Abstract:Secure container runtimes serve as the foundational layer for creating and running containers, which is the bedrock of emerging computing paradigms like microservices and serverless computing. Although existing secure container runtimes indeed enhance security via running containers over a guest kernel and a Virtual Machine Monitor (VMM or Hypervisor), they incur performance penalties in critical areas such as networking, container startup, and I/O system calls. In our practice of operating microservices and serverless computing, we build a high-performance secure container runtime named Quark. Unlike existing solutions that rely on traditional VM technologies by importing Linux for the guest kernel and QEMU for the VMM, we take a different approach to building Quark from the ground up, paving the way for extreme customization to unlock high performance. Our development centers on co-designing a custom guest kernel and a VMM for secure containers. To this end, we build a lightweight guest OS kernel named QKernel and a specialized VMM named QVisor. The QKernel-QVisor codesign allows us to deliver three key advancements: high-performance RDMA-based container networking, fast container startup mode, and efficient mechanisms for executing I/O syscalls. In our practice with real-world apps like Redis, Quark cuts down P95 latency by 79.3% and increases throughput by 2.43x compared to Kata. Moreover, Quark container startup achieves 96.5% lower latency than the cold-start mode while saving 81.3% memory cost to the keep-warm mode. Quark is open-source with an industry-standard codebase in Rust.

RunD: A Lightweight Secure Container Runtime for High-density Deployment and High-concurrency Startup in Serverless Computing

Houdini's Escape

Orchestrated sandboxed containers, unikernels, and virtual machines for isolation‐enhanced multitenant workloads and serverless computing in cloud

Tackling Cold Start in Serverless Computing with Multi-Level Container Reuse

Hibernate Container: A Deflated Container Mode for Fast Startup and High-density Deployment in Serverless Computing

Quark: A High-Performance Secure Container Runtime for Serverless Computing

Understanding Network Startup for Secure Containers in Multi-Tenant Clouds: Performance, Bottleneck and Optimization

A Lightweight Container Security Framework Adapted to the Power Cloud Platform

Help Rather Than Recycle: Alleviating Cold Startup in Serverless Computing Through Inter-Function Container Sharing

Serverless Confidential Containers: Challenges and Opportunities

PVM: Efficient Shadow Paging for Deploying Secure Containers in Cloud-native Environment.

On Efficient Zygote Container Planning Toward Fast Function Startup in Serverless Edge Cloud.

No Provisioned Concurrency: Fast RDMA-codesigned Remote Fork for Serverless Computing

Sustainable Serverless Computing with Cold-start Optimization and Automatic Workflow Resource Scheduling

A Lightweight Virtualization Solution for Android Devices

Block-level Image Service for the Cloud

Adaptive Function Launching Acceleration in Serverless Computing Platforms.

Enhancing Resource Utilization Efficiency in Serverless Education: A Stateful Approach with Rofuse

FaaSNet: Scalable and Fast Provisioning of Custom Serverless Container Runtimes at Alibaba Cloud Function Compute

My VM is Lighter (and Safer) than your Container

Container-Based Cloud Platform for Mobile Computation Offloading.