Abstract
Container virtualization technologies, like Docker, are becoming increasingly popular. Containers provide exceptional developer experience because containers offer lightweight isolation and ease of software distribution. Containers also solve a fundamental code portability problem.
In contrast, container virtualization is basically insecure when compared to virtualization based on hypervisors. Virtual machines are also better integrated with the rest of the cloud ecosystem. Sum it all, virtual machines are more suitable for production environments. However, virtual machines impose a non-negligible memory footprint and suffer longer boot times, which is impractical for local development. So far, there is no deployment infrastructure that allows both the developer experience of containers and the maturity and isolation capabilities of virtual machines.
We solve this problem in this paper by introducing i2kit, an orchestration tool that enjoys the best of both worlds: (1) the development workflow is untouched, containers can be used as usual; (2) at time of deployment, containers are transformed into virtual machines, keeping code portability, but providing better security and better integration with other cloud services. The tool i2kit creates virtual machines using Linuxkit. Linuxkit alleviates the drawback in size that using virtual machines would otherwise entail because the footprint of our Linuxkit distributions is only about 60 MB. The attack surface of the application is reduced since Linuxkit only installs the minimum set of OS dependencies to run containers. Finally, we report an empirical study using i2kit that allows us to conclude that i2kit is a promising technology for VM deployment of applications developed using containers.
This research has been partially supported by: the EU H2020 project Elastest (num. 731535), by the Spanish MINECO Project “RISCO (TIN2015-71819-P)” and by the EU ICT COST Action IC1402 ARVI (Runtime Verification beyond Monitoring).
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Notes
- 1.
In this paper, we refer to containers or pods indistinctly. A pod is a group of strongly related containers that get deployed as a unit.
- 2.
i2kit is available at www.github.com/pchico83/i2kit.
- 3.
We are also exploring how to support alternative technologies to Linuxkit.
References
Merkel, D.: Docker: lightweight Linux containers for consistent development and deployment. Linux J. 2014(239) (2014)
Wang, C.: LXC and Docker explained. http://www.infoworld.com/article/3072929/linux/containers-101-linux-containers-and-docker-explained.html
Clark, J.: EVERYTHING at Google runs in a container. http://www.theregister.co.uk/2014/05/23/google_containerization_two_billion/
Lewis, J., Fowler, M.: Microservices: a definition of this new architectural term. http://martinfowler.com/articles/microservices.html
Thönes, J.: Microservices. IEEE Softw. 32(1), 113–116 (2015)
Burns, B., Grant, B., Oppenheimer, D., Brewer, E., Wilkes, J.: Borg, omega, and kubernetes. Commun. ACM 59(5), 50–57 (2016)
Docker Swarm. https://github.com/docker/swarm
Hindman, B., et al. : Mesos: a platform for fine-grained resource sharing in the data center. In: Proceedings of NSDI 2011, pp. 295–308. USENIX Association (2011)
Moiron, J.: IsK8s Too Complicated? http://jmoiron.net/blog/is-k8s-too-complicated/
Mouat, A.: Five security concers when using Docker. https://www.oreilly.com/ideas/five-security-concerns-when-using-docker
Linux Kernel Security Vulnerabilities. https://www.cvedetails.com/vulnerability-list.php
Habib, I.: Virtualization with KVM. Linux J. 2008(166) (2008). http://dl.acm.org/citation.cfm?id=1344209.1344217
Mishchenko, D.: VMware ESXi: Planning, Implementation, and Security, 1st edn. Course Technology Press, Boston (2010)
Velte, A., Velte, T.: Microsoft Virtualization with Hyper-V, 1st edn. McGraw-Hill, Inc., New York (2010)
LinuxKit. https://github.com/linuxkit/linuxkit
Fowler, C.: Trash Your Servers and Burn Your Code: Immutable Infrastructure and Disposable Components. http://chadfowler.com/2013/06/23/immutable-deployments.html
Verma, A., Pedrosa, L., Korupolu, M.R., Oppenheimer, D., Tune, E., Wilkes, J.: Large-scale cluster management at Google with Borg. In: Proceedings of EuroSys 2015. ACM (2015)
Schwarzkopf, M., Konwinski, A., Abd-El-Malek, M., Wilkes, J.: Omega: flexible, scalable schedulers for large compute clusters. In: Proceedings of EuroSys 2013, pp. 351–364. ACM (2013)
Auto Scalability Groups. https://aws.amazon.com/autoscaling/
Elastic Load Balancing. https://aws.amazon.com/elasticloadbalancing/
Cloud Formation. https://aws.amazon.com/cloudformation/
Building Large Kubernetes Clusters. https://kubernetes.io/docs/admin/cluster-large/
Delimitrou, C., Kozyrakis, C.: Quasar: resource-efficient and QoS-aware cluster management. SIGARCH Comput. Archit. News 42(1), 127–144 (2014)
Mars, J., Tang, L., Hundt, R., Skadron, K., Souffa, M.L.: Bubble-up: increasing utilization in modern warehouse scale computers via sensible co-locations. In: Proceedings of MICRO 2011. ACM (2011)
Kata Containers. https://katacontainers.io
Ernst, E.: Kata containers doesnt replace kubernetes (2018). https://katacontainers.io/posts/why-kata-containers-doesnt-replace-kubernetes/
Manco, F., et al.: My VM is lighter (and safer) than your container. In: Proceedings of SOSP 2017, pp. 218–233. ACM (2017)
Madhavapeddy, A., Scott, D.J.: Unikernels: rise of the virtual library operating system. Queue 11(11), 30:30–30:44 (2013)
Serverless Architectures. https://martinfowler.com/articles/serverless.html
Ongaro, D., Ousterhout, J.: In search of an understandable consensus algorithm. In: Proceedings of USENIX ATC 2014. USENIX Association, pp. 305–320 (2014)
AWS Fargate. https://aws.amazon.com/fargate/
Borello, G.: System and application monitoring and troubleshooting with Sysdig. USENIX Association, Washington, D.C. (2015)
Author information
Authors and Affiliations
Corresponding authors
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2018 Springer Nature Switzerland AG
About this paper
Cite this paper
de Guzmán, P.C., Gorostiaga, F., Sánchez, C. (2018). \(\textit{i2kit}\): A Deployment Tool with the Simplicity of Containers and the Security of Virtual Machines. In: Hacid, H., Cellary, W., Wang, H., Paik, HY., Zhou, R. (eds) Web Information Systems Engineering – WISE 2018. WISE 2018. Lecture Notes in Computer Science(), vol 11233. Springer, Cham. https://doi.org/10.1007/978-3-030-02922-7_6
Download citation
DOI: https://doi.org/10.1007/978-3-030-02922-7_6
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-030-02921-0
Online ISBN: 978-3-030-02922-7
eBook Packages: Computer ScienceComputer Science (R0)