Encrypted Container Image Blocks for Faster VM Container Startup
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing containerization technologies provide insufficient isolation for highly sensitive containers, necessitating stronger security measures akin to virtual machines, while conventional encrypted container image downloads incur substantial overhead and resource usage.
Innovation Solution
Implementing on-demand encrypted container image download for VM-based containers, utilizing a block caching mechanism that maintains a cache of encrypted container image blocks, allowing decryption within the VM and sharing among multiple containers, reducing startup times and storage requirements.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If complete encrypted container images are downloaded before use, then security is improved, but startup time and resource usage increase
Solution Approach 1:
The container image is divided into multiple blocks that are downloaded and decrypted on-demand rather than downloading the complete image upfront. This segmentation allows the system to retrieve only necessary image blocks when needed, reducing startup time while maintaining security through encrypted storage and selective decryption.
Solution Approach 2:
The container image blocks are pre-encoded and stored in encrypted form in the container registry before being requested. This preliminary encryption and storage preparation enables fast on-demand retrieval and decryption without compromising security, resolving the contradiction between security and startup time.
2Reliability
If complete encrypted container images are downloaded before use, then security is improved, but storage requirements increase
Solution Approach 1:
The container image is segmented into multiple blocks stored separately in encrypted form. This segmentation reduces the storage burden on individual systems since only required blocks are downloaded and cached locally, while the encrypted storage format maintains security requirements.
Solution Approach 2:
Instead of storing complete decrypted images locally, the system stores and transfers only encrypted image blocks as needed. This copying approach reduces storage requirements while maintaining security through encrypted container image blocks.
3Speed
If container images are decrypted and cached locally, then access speed is improved, but security is compromised
Solution Approach 1:
The system implements local caching of encrypted container image blocks rather than decrypting them. This allows fast local access speed while maintaining security, as the cached blocks remain encrypted and can be decrypted on-demand within the container runtime environment without exposing full image decryption.
4Reliability
If conventional encrypted container image downloads are used, then security is maintained, but resource usage increases
Solution Approach 1:
The container image download process is segmented into on-demand block retrieval operations. This segmentation reduces resource usage by downloading and decrypting only necessary image blocks rather than complete images, while encrypted storage and transmission maintain security requirements.
Solution Approach 2:
The system performs partial downloads of only the necessary container image blocks required for container execution rather than downloading complete images. This partial action approach reduces resource usage while maintaining security through encrypted container image block storage and on-demand decryption.
Data Source
Figure 1
Figure 2
Figure 2A1
AI summary
A virtual machine (VM)-based container runtime executing on a computing device receives a request to run a container from a container image that is at least partially encrypted. The VM-based container runtime causes a VM to be initiated from a VM image, the VM image including an agent operable to, during execution, obtain a plurality of decryption keys operable to decrypt blocks of the container image. The agent is operable to set up a block remapper in the VM to be invoked by a file system mounted to the VM to request a particular container image block, send a request for the particular container image block to a block obtainer component executing outside of the VM, utilize a decryption key to decrypt a container image block received from the block obtainer component to generate a decrypted container image block, and pass the decrypted container image block to the file system.