We're sorry but this page doesn't work properly without JavaScript enabled. Please enable it to continue.
Feedback

Leveraging virtio-vsock in the cloud and containers

Formale Metadaten

Titel
Leveraging virtio-vsock in the cloud and containers
Untertitel
A communication channel for isolated workloads
Serientitel
Anzahl der Teile
637
Autor
Lizenz
CC-Namensnennung 2.0 Belgien:
Sie dürfen das Werk bzw. den Inhalt zu jedem legalen Zweck nutzen, verändern und in unveränderter oder veränderter Form vervielfältigen, verbreiten und öffentlich zugänglich machen, sofern Sie den Namen des Autors/Rechteinhabers in der von ihm festgelegten Weise nennen.
Identifikatoren
Herausgeber
Erscheinungsjahr2021
SpracheEnglisch

Inhaltliche Metadaten

Fachgebiet
Genre
Abstract
VM sockets (vsock) enable communication between hosts and VMs. The vsock use cases have grown over the recent years to also cover cloud and containers projects. Andra and Stefano will walk through the details of a set of projects focused on isolation that use vsock as a communication channel. Then they will present debugging tools and further work items for improving and adding new features for vsock. In the last years, many projects have been developed to increase security and isolation in the cloud and containers, such as Kata Containers, Nitro Enclaves, and libkrun. All these projects leverage Linux KVM (Kernel-based virtual machines) to create a more isolated environment. They use VM sockets (vsock) to provide a communication channel between constrained and less constrained worlds, reducing the attack surface. These VM sockets are provided by the AF_VSOCK address family and the virtio-vsock device. They offer a very simple configuration and the possibility to use POSIX sockets to communicate between hosts and VMs. Andra and Stefano will give a brief introduction of AF_VSOCK and virtio-vsock. Then they will illustrate how the projects and features, mentioned at the beginning, use VM sockets. They will present a couple of demos to explain how to use several tools for easier debugging and performance evaluation of vsock. At the end, they will share an overview of a set of new features such as namespaces, multiqueue, and shared memory. These are planned as future work to further grow the ecosystem for virtio-vsock.