centric world vms in a container- · 2020. 9. 24. · 05/04/2019 vms in a container-centric world ...

05/04/2019 VMs in a container-centric world

http://penguin.linux.test:9000/bkk19-vms-in-a-container-world.html?print-pdf 1/55

VMS IN A CONTAINER-VMS IN A CONTAINER-CENTRIC WORLDCENTRIC WORLD

ALEX BENNÉEALEX BENNÉEBKK19BKK19

1



INTRODUCTIONINTRODUCTION

2 . 1



WHO AM IWHO AM I

Alex BennéeSenior Virtualisation Engineer @LinaroQEMU's TCG (emulation)/KVMIRC: stsquad/ajb-linaro

2 . 2



DOCKER HYPE?DOCKER HYPE?

2 . 3



DEVELOPER BUZZWORDSDEVELOPER BUZZWORDS

LightweightAgileDevOpsCloud

2 . 4



OTHER USE CASESOTHER USE CASES

ApplicationSandboxesAndroid-in-a-Box

2 . 5



UBIQUITOUSUBIQUITOUS

2 . 6



CONTAINER OVERVIEWCONTAINER OVERVIEW

3 . 1



WHAT IS A CONTAINERWHAT IS A CONTAINER

3 . 2



TECHNOLOGIESTECHNOLOGIES

3 . 3



NAMESPACESNAMESPACES

3 . 4



CONTROL GROUPSCONTROL GROUPS

limitsaccountingprioritycontrol

3 . 5



SANDBOXINGSANDBOXING

seccompnet�lterbpf

3 . 6



FILE-SYSTEMSFILE-SYSTEMS

3 . 7



RUNTIMESRUNTIMES

LXCDockersystemd-nspawn

3 . 8



BUT….BUT….

4 . 1



"container with an attacker-controlled image"…

"overwrite the host runc binary (and consequently obtain host rootaccess)"

CVE-2019-5736CVE-2019-5736

4 . 2

https://nvd.nist.gov/vuln/detail/CVE-2019-5736



DETAILSDETAILS

Attacker Image (i.e. from a hub)with root privilegesmodi�es guest binary (/bin/target)#!/proc/self/exe

Host launches a containerattempts to run /bin/target

actually runs itselfattacker grabs /proc/TARGETPID/exekeeps writing until PROFIT!

4 . 3



ENTER VMSENTER VMS

5 . 1



WHAT IS A VIRTUAL MACHINEWHAT IS A VIRTUAL MACHINE

5 . 2



ISOLATIONISOLATION

5 . 3



BEST OF BOTH WORLDSBEST OF BOTH WORLDS

6 . 1



MORE LAYERSMORE LAYERS

6 . 2



ABSTRACTION == COSTABSTRACTION == COST

6 . 3



DOCKER 10.9 SECONDSDOCKER 10.9 SECONDS

6 . 4



KVM 12.0 SECONDSKVM 12.0 SECONDS

6 . 5



KVM HOST VIEWKVM HOST VIEW

6 . 6



MITIGATIONMITIGATION

7 . 1



VIRTUAL HWVIRTUAL HW

MinimalParavirtualizedHot-Pluggable

7 . 2



GUEST SETUPGUEST SETUP

Minimal KernelLightweightUserspaceDirect Boot/uBios

7 . 3



HOST/GUEST COMMUNICATIONHOST/GUEST COMMUNICATION

7 . 4



VIRTIO-VSOCKVIRTIO-VSOCK

bi-directional socketzero con�gurationmore ef�cient thannetwork

7 . 5



VIRTIO-FSVIRTIO-FS

POSIX APICo-locatedhost/guestShared Memory

7 . 6



EXAMPLE: CHROMOS CROSTINIEXAMPLE: CHROMOS CROSTINI

8 . 1



CHROME OSCHROME OS

Trusted BootpathLinux KernelMinimal GentooUserspaceChrome Browser

8 . 2



ARCHITECTUREARCHITECTURE

8 . 3



CROSVMCROSVM

8 . 4



EXAMPLE: KATA CONTAINERSEXAMPLE: KATA CONTAINERS

9 . 1



KATA CONTAINERSKATA CONTAINERS

Lightweight VMsDockerIntegration

9 . 2



ARCHITECTUREARCHITECTURE

9 . 3



FEATURESFEATURES

Optimised Kernelrootfs(initrd/nvdimm)

NEMU (NoEmu QEMU)

9 . 4



EXAMPLE: GVISOREXAMPLE: GVISOR

10 . 1



REMAINING WORKREMAINING WORK

11 . 1



DE-BLOAT QEMUDE-BLOAT QEMU

Reduce size & start-up–disable-tcgKCon�g languageWork in progress

11 . 2



X86 KVM FEATURE PARITYX86 KVM FEATURE PARITY

HotplugSupport

11 . 3



SUMMARYSUMMARY

12 . 1



CONTAINERSCONTAINERS

PopularToolingPortability

12 . 2



VIRTUAL MACHINESVIRTUAL MACHINES

More de�ned isolationPerformance Trade-offsCan be contained

12 . 3



COMBINATIONCOMBINATION

Best of BothWorldsDefence in Depth

12 . 4



QUESTIONS?QUESTIONS?

13 . 1



REFERENCESREFERENCESKata Containers: Advanced Features of QEMU forBetter Container Isolation by Eric ErnstCrostini: A Linux Desktop on ChromeOS

14 . 1

https://www.youtube.com/watch?v=Cgnb7jMZfPs

https://fosdem.org/2019/schedule/event/crostini/



EXTRA SLIDESEXTRA SLIDES

15 . 1



"The Floppy Disk Controller (FDC) in QEMU"…

"allows local guest users to cause a denial of service…or possiblyexecute arbitrary code"

CVS-2015-3456 (VENOM)CVS-2015-3456 (VENOM)

15 . 2

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3456



CONTAINER PATTERNSCONTAINER PATTERNS

Service OrientatedArchitectureStateless DesignComposability

15 . 3



REASONS FOR POPULARITYREASONS FOR POPULARITY

ToolingPortabilityOrchestration

15 . 4

centric world vms in a container- · 2020. 9. 24. · 05/04/2019 vms in a container-centric world ...

Documents