Cimplifier: automatically debloating containers
Cimplifier: automatically debloating containers
复制标题
DOI：
10.1145/3106237.3106271
复制
发表时间：
2017-08
期刊：
影响因子：
--
通讯作者：
Vaibhav Rastogi;Drew Davidson;Lorenzo De Carli;S. Jha;P. Mcdaniel
中科院分区：
文献类型：
--
作者：
Vaibhav Rastogi;Drew Davidson;Lorenzo De Carli;S. Jha;P. Mcdaniel
应用程序容器（例如Docker提供的容器）最近已获得敏捷和无缝软件部署的解决方案。这些轻巧的虚拟化环境运行的应用程序与其资源和配置信息一起包装，因此可以在各种软件平台上部署。不幸的是，可以在单个容器中包含逻辑上不同的应用程序的包装，并鼓励包装在逻辑上不同的应用程序，并包含大量不必要的组件。这些实践不必要地通过数量级来增加容器尺寸的时间。它们还降低了整体安全性，因为每个安全性都包含了必要的或不可能带来的安全问题，并且在同一容器映像中包装的多个应用程序之间没有隔离。我们提出算法和称为Cimplifier的工具，它解决了以下问题：给定一个容器和简单的用户定义的约束，我们的工具将其分配到较简单的容器中，（i）彼此隔离，仅在必要时进行通信，以及（ii）（ii） ）仅包括足够的资源来执行其功能。我们对现实世界容器的评估表明，Cimplifier保留原始功能，导致图像大小的降低高达95％，甚至在30秒内处理大型容器。
Application containers, such as those provided by Docker, have recently gained popularity as a solution for agile and seamless software deployment. These light-weight virtualization environments run applications that are packed together with their resources and configuration information, and thus can be deployed across various software platforms. Unfortunately, the ease with which containers can be created is oftentimes a double-edged sword, encouraging the packaging of logically distinct applications, and the inclusion of significant amount of unnecessary components, within a single container. These practices needlessly increase the container size-sometimes by orders of magnitude. They also decrease the overall security, as each included component-necessary or not-may bring in security issues of its own, and there is no isolation between multiple applications packaged within the same container image. We propose algorithms and a tool called Cimplifier, which address these concerns: given a container and simple user-defined constraints, our tool partitions it into simpler containers, which (i) are isolated from each other, only communicating as necessary, and (ii) only include enough resources to perform their functionality. Our evaluation on real-world containers demonstrates that Cimplifier preserves the original functionality, leads to reduction in image size of up to 95%, and processes even large containers in under thirty seconds.