SBIR Phase I: X-Containers: Fast, Secure Containers for a Cloud-Native World

这个小型企业创新研究（SBIR）第一阶段项目的更广泛的影响/商业潜力将是在不牺牲性能和成本效益的情况下提高云计算的安全性。云计算已被证明是信息技术（IT）领域的颠覆性技术，应用程序容器市场是该领域快速增长的部分。尽管容器提供了一种更简单、更有效的设备来托管云中的应用程序，但仍存在一些重要的问题需要解决，例如安全隔离能力弱、内核兼容性低以及内核定制性差。安全性是最常见的问题，因为一个受感染的内核可以影响许多容器。到目前为止，每个采用容器应用程序的组织都被要求独立确保自己的安全性。一项研究发现，大多数（54%的参与者）在虚拟机（VM）上运行容器以进行安全隔离，这牺牲了性能和成本效率。因此，非常需要提供一种在不牺牲性能和成本效率的情况下支持更高安全性的容器架构。该项目解决了这一迫切需求，所产生的技术可以广泛应用于云计算、信息技术（IT）基础设施、网络功能虚拟化（NFV）等领域。这个小企业创新研究（SBIR）第一阶段项目将进一步提高新型软件应用程序容器架构的可用性、安全性和效率，以便客户可以轻松部署和评估。虽然目前的平台可以运行Docker容器而无需修改，但它与Docker和Kubernetes编排平台不兼容，这可能是许多容器用户和开发人员采用的障碍。新的容器可以运行现有应用程序的未经修改的迭代，并通过在运行时修补二进制文件来自动优化许多应用程序的性能。然而，在应用程序二进制中处理复杂的场景是具有挑战性的，并且需要更复杂的技术来进一步提高自动二进制优化模块的覆盖率。由于新容器平台所基于的一些软件的许可要求，研究原型是开源的。该项目的目标是通过五大目标来解决这些限制和挑战：支持Docker和Kubernetes生态系统兼容性;提高自动二进制优化覆盖率;重新设计平台以避免违反开源许可证;进一步提高安全性;开发自动安装工具和产品演示。该奖项反映了NSF的法定使命，并通过使用基金会的学术价值和更广泛的影响审查标准。

The broader impact/commercial potential of this Small Business Innovation Research (SBIR) Phase I project will be to improve security of cloud computing without sacrificing performance and cost efficiency. Cloud computing has proven to be a disruptive technology in the Information Technology (IT) sector, and the application container market is a rapidly growing segment of this sector. Although containers provide a simpler and more efficient apparatus to host applications in the cloud, there are important problems to address, such as weak security isolation, low kernel compatibility, and poor kernel customization. Security is the most common concern because one infected kernel can affect a multitude of containers. So far, each organization that has adopted container applications has been required to independently ensure their own security. One study found that a majority (54% of participants) ran containers on top of virtual machines (VMs) for security isolation, which sacrifices performance and cost efficiency. Thus, there is a significant need to provide a container architecture that supports greater security without sacrificing performance and cost efficiency. This project addresses this urgent need, and the resulting technology can be applied broadly to domains such as cloud computing, Information Technology (IT) infrastructures, Network Function Virtualization (NFV), etc.This Small Business Innovation Research (SBIR) Phase I project will further improve usability, security, and efficiency of a novel software application container architecture, so that it can be easily deployed and evaluated by customers. While the current platform can run Docker containers without modifications, it is incompatible with the Docker and Kubernetes orchestration platforms, which is a probable obstacle to adoption for many container users and developers. The novel containers can run unmodified iterations of existing applications and automatically optimize performance of many applications by patching the binary during runtime. However, it is challenging to handle complicated scenarios in the application binary, and a more sophisticated technique is required to further improve the coverage of the automatic binary optimization module. Due to the licensing requirements of some of the software the novel container platform is based on, the research prototype is run open-source. The goal of this project is to address these limitations and challenges through five major objectives: support Docker and Kubernetes ecosystem compatibility; improve automatic binary optimization coverage; re-design the platform to avoid open-source license violations; further improve security; develop an automatic installation tool and a product demonstration.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.