Nabla Containers: A New Approach to Container Isolation
summary
Nabla containers lift many kernel services into user space using library-OS/unikernel techniques and a custom runnc OCI runtime, producing a special Nabla binary that runs Node.js, Python Tornado and Redis while limiting host-visible syscalls to 7 syscalls via seccomp. strace shows Node hitting 3 vs ~10 syscalls for a normal container, and deeper ftrace kernel functions counts confirm fewer kernel code paths touched. Deployed on Kubernetes the demo works; measured overhead is modest (~10%) largely from an extra network bridge and an existing buildstep still requires conversion to the Nabla binary.
AI-written summary · about
chapters (6)
- 0:00Start
- 1:41What does it mean to be isolated?
- 3:11Container Isolation Reality
- 11:06Making and running a Nabla
- 23:53ftrace measurements (lower is better)
- 27:02What's Next?
related talks
31mYour Containers Aren’t Alone: Demystifying Container Isolation
14mYour Containers Aren’t Alone: Demystifying Container Isolation
44mRootless containers
34mContainer Runtimes... on Lockdown: The Hidden Costs of Multi-tenant Workloads
14mA kernel? In a Container? Explain Yourself!
22mKata Containers: Security and Containers Without Compromise
25mOne Size Fits None: Lightweight Workload-Specialized Confidential Containers
53mProtect Containerized Applications With System Call Profiling