Optimization of docker container security and its performance evaluation

Abstract

Containers have replaced virtual machines because of their superior performance and lower resource use. The largest problems they face arise when security issues, such as establishing an appropriate level of isolation, are neglected. Namespaces and groups are tools offered by the Linux kernel, present limitations in its implementation. The solution to mitigate them, on the other hand, involves the use of a heterogeneous and complex set of additional measures: control MAC access, privilege segregation using capabilities and call filtering to the core with scomp. These mechanisms, however, are complex and require detailed knowledge of the technology on which it is based. The suppliers of platform as a service (PaaS) have the advantage the economy of scale to meet these challenges. In this work we deal with security in different contexts, and try to determine if running containers in operation in an infrastructure of reduced size can maintain an acceptable level of security. We’ve done this by looking at container technology and excellent security procedures from a guidebook.

Subject Classification:

• 68M10

Keywords:

• Docker security
• Cgroup
• Mac access
• Platform of service
• Infrastructure of service