On-Demand Encrypted Container Image Blocks With VM Remapping
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing containerization technologies provide insufficient isolation for highly sensitive containers, necessitating stronger security measures, while conventional encrypted container image downloads incur high overhead and resource usage.
Innovation Solution
Implementing on-demand encrypted container image download for VM-based containers using a host-based block caching mechanism that maintains a cache of encrypted container image blocks, allowing decryption within the VM and sharing among multiple containers, reducing startup times and resource usage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If containerization technology is used to provide isolation between containers, then ease of operation and resource efficiency are improved, but security isolation strength deteriorates
Solution Approach 1:
The container image is segmented into multiple blocks that are downloaded and decrypted on-demand rather than as a complete image. This segmentation allows the system to maintain containerization efficiency while enhancing security through VM-based isolation for each container instance.
Solution Approach 2:
A block remapper component is introduced as an intermediary between the file system and the container runtime. This mediator handles decryption requests, manages block caching, and coordinates between the encrypted storage and the container execution environment, enabling both security and efficiency.
2Reliability
If encrypted container images are downloaded conventionally, then security is improved, but startup time and resource usage worsen
Solution Approach 1:
Decryption keys are obtained in advance and cached within the VM before container images are accessed. The block remapper is pre-configured with decryption capabilities, allowing encrypted blocks to be decrypted on-demand without delaying container startup or requiring full image decryption beforehand.
Solution Approach 2:
The system dynamically decrypts only the specific blocks that are needed at each moment rather than decrypting the entire container image upfront. This dynamic on-demand decryption approach reduces both startup time and memory usage while maintaining security.
3Productivity
If complete container images are downloaded and decrypted, then availability is improved, but storage requirements and resource usage worsen
Solution Approach 1:
Instead of uniformly downloading and storing complete container images, the system provides different quality levels of image access locally - only the specific blocks needed by each container are downloaded and decrypted to the extent necessary. This local quality differentiation reduces overall storage requirements while maintaining container availability.
Solution Approach 2:
Decrypted container image blocks are cached temporarily in the VM and can be recovered for future use without requiring permanent storage of the complete decrypted image. This allows the system to discard decrypted blocks after use, significantly reducing storage requirements while maintaining productivity through caching.
Data Source
AI summary
A virtual machine (VM)-based container runtime executing on a computing device receives a request to run a container from a container image that is at least partially encrypted. The VM-based container runtime causes a VM to be initiated from a VM image, the VM image including an agent operable to, during execution, obtain a plurality of decryption keys operable to decrypt blocks of the container image. The agent is operable to set up a block remapper in the VM to be invoked by a file system mounted to the VM to request a particular container image block, send a request for the particular container image block to a block obtainer component executing outside of the VM, utilize a decryption key to decrypt a container image block received from the block obtainer component to generate a decrypted container image block, and pass the decrypted container image block to the file system.