UML Kernel Isolation in Containers via System Call Hooking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing container technology faces compatibility and reliability issues when running kernel-dependent applications, as all containers on a host processing system share the same kernel, leading to functionality and robustness problems.
Innovation Solution
Implementing a User Mode Linux (UML) kernel inside a container and using a system call hook kernel module to redirect system calls from the host kernel to the UML kernel, allowing for secure and stable operation of kernel-dependent applications without affecting other containers or the host kernel.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Use of energy by moving object
If all containers on a host processing system share the same kernel, then resource usage is reduced and containers become lightweight, but compatibility and reliability issues occur when running kernel-dependent applications
Solution Approach 1:
The patent segments the kernel isolation scope by introducing a nested virtualization layer where a virtualized kernel runs inside the container, separate from the host kernel. This allows each container to have its own kernel instance while still sharing the host OS, resolving the contradiction between resource efficiency and kernel-level isolation for kernel-dependent applications.
Solution Approach 2:
The patent implements nested virtualization by placing a virtualized kernel inside the container (a container within a container). The outer container shares the host kernel, while the inner virtualized kernel provides isolated kernel functionality for kernel-dependent applications, enabling multi-level resource sharing with targeted isolation.
2Ease of manufacture
If containers share the host kernel, then container deployment is simplified and resource overhead is reduced, but functionality and robustness problems arise for kernel-dependent applications
Solution Approach 1:
The patent introduces dynamic kernel selection capability where containers can choose to use either the host kernel or a virtualized kernel based on application requirements. This dynamic approach maintains deployment simplicity for standard applications while providing robustness when kernel isolation is needed, resolving the contradiction between ease of deployment and application reliability.
3Reliability
If a virtualized kernel is introduced inside a container, then kernel-dependent applications can run with improved security and stability, but system complexity increases
Solution Approach 1:
The patent introduces a kernel module as an intermediary layer that manages communication between the host kernel and the virtualized kernel inside the container. This intermediary handles system call redirection and coordination, providing security and stability benefits while abstracting away much of the underlying complexity from users and applications.
4Reliability
If system call redirection is implemented from host kernel to UML kernel, then secure operation of kernel-dependent applications is achieved, but additional overhead is introduced
Solution Approach 1:
The patent implements selective system call redirection where only specific system calls required by kernel-dependent applications are redirected to the virtualized kernel, while other system calls continue to use the host kernel directly. This localized approach provides security where needed without introducing unnecessary overhead for all operations, resolving the contradiction between secure operation and performance efficiency.
Data Source
AI summary
Examples of techniques for running kernel dependent applications in containers are disclosed. In one example implementation, a method includes initiating, by a processing system, a user mode Linux (UML) kernel in a container of a host. The method further includes initiating, by the processing system, an agent inside the UML, the agent configured to handle system call redirection from a host kernel of the host. The method further includes enabling, by the processing system, a system call hook kernel module on the host to hook a system call received from the container. The method further includes determining, by the processing system, whether the UML kernel is running inside the container. The method further includes, based at least in part on determining that the UML is running inside the container, passing, by the processing system, the system call to the UML kernel inside the container.