~/talk

LITESHIELD: Secure Containers via Lightweight, Composable Userspace μKernel...

on YouTube 18m
Talkat USENIX ATC '25 · 2025-07-07..07-09· [security, linux-and-operating-systems]

speakers

name:Kaesi Manakkal
links:none on file
name:Nathan Daughety
links:none on file
name:Marcus Pendleton
links:none on file
name:Hui Lu
links:none on file

resources

video:https://youtu.be/Q6goGLQ762o
slides:none on file

summary

LITESHIELD claims VM-like isolation while avoiding VMs by reducing the user‑to‑host interface to 22 syscalls. It implements fast shared‑memory IPC and syscall redirection via LD_PRELOAD interception, runs a user‑space network stack (FSAC on DPDK bound to tap devices) and an Xv6‑like file service backed by mmap, totaling ~7,000 LOC for core services. Evaluation shows much lower getpid and read latency, better UDP throughput, weaker TCP, FIO and YCSB on Reddus that match or beat VM baselines while preserving compatibility with unmodified Linux binaries.

AI-written summary · about

chapters (11)

  1. 0:00Introduction
  2. 0:41Monolithic vs micro kernels
  3. 2:30Microservices container challenges
  4. 5:18VM isolation vs performance
  5. 7:03Light Shield secure containers
  6. 9:13Non-delegable syscalls in userspace
  7. 11:19Kernel bypass for high-performance IO
  8. 12:23Legacy apps with LD preload
  9. 13:27Implementation and syscall interception
  10. 14:51Performance benchmarks
  11. 16:58Summary

related talks

~/search
type to search 6,249 conferences, 138,987 speakers and 185,172 talks
~/help
cmdctrl k
search every conference, speaker and series
/
focus the filter search
h
home
c
conferences
s
speakers
e
series
t
light / dark — the status bar button does the same
?
this help
esc
close this, then clear every filter — or just the search, while you are typing in it

Ignored while you are typing. Pages without a filter rail have no search to focus.