Back To Schedule
Monday, July 8 • 5:00pm - 5:30pm
An Ounce of Prevention is Worth a Pound of Cure: Ahead-of-time Preparation for Safe High-level Container Interfaces

Sign up or log in to save this to your schedule, view media, leave feedback and see who's attending!

Containers continue to gain traction in the cloud as lightweight alternatives to virtual machines (VMs). This is partially due to their use of host filesystem abstractions, which play a role in startup times, memory utilization, crash consistency, file sharing, host introspection, and image management. However, the filesystem interface is high-level and wide, presenting a large attack surface to the host. Emerging secure container efforts focus on lowering the level of abstraction of the interface to the host through deprivileged functionality recreation (e.g., VMs, userspace kernels). However, the filesystem abstraction is so important that some have resorted to directly exposing it from the host instead of suffering the resulting semantic gap. In this paper, we suggest that through careful ahead-of-time metadata preparation, secure containers can maintain a small attack surface while simultaneously alleviating the semantic gap.


Ricardo Koller

IBM T. J. Watson Research Center

Dan Williams

IBM T. J. Watson Research Center

Monday July 8, 2019 5:00pm - 5:30pm PDT
HotStorage: Grand Ballroom I–III