Security of OS-level virtualization technologies

Abstract

📜 Abstract

The need for flexible, low-overhead virtualization is evident on many fronts ranging from high-density cloud servers to mobile devices. During the past decade OS-level virtualization has emerged as a new, efficient approach for virtualization, with implementations in multiple different Unix-based systems. Despite its popularity, there has been no systematic study of OS-level virtualization from the point of view of security. In this report, we conduct a comparative study of several OS-level virtualization systems, discuss their security and identify some gaps in current solutions.

Description

✨ Summary

The paper presents a comparative security analysis of OS-level virtualization systems, in which multiple isolated user-space environments share a host operating-system kernel. It develops a generic system model covering host user space, the shared kernel, and application or system containers. The analysis considers both container-to-container isolation and isolation between containers and the host.

The authors define an attacker who controls one or more containers and may attempt to compromise other containers, cause denial of service, or obtain unauthorized privileges. From this model, they derive six security requirements:

process separation;
filesystem isolation;
device isolation;
inter-process communication isolation;
network isolation; and
resource management.

The study compares FreeBSD Jails, Linux-VServer, Solaris Zones, OpenVZ, Linux Containers, and Cells/Cellrox. It explains two broad implementation strategies: attaching a single container structure to processes, and composing containers from separate namespaces. The latter approach, used prominently in Linux, provides greater flexibility and supports incremental adoption, but introduces additional implementation complexity.

For Linux, the paper analyzes process, user, mount, IPC, and network namespaces, together with pivot-root-based filesystem confinement, virtual Ethernet, MACVLAN, device-control mechanisms, resource limits, and control groups. It emphasizes that individual mechanisms do not automatically provide complete security. For example, mount namespaces alone do not guarantee filesystem isolation, because containers may inherit host-visible mounts; device drivers are generally not namespace-aware; and privileged users inside containers must be carefully constrained through user namespaces and capabilities.

The paper identifies several open problems in the Linux container security model as it existed in 2014: container-aware mandatory access control, incomplete isolation of certain IPC mechanisms, safe access to physical devices, namespace-specific random-number generation, secure device hotplugging, and incomplete consolidation of resource controls into control groups. Its central conclusion is that Linux had largely caught up with earlier container systems in core isolation features, but still required additional mechanisms for strong security guarantees.

The paper became a cited reference in container-security research and practice. Aalto University’s publication record reports 43 Scopus citations for the conference publication. (research.aalto.fi) It is cited by NISTIR 8176, Security Assurance for Linux Containers, as a source in its discussion of Linux container security assurance. (govinfo.gov) A later doctoral thesis explicitly identifies the paper’s system and attacker models, security requirements, comparative survey, and analysis of Linux namespace shortcomings as research contributions. (aaltodoc.aalto.fi) These references indicate that the paper’s principal impact was to provide a structured vocabulary and threat model for evaluating container isolation, rather than to introduce a new container implementation.