Building high efficient storage infrastructure for secure container on top of SPDK
summary
Claim: SPDK vhost-user lets Kata Containers get direct block devices with over 2x IOPS using one CPU core versus host kernel stacks. Implementation uses SPDK vhost-user exported bdevs, creates fake device nodes to satisfy OCI device plumbing, ships an SPDK docker volume plugin, and is integrated into containerd with demo code available. It works as a PoC but lacks file-backed volumes, ephemeral emptydir support, broader validation, and Kubernetes readiness.
AI-written summary · about
chapters (7)
- 0:00Intro
- 0:52Container Storage Infrastructure
- 2:18Secure Container Storage
- 4:39SPDK Vhost-user for Secure Container
- 12:22Docker Volume from SPDK
- 14:30Images & Rootfs from SPDK
- 17:20Progress & Limitation & Expectation
related talks
39mMore Than Secure: Containerd + KataContainers as Kubernetes Runtime
37mSPDK Based User Space NVMe Over TCP Transport Solution
25mSecuring Untrusted Workloads with Kata Containers on Kubernetes - David Angot & Alex Price
35mKata Containers: Getting Involved with the Kata Community - Anne Bertucio & Samuel Ortiz
06m⚡ Lightning Talk: Kata Confidential Containers Meet Persistent Storage: Overcoming CSI Driver Challenges
36mKata Containers: Hypervisor-Based Container Runtime
06mKeynote: Introducing Kata Containers
32mLotsa security - confining the extra security layer