@inproceedings{Miemietz:2024,
abstract = {Containers are a light weight alternative to virtual machines, building on sandboxed processes whose permissions are restricted by additional security mechanisms such as seccomp-bpf. However, these mechanisms increase the kernel's attack surface, thus prompting new security challenges. In this paper, we ask the question of whether a system with processes properly restricted by design enables a container infrastructure with better security posture. For instance, microkernels with capability-based access control provide container-style isolation out of the box. On the basis of real-world {CVEs}, we argue that this conceptual simplicity actually results in a better security posture than that typically found on monolithic systems.We propose Oak, a container engine built on top of L4Re, a state-of-the-art microkernel-based operating system. For startup as well as for network microbenchmarks, containers running on L4Re exposed performance characteristics similar to that of containers on Linux. We thus conclude that building containers on microkernel is an approach worth pursuing further under both a performance and a security perspective.},
author = {Miemietz, Till and Reusch, Viktor and Hille, Matthias and Kurze, Max and Lackorzynksi, Adam and Roitzsch, Michael and Härtig, Hermann},
booktitle = {Proceedings of the 10th International Workshop on Container Technologies and Container Clouds},
date = {2024-12-02},
doi = {10.1145/3702637.3702957},
isbn = {9798400713392},
location = {New York, {NY}, {USA}},
pages = {1–6},
publisher = {Association for Computing Machinery},
series = {{WoC} '24},
shorttitle = {A Perfect Fit?},
title = {A Perfect Fit? - Towards Containers on Microkernels},
url = {https://dl.acm.org/doi/10.1145/3702637.3702957},
venue = {Hong Kong},
}
