Skip to content

LinuxSecurityModules/ContainerPapers

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

27 Commits
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

Container Papers

Design on Secure Containers

  1. Drawbridge-Rethinking the library OS from the top down

  2. OSv-Optimizing the Operating System for Virtual Machines, which is a new OS designed to run single application

  3. LightVM-My VM is Lighter (and Safer) than your Container

  4. Graphene-SGX- A Practical Library OS for Unmodified Applications on SGX

  5. Directvisor-Virtualization for Bare-metal Cloud

  6. Firecracker- Lightweight Virtualization for Serverless Applications.pdf

  7. X-Containers-Breaking Down Barriers to Improve Performance and Isolation of Cloud-Native Containers

Books

  1. Hardware and Software Support for Virtulization

Blogs

  1. VirtFS 虚拟化技术简介

Compare Secure Containers

  1. Blending Containers and Virtual Machines- A Study of Firecracker and gVisor

Optimization: FS Sharing

  1. 9p filesystem protocol https://www.kernel.org/doc/html/latest/filesystems/9p.html https://github.com/torvalds/linux/tree/master/fs/9p https://github.com/torvalds/linux/tree/master/net/9p

  2. XCPU & Clustering http://xcpu.org/papers/xcpu-talk.pdf

  3. KVMFS: control file system for KVM http://xcpu.org/papers/kvmfs.pdf

  4. CellFS: A New Programming Model for the Cell BE http://xcpu.org/papers/cellfs-talk.pdf

  5. PROSE I/O: Using 9p to enable Application Partitions http://plan9.escet.urjc.es/iwp9/cready/PROSE_iwp9_2006.pdf

  6. VirtFS: A Virtualization Aware File System pass-through http://goo.gl/3WPDg

Related Open Source Projects

Linux Binary Compatible

  • UML User-Mode Linux
  • OSv - Modular unikernel able to execute unmodified Linux binaries, developed in C++.
  • Nanos - Linux binary compatible unikernel focused on security.
  • HermiTux - Research project from Virginia Tech, demonstrating advanced optimizations.

Language oriented

  • HaLVM - Port of Glasgow Haskell compiler producing Xen optimized unikernels.
  • LING - Erlang/Elixir unikernel development toolkit targeting Xen.
  • MirageOS - OCaml unikernel development library using OCAML on XEN.
  • runtime.js - KVM oriented unikernel for running JavaScript applications via the V8 engine.
  • IncludeOS - Feature rich unikernel development library for C++.
  • Toro Kernel - Lazarus/FreePascal toolkit for unikernel development.
  • Ultibo Core - Lazarus/FreePascal unikernel targeting Raspberry Pi as the runtime environment.
  • rekernel - Minimal setup for developing unikernels in ReasonML.
  • Union - POSIX compliant unikernel written in Rust.
  • binaryno - Rust unikernel running on bare ARM CortexM hardware.

Generic

  • ClickOS - Efficient network function virtualization platform, optimized for Xen and developed by NEC, A high-performance, virtualized software middlebox platform (e.g., for NFV).
  • Clive - Research project from Rey Juan Carlos University (Madrid), developed in Go, an OS designed to work in distributed and cloud environments.
  • Mini-OS - Reference kernel distributed with Xen.
  • Rump Kernels - Development platform reusing NetBSD components for producing efficient unikernels, running unmodified POSIX software as a unikernel
  • Firecracker - AWS's VM isolation engine, using in products such as Lambda and Fargate.
  • Unikraft - Collection of building blocks for unikernel development.
  • BareMetal - Self described as an exokernel, it can be used as the starting point for unikernel development.
  • HermitCore - A C-based, lightweight unikernel project from Aachen University.
  • unicycle - Unikernel application framework developed in C.
  • EbbRT - Boston University unikernel research project.
  • Nautilus - Aerokernel from Sandia National Laboratories, supporting bare metal x86_64 and Xeon Phi.
  • JML - Proof of concept for a minimal web server unikernel implementing its own language.
  • UNICORE - Common code base and toolkit for deployment of applications to secure and reliable execution environments.

Unikernel-like

  • Drawbridge - Research prototype platform from Microsoft.
  • Graphene - Library OS optimized for Intel SGX.

Tools

  • OPS - Orchestration tool for building and deploying Nanos based images.
  • Capstan - Orchestration tool for packaging and running OSv based images.
  • UniK - Unikernel compiler supporting a Firecracker, rump kernels, OSv, IncludeOS and MirageOS.
  • Solo5 - Middle-ware interfacing unikernels with the host systems.
  • Albatross - MigrageOS unikernel orchestration, via Solo5.

About

Papers and related works for secure containers

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published