Effectiveness of cloud-native sandboxing technologies in containing security threats

In collaboration with:
University of Amsterdam SUE Logo
Back to overview

Download research

* required

By submitting this form, you confirm that you have read and understood our privacy statement.

In collaboration with the University of Amsterdam

This research evaluates the security effectiveness and performance trade-offs of cloud-native sandboxing technologies such as gVisor, with a specific focus on their ability to mitigate threats through system call interception.

Effectiveness of cloud-native sandboxing technologies in mitigating security threats

Container technology has radically changed the way applications are deployed and managed in cloud-native environments. By packaging applications and their dependencies in lightweight, isolated containers, developers can achieve greater agility, scalability, and resource efficiency. Containers leverage the host operating system's kernel to provide an efficient runtime environment, especially when compared to the performance of full virtualization solutions. However, this shared kernel also introduces security challenges. When the operating system itself does not run within the container, OS resources remain vulnerable with incomplete virtualization, and kernel bugs can be exploited through a large attack surface (more than 300 system calls).

Security risks in container environments

Because containerized applications can communicate with the host kernel via hundreds of system calls, the attack surface increases significantly. This increases the risk of security incidents. Although containers are efficient, they are a point of concern from a security perspective because they use a shared operating system.

Secure container technologies

To mitigate these security risks, secure container technologies such as gVisor, Kata Containers, and Nabla containers have been developed. These technologies aim to strengthen the isolation and security of containers by adding extra layers of protection and isolation between containerized applications and the host operating system. gVisor specifically introduces the "system call interception" mechanism. This mechanism is used to control and monitor system call activity. By intercepting and filtering system calls, the gVisor container runtime, runsc, can provide additional isolation for containers.

Balancing security and performance

Although container runtimes strive to strike a balance between security and performance, system call interception inevitably introduces performance overhead. The interception process requires additional context switching, which can affect the total execution time of system calls. The extent of the performance impact depends on the implementation of the container runtime and the specific system calls that are intercepted.

Research questions

These considerations led to the formulation of the following main research questions, including sub-questions:

  1. How effective are cloud-native sandboxing technologies such as gVisor in mitigating security threats?
  2. What performance and security considerations play a role in sandboxing technologies?
Download
Share this:
Share this:
Table of Contents

Related research

In collaboration with the University of Amsterdam

Leveraging eBPF to Build Effective High-Interaction Honeypots

Nowadays, people and businesses make extensive use of interconnected information systems (the Internet). However, this is not without risk, as a large proportion of individuals and organizations are affected by cyberattacks every year.
Expertise: Cloud Security
Read more
In collaboration with the University of Amsterdam

Mitigating DDoS attacks on virtualized environments using eBPF and XDP

The research aims to answer the question of whether eBPF and XDP can be applied to virtualized environments to provide more performance to repel DDoS attacks.
Expertise: Cloud Security
Read more
In collaboration with the University of Amsterdam

Low-latency Implementation of the GIFT Cipher on RISC-V Architectures

Conventional cryptographic algorithms, such as AES-128, have successfully met most security and privacy requirements in modern applications.
Expertise: Cloud Security
Read more
Privacy overview
This website uses cookies. We use cookies to ensure that our website and services function properly, to gain insight into the use of our website, and to improve our products and marketing. For more information, please read our privacy and cookie policy.