Operating System Virtualization Research Articles

A Systematic Literature Review on Maintenance of Software Containers

Nowadays, cloud computing is gaining tremendous attention to deliver information via the internet. Virtualization plays a major role in cloud computing as it deploys multiple virtual machines on the same physical machine and thus results in improving resource utilization. Hypervisor-based virtualization and containerization are two commonly used approaches in operating system virtualization. In this article, we provide a systematic literature review on various phases in maintenance of containers including container image detection, container scheduling, container security measures, and performance evaluation of containers. We have selected 145 primary studies out of which 24% of studies are related to container performance evaluation, 42% of studies are related to container scheduling techniques, 22% of studies are related to container security measures, and 12% of studies are related to container image detection process. A few studies are related to container image detection process and evaluation of container security measures. Resource utilization is the most considered performance objective in almost all container scheduling techniques. We conclude that there is a need to introduce new tagging approaches, smell detection approaches, and also new approaches to detect and resolve threat issues in containers so that we can maintain the security of containers.

An Overview of Virtualization and Cloud Computing

Abstract: Virtualization is a technology that creates an abstract environment for underlying resources, simplifying their use and supporting replication It plays a key role in cloud computing by allowing virtual images of storage devices, servers, or network resources to be used on multiple machines. Virtualization can be implemented using a proposed model and virtual architecture. It offers greater flexibility and demand-based services while reducing the expense of accessing clients' data. Cloud computing represents a movement towards intensive resource sharing and utilization. It delivers different types of services via the internet and provides application virtualization by abstracting the application layer from the operating system Virtualization in cloud computing offers several benefits, including flexibility, data protection, security against attacks, cost-effectiveness, automatic backup across multiple devices, and reduced expenses, resiliency, high availability, increased efficiency, and environmentally friendly IT.

ContainerGuard: A Real-Time Attack Detection System in Container-Based Big Data Platform

As a lightweight, flexible, and high-performance operating system virtualization, containers are used to speed up the big data platform. However, due to the imperfection of the resource isolation mechanism and the property of shared kernel, the meltdown and spectre attacks can lead to information leakage of kernel space and coresident containers. In this article, a noise-resilient and real-time detection system, named ContainerGuard, is proposed to detect meltdown and spectre attacks in the container-based big data platform. ContainerGuard uses a nonintrusive manner to collect lifecycle multivariate time-series performance event data of processes in containers and then uses ensemble of variational autoencoders as generative neural networks to learn the robust representations of normal patterns. Therefore, ContainerGuard meets the urgent need for information protection in the container-based big data platform. Our evaluations using real-world datasets show that ContainerGuard achieves excellent detection performance and only introduces about 4.5% of running performance overhead to the platform.

Research Situation and Prospects of Operating System Virtualization

Research Situation and Prospects of Operating System Virtualization

Continuous Integration in Wireless Technology Development

Network testing plays an important role in the iterative process of developing new communication protocols and algorithms. However, test environments have to keep up with the evolution of technology and require continuous update and redesign. In this paper, we propose COINS, a framework that can be used by wireless technology developers to enable continuous integration (CI) practices in their testbed infrastructure. As a proof-of-concept, we provide a reference architecture and implementation of COINS for controlled testing of multi-technology 5G Machine Type Communication (MTC) networks. The implementation upgrades an existing wireless experimentation testbed with new software and hardware functionalities. It blends web service technology and operating system virtualization technologies with emerging Internet of Things technologies enabling CI for wireless networks. Moreover, we also extend an existing qualitative methodology for comparing similar frameworks and identify and discuss open challenges for wider use of CI practices in wireless technology development.

Leveraging deployment models on low-resource devices for cloud services in community networks

Community networks are crowd-sourced IP networks that evolved into regional-scale computing platforms. This has led to adapting the cloud computing model for services that can operate and use computing resources inside a community network. The network and computing infrastructure is contributed by individuals, companies, organizations and maintained by its members. Community cloud devices are often low-capacity computing devices, such as home gateways or cabinet servers, with limited capabilities. These devices are used to install and operate specific personal or community services, but can be turned into multi-purpose execution environments applying machine or operating system (container) virtualization. However that requires addressing the problems of resource sharing in low-capacity devices, related to predictable performance and isolation. Our comparative analysis with the current infrastructure in community networks gives evidence about how devices can concurrently run multiple services, the trade offs between the number and resource requirements of services and the degradation of quality that services may suffer.

Smart Brix—a continuous evolution framework for container application deployments

Container-based application deployments have received significant attention in recent years. Operating system virtualization based on containers as a mechanism to deploy and manage complex, large-scale software systems has become a popular mechanism for application deployment and operation. Packaging application components into self-contained artifacts has brought substantial flexibility to developers and operation teams alike. However, this flexibility comes at a price. Pracitioners need to respect numerous constraints ranging from security and compliance requirements, to specific regulatory conditions. Fulfilling these requirements is especially challenging in specialized domains with large numbers of stakeholders. Moreover, the rapidly growing number of container images to be managed due to the introduction of new or updated applications and respective components, leads to significant challenges for container management and adaptation. In this paper, we introduce Smart Brix, a framework for continuous evolution of container application deployments that tackles these challenges. Smart Brix integrates and unifies concepts of continuous integration, runtime monitoring, and operational analytics. Furthermore, it allows practitioners to define generic analytics and compensation pipelines composed of self-assembling processing components to autonomously validate and verify containers to be deployed. We illustrate the feasibility of our approach by evaluating our framework using a case study from the smart city domain. We show that Smart Brix is horizontally scalable and runtime of the implemented analysis and compensation pipelines scales linearly with the number of container application packages.

계층적 실시간 시스템 스케줄링 검증을 위한 정형적 프레임워크

The use of Operating System(OS) virtualization is increasing as it provides many useful features such as efficient use of hardware(HW), easy system migration, and isolation between virtual spaces which prevents errors effecting each other. Recent development in HW has made it possible to use OS virtualization in embedded systems. However, implementing OS virtualization means that a multiple number of schedulers are layered in a system, rendering it difficult to analyze the schedulability of the system and errors are easily produced. Errors in safety critical embedded systems can cause serious damage to life and property; thus, the hierarchical schedulability must be verified. In this paper, we propose a framework which supports formal modeling and verification of hierarchical scheduling systems with UPPAAL.

An introduction to Docker for reproducible research

As computational work becomes more and more integral to many aspects of scientific research, computational reproducibility has become an issue of increasing importance to computer systems researchers and domain scientists alike. Though computational reproducibility seems more straight forward than replicating physical experiments, the complex and rapidly changing nature of computer environments makes being able to reproduce and extend such work a serious challenge. In this paper, I explore common reasons that code developed for one research project cannot be successfully executed or extended by subsequent researchers. I review current approaches to these issues, including virtual machines and workflow systems, and their limitations. I then examine how the popular emerging technology Docker combines several areas from systems research - such as operating system virtualization, cross-platform portability, modular re-usable elements, versioning, and a 'DevOps' philosophy, to address these challenges. I illustrate this with several examples of Docker use with a focus on the R statistical environment.

Operating Systems: Basic Concepts and Challenges against Virtualization

In this paper, we discuss about basic operating systems, get an overview of the internal processes associated with an operating system and understand its connection with the kernel and the hardware. We then move on to Virtualization by introducing Vagrant, an operating system virtualization software that allows you to run virtual machines on your system and configure them the way you want to suit your needs, and discuss about virtualization on cloud.

IBM Secure Enterprise Desktop

Using software-only approaches makes it is practically impossible to completely secure software applications, as well as corporate information, against determined cyber-criminals. Therefore, in an era where any general-purpose operating system (OS) with end-user access can be hacked, we propose using dedicated security hardware to ensure that only authorized people obtain access to sensitive information. The fundamental principle involves booting the end-user computer from such a trusted mobile device without trusting any software installed on the computer. The device establishes a secure connection to the back-end infrastructure to provide access to the user's OS, e.g., through a remote terminal access or provisioned on the local computer. The solution is very simple to operate, as many corporate employees are not necessarily IT (information technology) savvy. In this paper, we discuss the combination of our dedicated tamper-resistant security boot-token operating user credentials with known defense mechanisms, such as OS virtualization, trusted boot, establishment of client-side and server-side authenticated secure channels to trustworthy back-ends, and client-side storage encryption. This novel combination forms an easy-to-use and highly mobile security solution that addresses security challenges of the BYOD (bring-your-own-device) approach. As a proof point for the latter claims, we report on initial real-world usability tests.

Unikernels: Rise of the Virtual Library Operating System

Cloud computing has been pioneering the business of renting computing resources in large data centers to multiple (and possibly competing) tenants. The basic enabling technology for the cloud is operating-system virtualization such as Xen1 or VMWare, which allows customers to multiplex VMs (virtual machines) on a shared cluster of physical machines. Each VM presents as a self-contained computer, booting a standard operating-system kernel and running unmodified applications just as if it were executing on a physical machine.

Design and verification of a lightweight reliable virtual machine monitor for a many-core architecture

Virtual machine monitors (VMMs) play a central role in cloud computing. Their reliability and availability are critical for cloud computing. Virtualization and device emulation make the VMM code base large and the interface between OS and VMM complex. This results in a code base that is very hard to verify the security of the VMM. For example, a misuse of a VMM hyper-call by a malicious guest OS can corrupt the whole VMM. The complexity of the VMM also makes it hard to formally verify the correctness of the system's behavior. In this paper a new VMM, operating system virtualization (OSV), is proposed. The multiprocessor boot interface and memory configuration interface are virtualized in OSV at boot time in the Linux kernel. After booting, only inter-processor interrupt operations are intercepted by OSV, which makes the interface between OSV and OS simple. The interface is verified using formal model checking, which ensures a malicious OS cannot attack OSV through the interface. Currently, OSV is implemented based on the AMD Opteron multi-core server architecture. Evaluation results show that Linux running on OSV has a similar performance to native Linux. OSV has a performance improvement of 4%---13% over Xen.

The Design, Implementation, and Evaluation of Cells

Smartphones are increasingly ubiquitous, and many users carry multiple phones to accommodate work, personal, and geographic mobility needs. We present Cells , a virtualization architecture for enabling multiple virtual smartphones to run simultaneously on the same physical cellphone in an isolated, secure manner. Cells introduces a usage model of having one foreground virtual phone and multiple background virtual phones. This model enables a new device namespace mechanism and novel device proxies that integrate with lightweight operating system virtualization to multiplex phone hardware across multiple virtual phones while providing native hardware device performance. Cells virtual phone features include fully accelerated 3D graphics, complete power management features, and full telephony functionality with separately assignable telephone numbers and caller ID support. We have implemented a prototype of Cells that supports multiple Android virtual phones on the same phone. Our performance results demonstrate that Cells imposes only modest runtime and memory overhead, works seamlessly across multiple hardware devices including Google Nexus 1 and Nexus S phones, and transparently runs Android applications at native speed without any modifications.

Proactive process-level live migration and back migration in HPC environments

As the number of nodes in high-performance computing environments keeps increasing, faults are becoming common place. Reactive fault tolerance (FT) often does not scale due to massive I/O requirements and relies on manual job resubmission. This work complements reactive with proactive FT at the process level. Through health monitoring, a subset of node failures can be anticipated when one’s health deteriorates. A novel process-level live migration mechanism supports continued execution of applications during much of process migration. This scheme is integrated into an MPI execution environment to transparently sustain health-inflicted node failures, which eradicates the need to restart and requeue MPI jobs. Experiments indicate that 1–6.5 s of prior warning are required to successfully trigger live process migration while similar operating system virtualization mechanisms require 13–24 s. This self-healing approach complements reactive FT by nearly cutting the number of checkpoints in half when 70% of the faults are handled proactively. The work also provides a novel back migration approach to eliminate load imbalance or bottlenecks caused by migrated tasks. Experiments indicate the larger the amount of outstanding execution, the higher the benefit due to back migration.

An Automated Virtualization Performance Analysis Platform

This research compares three traditional categories of virtualization to a technique known as hybrid virtualization. Each technique is evaluated in terms of both capability and performance. The traditional methods of platform virtualization such as full virtualization, paravirtualization and operating system virtualization each comes with its own set of capabilities and engineering trade-offs. Hybrid virtualization attempts to leverage the benefits of full and operating system virtualization by allowing virtual machines of each type of virtualization to run simultaneously on the same host machine. This research measures the time required for each virtualization technique to perform a workload inside virtual machines as the number of virtual machines running the workload scales. This performance data will help determine the usefulness of the hybrid technique in building a military cyber warfare training simulation environment based on virtualization. The goal is to determine which technique is capable of supporting large-scale environments required by realistic network training scenarios. The capability evaluation results indicate that hybrid virtualization successfully leverages the benefits of its two virtualization components while minimizing the trade-offs of each individual technique. The performance results indicate that the performance of each virtualization technique differs significantly relative to the workload applied. Some workloads saw no significant differences in performance between techniques. However, in the workloads that did show significant difference, the hybrid technique performed as well as or better than full virtualization or operating system virtualization alone. This leads to the conclusion that hybrid virtualization is a viable candidate as the basis for a military cyber warfare simulation and training environment.

Container-based operating system virtualization

Hypervisors, popularized by Xen and VMware, are quickly becoming commodity. They are appropriate for many usage scenarios, but there are scenarios that require system virtualization with high degrees of both isolation and efficiency . Examples include HPC clusters, the Grid, hosting centers, and PlanetLab. We present an alternative to hypervisors that is better suited to such scenarios. The approach is a synthesis of prior work on resource containers and security containers applied to general-purpose, time-shared operating systems. Examples of such container-based systems include Solaris 10, Virtuozzo for Linux, and Linux-VServer. As a representative instance of container-based systems, this paper describes the design and implementation of Linux-VServer. In addition, it contrasts the architecture of Linux-VServer with current generations of Xen, and shows how Linux-VServer provides comparable support for isolation and superior system efficiency.

V for Virtual

Operating system virtualization has been available on commodity hardware for a few years, and today attracts considerable commercial and research interest. Virtualization allows one or more virtual machines (VMs) to run on a single physical machine, and to interact via virtual devices, such as virtual hard discs or virtual network cards. To model basic virtualization operations, we propose a process calculus, V, with primitives to start and stop VMs, and to read and write data in a hierarchical store. Formalisms such as V may be useful for programming and reasoning about various applications of virtualization, such as VM-based trusted computing or VM-based computational grids.