November 13–15, 2018 - Shanghai, China
Click Here For Information & Registration

To view the Chinese version of this schedule please go here.

Simultaneous translation will be provided for all keynote and breakout sessions.
Thursday, November 15 • 16:45 - 17:20
Nabla Containers: A New Approach to Container Isolation - Brandon Lum & Ricardo Koller, IBM

Sign up or log in to save this to your schedule and see who's attending!

Feedback form is now closed.
Horizontal attacks are an important security concern for cloud providers and its tenants. Despite its many advantages, containers have not been accepted as isolated sandboxes, which is crucial for container-native clouds. The exposure of the syscall interface directly to untrusted workloads has greatly increased the number of exploits possible to the host.

We present Nabla containers, which uses library OS/unikernel techniques to avoid system calls and thereby reduce the attack surface on the host kernel. Using our OCI runtime, runnc (https://github.com/nabla-containers/runnc), we show the running of popular applcations: Node.js, python, redis, etc. permitting use of < 9 syscalls via seccomp. In this talk, we will discuss and demo how we have leveraged libOS ideas in a novel way and compare isolation and performance metrics against other technologies such as gvisor and Kata Containers.


Ricardo Koller

Research Scientist 科学研究员, IBM
Ricardo Koller is a systems researcher at the IBM T.J. Watson Research Center. He specializes on virtualization and OS kernels, and has been focusing on unikernels and container security. He previously worked on container and VM introspection, and previous to that, on virtual machines... Read More →
avatar for Brandon Lum

Brandon Lum

Software Engineer, IBM
Brandon loves designing and implementing computer systems (with a focus on Security, Operating Systems, and Distributed/Parallel Systems). He enjoys tackling both technical and business challenges and has a side interest in organizational behavior and leadership. At IBM Research... Read More →

Thursday November 15, 2018 16:45 - 17:20
302 A