Attending this event?
November 13–15, 2018 - Shanghai, China
Click Here For Information & Registration

To view the Chinese version of this schedule please go here.

Simultaneous translation will be provided for all keynote and breakout sessions.
View analytic
Thursday, November 15 • 16:45 - 17:20
Nabla Containers: A New Approach to Container Isolation - Brandon Lum & Ricardo Koller, IBM

Sign up or log in to save this to your schedule and see who's attending!

Horizontal attacks are an important security concern for cloud providers and its tenants. Despite its many advantages, containers have not been accepted as isolated sandboxes, which is crucial for container-native clouds. The exposure of the syscall interface directly to untrusted workloads has greatly increased the number of exploits possible to the host.

We present Nabla containers, which uses library OS/unikernel techniques to avoid system calls and thereby reduce the attack surface on the host kernel. Using our OCI runtime, runnc (https://github.com/nabla-containers/runnc), we show the running of popular applcations: Node.js, python, redis, etc. permitting use of < 9 syscalls via seccomp. In this talk, we will discuss and demo how we have leveraged libOS ideas in a novel way and compare isolation and performance metrics against other technologies such as gvisor and Kata Containers.


Ricardo Koller

Research Scientist 科学研究员, IBM
Ricardo Koller is a systems researcher at the IBM T.J. Watson Research Center. | He specializes on virtualization and OS kernels, and has been focusing on | unikernels and container security. He previously worked on container and VM | introspection, and previous to that, on virtual... Read More →
avatar for Brandon Lum

Brandon Lum

Software Engineer 软件工程师, IBM
Brandon loves designing and implementing computer systems (with a focus on Security, Operating Systems, and Distributed/Parallel Systems). He enjoys tackling both technical and business challenges and has a side interest in organizational behavior and leadership. | | At IBM Research... Read More →

Thursday November 15, 2018 16:45 - 17:20
302 A
Feedback form isn't open yet.