Characterizing and optimizing Kernel resource isolation for containers

Kun Wang, Song Wu, Kun Suo, Yijie Liu, Hang Huang, Zhuo Huang, Hai Jin

Abstract: Highlights•We analyze the isolation problems of kernel resources and reveal their root causes.•We provide a general design to enhance isolation by limiting usage of system calls.•We use Pareto to identify containers and supply–demand model to manage resources.•The design effectively enhances kernel resource isolation with negligible overhead.