容器系统隔离性机制研究

Compared to the traditional hardware virtualization technology, container has the advantages of small overhead, higher efficiency, etc., which makes it widely adopted in resource management, system maintenance and software deployment of cloud platform. Container not only has become the focus of cloud computing, but also has the potential to change the software ecosystem. Compared with the traditional hardware virtualization technology, the lack of isolation capability is the key limitation of containers, along with the increasing deployment density of containers in data centers. Container isolation problem has become increasingly significant and is the major bottleneck restricting the development and application of container technology. This project, starting from the core mechanism of operating system virtualization, provides a systematic and in-depth study on the problem and the essence of container isolation. It shows a comprehensive analysis of the complex factors involved in container isolation problem, combined with the technology development trend of computer architecture. This project puts forward a new system model and a set of isolation mechanisms targeting container isolation problem, which will guarantee high isolation capability among containers and solve the bottleneck of containerization in data centers.

相比于传统硬件虚拟化技术，容器技术具有开销小、效率高等优点，因而广泛应用于云计算平台的资源管理、系统运维和软件部署，不仅成为云计算领域的业界热点，而且具有改变软件生态的潜力。隔离性不足是容器相对传统虚拟化技术而言最大的局限性，随着数据中心容器部署密度的不断提高以及所承载应用的复杂多样，容器隔离性问题日益凸显，已成为制约容器技术发展和应用的主要瓶颈。本项目从操作系统虚拟化的核心机理出发，系统深入地研究了容器隔离性问题及其本质原因，全面综合地分析了容器隔离性问题涉及的复杂因素，并结合体系结构领域的技术发展趋势，提出了一套针对容器隔离性问题的新型系统架构和隔离方法，以保障容器运行环境的高效隔离能力，解决数据中心容器化过程中的关键瓶颈问题。