NanoVisor: Modernizing Container Runtime with an Architecture Refactor..
Talkat Open Source Summit Europe 2023 · on Tuesday, 2023-09-19· at 15:40· Room 0A (Floor 0), Abandoibarra Etorb., 4, 48011 Bilbao, Bizkaia, Spain·
summary
NanoVisor refactors gVisor to hit production performance: a rewritten userspace network stack plus device passthrough and C/Rust hot paths drop syscall-emulation hot paths from ~1 µs to ~100 ns and reduce sandbox→host syscall pass to ~400 ns. File stack uses EROFS plus raw file-backed tmpfs to eliminate gofer, removing proxying overhead. Claims show 0.5–1x better throughput than runc on Redis/Nginx/RPC and comparable fs results, and a FaaS mode with 7 ms cold start and <1 MB extra memory, at the cost of removing KPTI and tightening seccomp.
AI-written summary · about
chapters (6)
- 0:00Introduction to gVisor
- 2:46Architecture and history
- 7:16Evaluation and challenges
- 12:09Performance optimizations
- 24:36Production implementation
- 31:34Summary and Q&A
related talks
40mContainer Isolation at Scale (Introducing gVisor) - Dawn Chen & Zhengyu He, Google
27mgVisor Container on Arm64: Let‘s Talk about Our Progress!
35mThe Enemy Within: Running Untrusted Code with gVisor
07mLightning Talk: Optimizing Security Container Runtime's Network Performance with Modular Plugin TCP/IP Stack
25mIsolating Kubernetes Workloads with gVisor
37mA New Secure Container Solution on Arm Platform: gVisor
37mA New Secure Container Solution on Arm Platform: gVisor
35mThe Enemy Within: Running Untrusted Code with gVisor