OS-level Virtualization Research Articles

Adapt Burstable Containers to Variable CPU Resources

In the age of the cloud-native, container technology, referred as OS-level virtualization, is increasingly adopted to deploy cloud applications. Compared with virtual machines, containers are lightweight and flexible in resource management. An important quality-of-service (QoS) class in container management is burstable container, whose resource limits are higher than the actual requests allowing a container to expand whenever demands ramp up and additional resources become available. However, efficiently managing burstable containers is challenging, especially for CPU resources. On the one hand, burstable containers should maintain sufficient concurrency, in the form of threads, to utilize extendable CPU resources. On the other hand, the degree of concurrency necessary for utilizing peak CPU resources leads to suboptimal performance when a container's CPU allocation is constrained. In this paper, we recommend that the number of threads in burstable containers should always be set to the CPU limit to guarantee extensibility. However, modern operating systems (OSes) fall short of efficiently managing thread oversubscription. First, the OS CPU scheduler is inefficient for scheduling excessive threads and lacks container awareness. Second, the existing blocking synchronization supported by the OS kernel is inefficient in handling the sleep and wakeup of excessive threads. Finally, the non-blocking synchronization may waste CPUs performing busy waiting when more than one thread in the run queue. To this end, we present a user-level adaptive container scheduler and two OS mechanisms, <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">virtual blocking</i> and <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">busy-waiting detection</i> , to avoid inefficiency in managing burstable containers without requiring program code changes. Experimental results show that our approaches can keep burstable containers efficient while allowing the applications in containers to take advantage of additional CPUs. The performance gain under high system load is up to 29.7×.

Honey Potting using Containerization Technique

In this paper, we overview the latest benefits of honeypots. Few outstanding plans and their analysis is specified. The facts related to honeypots in schooling and hybrid surroundings with the Intrusion Detection System were specified. In this paper, we specify the use of the signature approach in honeypots for visitor analysis. In this, we summarize all these features. Containerization encourages a few functions to run machine kernel that is Name spaces and control organizations. These are some Linux kernel capabilities that permit separation of process and whilst these kernel functions had been addressed one after the other with the purpose to develop lightweight, OS-level virtualization, Docker changed into evolved.

VIRTUALIZATION AS A MEANS TO ENSURE THE RESILIENCE OF PEER-TO-PEER COMMUNICATION SYSTEMS

Resilience to failures and deliberate attacks is becoming an essential requirement in most point-to-point communication networks today. The present paper presents a survey of strategies to ensure resilience in peer-to-peer communication networks by means of operating systems virtualization. Virtual machines can ensure the resiliency of the peer-to-peer communication network both by their very use and by providing service isolation. For hands-on research, OpenVZ as a Linux implementation of OS-level virtualization has been used.

Performance Analysis of Virtual Machine in Cloud Architecture

Cloud computing is a technique for storing and processing data that makes use of a network of remote servers. Cloud computing is gaining popularity due to its vast storage capacity, ease of access, and diverse variety of services. When cloud computing advanced and technologies such as virtual machines appeared, virtualization entered the scene. When customers’ computing demands for storage and servers increased, however, virtual machines were unable to match those expectations due to scalability and resource allocation limits. As a consequence, containerization became a reality. Containerization is the process of packaging software code along with all of its essential components, including frameworks, libraries, and other dependencies, such that they may be separated or separated in their own container. The program operating in containers may execute reliably in any environment or infrastructure. Containers provide OS-level virtualization, which reduces the computational load on the host machine and enables programs to run much faster and more reliably. Performance analysis is very important in comparing the throughput of both VM-based and Container-based designs. To analyze it same web application is running in both the designs. CPU usage and RAM usage in both designs were compared. Results obtained are tabulated and a Proper conclusion has been given.

Thread-level resource consumption control of tenant custom code in a shared JVM for multi-tenant SaaS

Software-as-a-Service (SaaS) providers commonly support customization of their services to allow them to attract larger tenant bases. The nature of these customizations in practice ranges from anticipated configuration options to sophisticated code extensions. From a SaaS provider viewpoint, the latter category is particularly challenging as it involves executing untrusted tenant custom code in the SaaS production environment. Proper isolation of custom code in turn requires the ability to control resource consumption of each tenant.In current practice, OS-level virtualization tools such as hypervisors or containers are predominantly used for this purpose. These techniques, however, constrain the number of tenants that a single node can cost-effectively accommodate. Furthermore, additional overhead will be incurred for (un)marshaling objects and possibly a network round-trip of data when these techniques are applied.In this paper, we present a practical solution for thread-level resource consumption control of tenant-provided custom code. This solution provides control mechanism for four types of resources, namely CPU, memory, network and storage. Usage data are gathered using the Java Resource Consumption Management API (JSR-284). In case of CPU and memory, where this API is not capable of imposing limits, both the Java Runtime Environment (JRE) bytecode and tenant code are instrumented with usage control checkpoints which ensures that CPU and memory usage of tenants remain within their Service-level Agreements (SLA) limits.Our experiments show that the proposed solution outperforms containers in terms of tenant accommodation capacity and performance overhead. It is shown that 84 times more tenants can be accommodated on a single node when our solution is adopted while, at the same time, the performance overhead of the control mechanism is less than hosting the tenant code as a remote process.

Log Analyzer for Update Manager

Performing System updates is a very tricky and complicated task. You have to update new software on the same old hardware. This may introduce many errors in the system. For example a windows update on a single PC is generally prone to failures. Further updating a server is more challenging job. As a server can support many Operating systems their components, firmware’s and software’s etc, there are many possibilities that a server update may initiate many errors in the system. Thus, this paper proposes a tool that can go through all those thousands of log files generated during an update of a server and finds out where exactly the update went wrong. The paper describes about building a tool to perform log analysis from the scratch. It describes about developing parsers at the backend, building a user interface at the frontend and deploying the tool on to network. The proposed work supports building a Docker for the backend. Docker is a platform as a service product that uses OS-level virtualization to deliver software in packages called containers. The tool takes compressed log file as input. The tool analyses the structure of log file and then parses the contents of the log file according to its structure. Finally the proposed tool generates a report in JSON (JavaScript Object Notation) as well as CSV (Comma-Separated Values) format and that report consists of all the required fields to identify and classify the error that was responsible for failure during system update. This report is sent to concerned software development team to fix the defect that occurred in the update.

From virtualization security issues to cloud protection opportunities: An in-depth analysis of system virtualization models

Virtualization methods and techniques play an important role in the development of cloud infrastructures and their services. They enable the decoupling of virtualized resources from the underlying hardware, and facilitate their sharing amongst multiple users. They contribute to the building of elaborated cloud services that are based on the instantiation and composition of these resources. Different models may support such a virtualization, including virtualization based on type-I and type-II hypervisors, OS-level virtualization, and unikernel virtualization. These virtualization models pose a large variety of security issues, but also offer new opportunities for the protection of cloud services. In this article, we describe and compare these virtualization models, in order to establish a reference architecture of cloud infrastructure. We then analyze the security issues related to these models from the reference architecture, by considering related vulnerabilities and attacks. Finally, we point out different recommendations with respect to the exploitation of these models for supporting cloud protection.

Distributed deep learning platform for pedestrian detection on IT convergence environment

IT technology and traditional industries have been combined recently, resulting in IT convergence technology in various fields. Through convergence with the automobile, pedestrian detection technology, in particular, is used in the autonomous navigation control service of autonomous vehicles and also applied in various fields such as intelligent CCTV and robot recognition technology. For pedestrian detection, hierarchical classification and feature vector were used in early stage, and deep learning is under active progress. However, since deep learning for pedestrian detection is time-consuming for processing a large volume of image data, it requires a lot of computing resources, and hence building such a system is very expensive. Therefore, in this paper we shall present a distributed deep learning platform which can easily build a cluster, and execute deep learning process in the distributed cloud environment, while achieving performance improvement in various ways. Our platform provides a convenient interface for easily and efficiently executing the deep learning process in a distributed environment by providing a multilayered system architecture. Our system builds and utilizes computing power in easy and efficient way by leveraging container technique, so-called OS-level virtualization, rather than traditional hypervisor-based virtualization. In our system, we improve the whole performance by exploiting both of data and parameter parallelisms at once and reduce the synchronization overhead by exploiting asynchronous communication for parameter updates. Also, we propose an efficient resource allocation scheme for parameter servers and slaves which can improve the performance from the experiment.

Efficient operating system level virtualization techniques for cloud resources

Cloud computing is an advancing technology which provides the servcies of Infrastructure, Platform and Software. Virtualization and Computer utility are the keys of Cloud computing. The numbers of cloud users are increasing day by day. So it is the need of the hour to make resources available on demand to satisfy user requirements. The technique in which resources namely storage, processing power, memory and network or I/O are abstracted is known as Virtualization. For executing the operating systems various virtualization techniques are available. They are: Full System Virtualization and Para Virtualization. In Full Virtualization, the whole architecture of hardware is duplicated virtually. No modifications are required in Guest OS as the OS deals with the VM hypervisor directly. In Para Virtualization, modifications of OS is required to run in parallel with other OS. For the Guest OS to access the hardware, the host OS must provide a Virtual Machine Interface. OS virtualization has many advantages such as migrating applications transparently, consolidation of server, online maintenance of OS and providing security. This paper briefs both the virtualization techniques and discusses the issues in OS level virtualization.

A Lightweight OS-Level Virtualization Architecture Based on Android

All kinds of intelligent terminal equipment emerge in endlessly and grow explosively. Typical devices, such as smartphones and tablets, are becoming more and more popular, furthermore, intelligent equipment market share has more than that on PCs. And on mobile devices area, the demand for virtualization technology is gradually increasing. As an important branch of computer technology development, operating system level virtualization is becoming a hot spot of current research due to its low overhead and the advantages of lightweight. In this paper, based on the Android system on mobile devices, implement a prototype which can run multiple virtual system instances on only an Android OS by modifying the namespace mechanism in the Linux kernel to and expand into driver namespace mechanism. In addition, put forward a model called the active- inactive model guaranteeing the process if and only if in the active namespace to operate the device drivers, which was designed and implemented a new scheme of operating system level virtualization.

MultiLanes

OS-level virtualization is often used for server consolidation in data centers because of its high efficiency. However, the sharing of storage stack services among the colocated containers incurs contention on shared kernel data structures and locks within I/O stack, leading to severe performance degradation on manycore platforms incorporating fast storage technologies (e.g., SSDs based on nonvolatile memories). This article presents MultiLanes, a virtualized storage system for OS-level virtualization on manycores. MultiLanes builds an isolated I/O stack on top of a virtualized storage device for each container to eliminate contention on kernel data structures and locks between them, thus scaling them to manycores. Meanwhile, we propose a set of techniques to tune the overhead induced by storage-device virtualization to be negligible, and to scale the virtualized devices to manycores on the host, which itself scales poorly. To reduce the contention within each single container, we further propose SFS, which runs multiple file-system instances through the proposed virtualized storage devices, distributes all files under each directory among the underlying file-system instances, then stacks a unified namespace on top of them. The evaluation of our prototype system built for Linux container (LXC) on a 32-core machine with both a RAM disk and a modern flash-based SSD demonstrates that MultiLanes scales much better than Linux in micro- and macro-benchmarks, bringing significant performance improvements, and that MultiLanes with SFS can further reduce the contention within each single container.

Shuttle: Facilitating Inter-Application Interactions for OS-Level Virtualization

OS-level virtualization generates a minimal start-up and run-time overhead on the host OS and thus suits applications that require both good isolation and high efficiency. However, multiple-member applications required for forming a system may need to occasionally communicate across this isolation barrier to cooperate with each other while they are separated in different VMs to isolate intrusion or fault. Such application scenarios are often critical to enterprise-class servers, HPC clusters and intrusion/fault-tolerant systems, etc. We make the first effort to support the inter-application interactions in an OS-level virtualization system without causing a significant compromise on VM isolation. We identify all interactive operations that impact inter-application interactions, including inter-process communications, application invocations, resource name transfers, and application dependencies. We propose Shuttle, a novel approach for facilitating inter-application interactions within and across OS-level virtual machines. Our results demonstrate that Shuttle can correctly address all necessary inter-application interactions while providing good isolation capability for all sample applications on different versions of Windows OS.

Malware Clearance for Secure Commitment of OS-Level Virtual Machines

A virtual machine(VM) can be simply created upon use and disposed upon the completion of the tasks or the detection of error. The disadvantage of this approach is that if there is no malicious activity, the user has to redo all of the work in her actual workspace since there is no easy way to commit (i.e., merge) only the benign updates within the VM back to the host environment. In this work, we develop a VM commitment system called Secom to automatically eliminate malicious state changes when merging the contents of an OS-level VM to the host. Secom consists of three steps: grouping state changes into clusters, distinguishing between benign and malicious clusters, and committing benign clusters. Secom has three novel features. First, instead of relying on a huge volume of log data, it leverages OS-level information flow and malware behavior information to recognize malicious changes. As a result, the approach imposes a smaller performance overhead. Second, different from existing intrusion detection and recovery systems that detect compromised OS objects one by one, Secom classifies objects into clusters and then identifies malicious objects on a cluster by cluster basis. Third, to reduce the false-positive rate when identifying malicious clusters, it simultaneously considers two malware behaviors that are of different types and the origin of the processes that exhibit these behaviors, rather than considers a single behavior alone as done by existing malware detection methods. We have successfully implemented Secom on the feather-weight virtual machine system, a Windows-based OS-level virtualization system. Experiments show that the prototype can effectively eliminate malicious state changes while committing a VM with small performance degradation. Moreover, compared with the commercial antimalware tools, the Secom prototype has a smaller number of false negatives and thus can more thoroughly clean up malware side effects. In addition, the number of false positives of the Secom prototype is also lower than that achieved by the online behavior-based approach of the commercial tools.

Facilitating inter-application interactions for OS-level virtualization

OS-level virtualization generates a minimal start-up and run-time overhead on the host OS and thus suits applications that require both good isolation and high efficiency. However, multiple-member applications required for forming a system may need to occasionally communicate across this isolation barrier to cooperate with each other while they are separated in different VMs to isolate intrusion or fault. Such application scenarios are often critical to enterprise-class servers, HPC clusters and intrusion/fault-tolerant systems, etc. We make the first effort to support the inter-application interactions in an OS-level virtualization system without causing a significant compromise on VM isolation. We identify all interactive operations that impact inter-application interactions, including inter-process communications, application invocations, resource name transfers and application dependencies. We propose Shuttle, a novel approach for facilitating inter-application interactions within and across OS-level virtual machines. Our results demonstrate that Shuttle can correctly address all necessary inter-application interactions while providing good isolation capability to all sample applications on different versions of Windows OS.