Improving Bootup Performance of Container with Overlay Images in TEE Envir...
summary
Improves container boot by replacing per-layer KMS handshakes with single-round key retrieval that returns all layer keys at once (one network round trip instead of N), downloads overlay layers in parallel, and offloads AES decryption to hardware (Intel Quick Assist Technology) via a Rust QAT wrapper and a task balancer that shifts work from CPU to accelerator. Implemented inside the CC agent and image IO path, reduces CPU decryption time and network latency during boot and is demonstrated as feasible in their prototype.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 0:37Agenda
- 3:24Background Motivation
- 7:27Background of Container
- 15:46Optimization
- 21:53Contributions
- 23:55Raster
- 28:43Conclusion
related talks
32mProtecting Sensitive Code with Encrypted Container Images on...
33mDon't Peek Into my Container!
41mPanel: A New Root Of Trust: Changing Computing With TEE
50mConfidential Containers: Why, How, and Where Are We?
27mTrust No One: Bringing Confidential Computing to Containers
48mThe Cost of Security: Measuring and Reducing Boot-Time Impact
24mSecure boot, TEEs, different OSes and more
25mFrom Cloud To AI: How Kata Containers 4.0 Reinvents the Sandbox for the Agent Era