容器系统隔离性机制研究

Compared to the traditional hardware virtualization technology, container has the advantages of small overhead, higher efficiency, etc., which makes it widely adopted in resource management, system maintenance and software deployment of cloud platform. Container not only has become the focus of cloud computing, but also has the potential to change the software ecosystem. Compared with the traditional hardware virtualization technology, the lack of isolation capability is the key limitation of containers, along with the increasing deployment density of containers in data centers. Container isolation problem has become increasingly significant and is the major bottleneck restricting the development and application of container technology. This project, starting from the core mechanism of operating system virtualization, provides a systematic and in-depth study on the problem and the essence of container isolation. It shows a comprehensive analysis of the complex factors involved in container isolation problem, combined with the technology development trend of computer architecture. This project puts forward a new system model and a set of isolation mechanisms targeting container isolation problem, which will guarantee high isolation capability among containers and solve the bottleneck of containerization in data centers.

相比于传统硬件虚拟化技术，容器技术具有开销小、效率高等优点，因而广泛应用于云计算平台的资源管理、系统运维和软件部署，不仅成为云计算领域的业界热点，而且具有改变软件生态的潜力。隔离性不足是容器相对传统虚拟化技术而言最大的局限性，随着数据中心容器部署密度的不断提高以及所承载应用的复杂多样，容器隔离性问题日益凸显，已成为制约容器技术发展和应用的主要瓶颈。本项目从操作系统虚拟化的核心机理出发，系统深入地研究了容器隔离性问题及其本质原因，全面综合地分析了容器隔离性问题涉及的复杂因素，并结合体系结构领域的技术发展趋势，提出了一套针对容器隔离性问题的新型系统架构和隔离方法，以保障容器运行环境的高效隔离能力，解决数据中心容器化过程中的关键瓶颈问题。

相比于传统虚拟化技术，现有容器技术具有开销小、效率高等优点，但是也存在局限性，其中容器隔离性不足的问题最为突出，成为制约容器发展和应用的主要技术瓶颈。针对云计算环境下容器隔离性问题，以解决操作系统虚拟化环境下建立层次化隔离模型面临的关键科学问题为目标，分别设计了容器系统资源视图隔离机制、容器系统内核软资源隔离机制和软硬协同的容器隔离机制。本课题一系列有影响力的成果，发表/录用学术论文29篇（其中CCF A/B类20篇），授权/申请发明专利14项（其中美国专利7项），研究成果入选2021年世界互联网领先科技成果，并在阿里云等行业领军企业获得大规模应用。因为在云计算领域的突出贡献，项目负责人作为第二完成人获得2020年国家自然科学二等奖，并于2021年入选国家“万人计划”科技创新领军人才。本课题研究成果为云计算环境下容器系统隔离机制优化奠定了理论和实践基础。