金发姑娘隔离：高性能虚拟机与Edera
Goldilocks Isolation: High Performance VMs with Edera
AI总结：
Edera通过优化类型1虚拟机实现高性能与强隔离，兼容Kubernetes容器运行时并提供硬件驱动隔离，性能优于Docker，启动时间略有增加。
摘要：
组织在共享云基础设施上运行应用，Docker和Kubernetes等工具通过操作系统虚拟化实现多租户。然而，共享内核导致容器逃逸攻击增多。Edera是一种优化的类型1虚拟机，采用半虚拟化提升性能，兼容Kubernetes容器运行时并提供硬件驱动隔离，其运行时间与Docker相近，系统调用性能平均快3%，内存性能快0-7%，启动时间比Docker长648毫秒。
英文摘要：
Organizations run applications on cloud infrastructure shared between multiple users and organizations. Popular tooling for this shared infrastructure, including Docker and Kubernetes, supports such multi-tenancy through the use of operating system virtualization. With operating system virtualization (known as containerization), multiple applications share the same kernel, reducing the runtime overhead. However, this shared kernel presents a large attack surface and has led to a proliferation of container escape attacks in which a kernel exploit lets an attacker escape the isolation of operating system virtualization to access other applications or the operating system itself. To address this, some systems have proposed a return to hypervisor virtualization for stronger isolation between applications. However, no existing system has achieved both the isolation of hypervisor virtualization and the performance and usability of operating system virtualization. We present Edera, an optimized type 1 hypervisor that uses paravirtualization to improve the runtime of hypervisor virtualization. We illustrate Edera's usability and performance through two use cases. First, we create a container runtime compatible with Kubernetes that runs on the Edera hypervisor. This implementation can be used as a drop-in replacement for the Kubernetes runtime and is compatible with all the tooling in the Kubernetes ecosystem. Second, we use Edera to provide driver isolation for hardware drivers, including those for networking, storage, and GPUs. This use of isolation protects the hypervisor and other applications from driver vulnerabilities. We find that Edera has runtime comparable to Docker with .9% slower cpu speeds, an average of 3% faster system call performance, and memory performance 0-7% faster. It achieves this with a 648 millisecond increase in startup time from Docker's 177.4 milliseconds.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
