Containerization and Sandboxing Concepts

A secure environment that isolates untrusted code or applications from the host system to prevent harm.

The process of limiting a program's access to system resources, like files or network access.

Ensuring that even if the program behaves maliciously, it cannot harm the host system.

A lightweight and portable package that includes an application and all its dependencies, making it easy to deploy and run.

The ability to run a container on any system that has the required runtime environment.

Containers ensure that applications behave consistently across different environments, from development to production.

Containers share the host OS kernel, making them more efficient than virtual machines.

A software that provides the runtime environment for containers, allowing them to run on different systems.

A mechanism in the Linux kernel that allows administrators to group processes and control their resource usage.

Allows the operating system to limit and allocate resources like CPU, memory, I/O, and network bandwidth among different groups of processes.

cgroups enforce limits on resource usage by specific groups of processes, preventing them from monopolizing system resources.

Allows administrators to assign weights to different groups, proportionally distributing resources based on their priority.

A mechanism to isolate global resources (e.g., file systems, network interfaces) for processes and keep them separate.

cgroups complement Namespaces by managing the resources available to the isolated processes within those namespaces.

A type of cgroup controller that controls how CPU time is allocated to different processes or groups of processes.

A type of cgroup controller that restricts the CPU cores a group of processes can run on, improving performance for specific workloads.

The operating system running on the machine where containers are deployed.

A virtualization technology that isolates applications in containers, providing consistent environments across different machines.

A technology that allows applications to run in isolated environments, sharing the same kernel of the host operating system.

A Linux kernel feature that isolates resources like processes, filesystems, and networks, creating distinct environments for containers.

A Linux kernel feature used for resource management, allowing containers to be assigned specific memory, CPU time, and other resources.

An earlier containerization technology that Docker originally used. It provides basic containerization features without the extra tooling of Docker.

A process that involves packaging an application with all its dependencies into a container, making it portable and deployable on any machine.

A technology that creates a secure, isolated environment to run untrusted code. It restricts the program's access to system resources, limiting its potential impact.

Tools like Docker, Snap, Flatpak, and AppImage primarily focus on packaging and distributing applications, not on strict security isolation.

Sandboxing requires careful control of permissions and resources, making it complex to implement correctly. Even small errors can lead to security vulnerabilities.

Using containerization without proper sandboxing exposes the host system to security threats. A compromised container could potentially harm the entire system.

While both sandboxing and containerization are valuable, they serve different purposes. Effective sandboxing provides an essential layer of security when using containerization for applications.

Containerization tools do not inherently offer the same level of security as sandboxing. They primarily focus on portability and reproducibility.

Misconfigured containers may leak sensitive information or access resources they are not supposed to. This emphasizes the importance of security measures beyond containerization.

A type of LXC container where the container's root user is mapped to the host's root user, making it vulnerable to container escape attacks.

A type of LXC container where the container's root user is mapped to a non-root user on the host, limiting the impact of a compromise.

A kernel feature that allows containers to run as unprivileged processes by mapping container users, including root, to less-privileged users on the host.

The set of components that must be trusted to enforce security policies, including the kernel and drivers.

A hardware vulnerability in CPUs that allows an attacker to read protected memory locations, potentially compromising sensitive data like kernel memory.

The process of exploiting out-of-order execution in CPUs to access protected memory locations.

A specific address in memory that holds sensitive information, such as kernel data.

The goal of exploiting a vulnerability like Meltdown to gain unauthorized access to protected memory.

KPTI separates user and kernel memory by using different page tables for each mode of access. This prevents user processes from accessing or speculating about kernel memory, improving security.

When switching between user and kernel mode (e.g., system calls), the CPU needs to switch between page tables. This involves flushing the TLB, which introduces a performance overhead.

In some cases, KPTI can significantly impact performance as it requires constant context switching between page tables. This was noticeable in Windows 7 with font rendering, which involved frequent interactions with the kernel.

Emulation is a technique that allows software designed for one system (the guest) to run on a completely different system (the host) by simulating the guest's hardware and software environment.

Emulation comes with a considerable performance overhead because the host system has to translate the instructions of the emulated system into its own instructions. This requires extra processing and resources.

Emulation is like running software while wearing a translator that constantly needs to interpret things. It requires extra work for the CPU and therefore slows down the process.

Future CPUs are being designed to address security vulnerabilities at the hardware level, reducing the need for software mitigations like KPTI. This aims to improve performance by minimizing context switching.

KPTI uses separate page tables to improve security, but this leads to performance overhead due to page table switching. Future CPUs aim to address these challenges at the hardware level.