Containers Topics of Interest Jerome Tollet CTAO - PIRL Sept 5th, 2016

Container fast communications Container placement Container Security Agenda Container fast communications Container placement Container Security Container (Reactive) Policies

Container fast communications Current status Today, containers communication rely on Linux kernel Can be a significant bottleneck for apps Very complex model including NAT (ip6 is not first class citizen) TCP is used even for “in server” communication Questions How can we bring user space networking for containers (DPDK, VPP,…) ? Can we reach 40Gbps for intercontainer communications ? Does that require applications changes ? What can be done at layer 2, layer 3, layer 4 and above Can we bypass useless and slow code for “in server” communications ?

Container placement Current status Containers are placed when launched where there is enough free resources This strategy is not always optimal in terms of security, performance or energy saving Examples Performance: two containers working together could be co-located Security: It might be interesting to physically isolate containers belonging to different entities Energy Saving: might be interesting to switch off servers and group all running containers Questions How do we migrate containers ? What is the real benefit of grouping containers (switching off some CPU) ? How do we put in place an “optimal topology”

Container Security Current status Containers are not simply light VMs, they are about application disaggregation into micro services Current security modelis very weak and looks more as an adaptation of VMs and Phy World security Topics of interest How can we better protect East-West communications at all level (2-3-4 above) How can we distribute in depth Security functions that used to be done at the Edge with minimal performance penalty ? How can we safely download signed Container Images from public repos

Container Policies Current status Tens is not hundreds of container technologies Existing policies (GBP, etc) come from Virtualization/Phy world Existing policies are very static and mainly focus on ACL kind of rules Topic of interest How can we model high level policies taking into account performance, security and energy saving ? How there model deals with incompatibilities (eg. energy vs performance) ? How do we bring reactive policies in these models (eg container 1 and 2 suddenly talking together) ? Can we extend existing languages or do we have to define new ones ?