LETTER Understanding File System Operations of a Secure Container Runtime Using System Call Tracing Technique

초록

This letter presents a technique that observes system call mapping behavior of the proxy kernel layer of secure container runtimes. We applied it to file system operations of a secure container runtime, gVisor. We found that gVisor's operations can become more expensive than the native by 48x more syscalls for open, and 6x for read and write.

키워드