Blending containers and virtual machines: a study of firecracker and gVisor
Blending containers and virtual machines: a study of firecracker and gVisor
复制标题
混合容器和虚拟机：Firecracker 和 gVisor 的研究
DOI：
10.1145/3381052.3381315
复制
发表时间：
2020
期刊：
影响因子：
--
通讯作者：
Swift, Michael M.
中科院分区：
文献类型：
--
作者：
Anjali, FNU;Caraza-Harter, Tyler;Swift, Michael M.
通过无服务器计算，提供商可以动态部署应用程序代码并管理资源分配，从而从应用程序开发中消除基础设施管理。无服务器提供商有各种虚拟化平台可供选择，以实现隔离功能，从原生Linux进程到Linux容器，再到轻量级隔离平台，如Google gVisor [7]和AWS Fiorracker [5]。这些平台形成了一个范围，因为它们将功能从主机内核转移到隔离的客户环境中。例如，gVisor在用户模式的Sentry进程中处理许多系统调用，而FiCracker在每个microVM中运行完整的客户操作系统。在本文中，我们对Linux容器（LXC）、gVisor安全容器和Fiorencacker microVM进行了比较研究，以了解它们如何以不同的方式使用Linux内核服务：它们对主机内核功能的使用有多大差异？我们还评估了一系列针对不同内核子系统的微基准测试的设计的性能成本。我们的结果表明，尽管移动了很多功能的内核，无论是Firacker和gVisor执行更多的内核代码比本地Linux。gVisor和Linux容器执行基本相同的代码，尽管频率不同。
With serverless computing, providers deploy application code and manage resource allocation dynamically, eliminating infrastructure management from application development.Serverless providers have a variety of virtualization platforms to choose from for isolating functions, ranging from native Linux processes to Linux containers to lightweight isolation platforms, such as Google gVisor [7] and AWS Firecracker [5]. These platforms form a spectrum as they move functionality out of the host kernel and into an isolated guest environment. For example, gVisor handles many system calls in a user-mode Sentry process while Firecracker runs a full guest operating system in each microVM. A common theme across these platforms are the twin goals of strong isolation and high performance.In this paper, we perform a comparative study of Linux containers (LXC), gVisor secure containers, and Firecracker microVMs to understand how they use Linux kernel services differently:how much does their use of host kernel functionality vary?We also evaluate the performance costs of the designs with a series of microbenchmarks targeting different kernel subsystems.Our results show that despite moving much functionality out of the kernel, both Firecracker and gVisor execute substantially more kernel code than native Linux. gVisor and Linux containers execute substantially the same code, although with different frequency.
DOI：
--
发表时间：
2018-07
期刊：
--
影响因子：
--
作者：
Liang Wang;Mengyuan Li;Yinqian Zhang;Thomas Ristenpart;M. Swift
通讯作者：
Liang Wang;Mengyuan Li;Yinqian Zhang;Thomas Ristenpart;M. Swift