1. Containers Topics of Interest
Jerome Tollet
CTAO - PIRL
Sept 5th, 2016

2. Container fast communications Container placement Container Security
Agenda
Container fast communications
Container placement
Container Security
Container (Reactive) Policies

3. Container fast communications
Current status
Today, containers communication rely on Linux kernel
Can be a significant bottleneck for apps
Very complex model including NAT (ip6 is not first class citizen)
TCP is used even for “in server” communication
Questions
How can we bring user space networking for containers (DPDK, VPP,…) ?
Can we reach 40Gbps for intercontainer communications ?
Does that require applications changes ?
What can be done at layer 2, layer 3, layer 4 and above
Can we bypass useless and slow code for “in server” communications ?

4. Container placement Current status
Containers are placed when launched where there is enough free resources
This strategy is not always optimal in terms of security, performance or energy saving
Examples
Performance: two containers working together could be co-located
Security: It might be interesting to physically isolate containers belonging to different entities
Energy Saving: might be interesting to switch off servers and group all running containers
Questions
How do we migrate containers ?
What is the real benefit of grouping containers (switching off some CPU) ?
How do we put in place an “optimal topology”

5. Container Security Current status
Containers are not simply light VMs, they are about application disaggregation into micro services
Current security modelis very weak and looks more as an adaptation of VMs and Phy World security
Topics of interest
How can we better protect East-West communications at all level (2-3-4 above)
How can we distribute in depth Security functions that used to be done at the Edge with minimal performance penalty ?
How can we safely download signed Container Images from public repos

6. Container Policies Current status
Tens is not hundreds of container technologies
Existing policies (GBP, etc) come from Virtualization/Phy world
Existing policies are very static and mainly focus on ACL kind of rules
Topic of interest
How can we model high level policies taking into account performance, security and energy saving ?
How there model deals with incompatibilities (eg. energy vs performance) ?
How do we bring reactive policies in these models (eg container 1 and 2 suddenly talking together) ?
Can we extend existing languages or do we have to define new ones ?