:07Lab Exclusive
- 20:38Metadata
- 21:22Networking Stack
- 25:20Conclusion
- 26:24Testing
related talks
22mAddress Spaces for Namespaces
32mSecurity Namespace: Making Linux Security Frameworks Available to Containers
43mAddress Space Isolation for Enhanced Safety of the Linux Kernel
48mAddress Space Isolation is ready
38mUnmapped Private Memory for Confidential Guests
45mMaking Containers Safer
47mNamespacing the Linux Integrity Measurement Architecture
47mContainer Security