gVisor on Arm64技術(shù)架構(gòu)概述

1、gVisor on Arm64技術(shù)架構(gòu)概述技術(shù)創(chuàng)新，變革未來(lái)AgendaWhats gVisorArchitectureDetailsWhat we have doneNext steps DemoWhats gVisorSecure ContainerA user-space kernel, written in GoOCI-compatibleA container runtimeIsolation platformPtraceKvmArchitecture - gVisorIO OperationsAppSentryGoferHost KernelSyscall Interception

2、SeccompNamespaceIntercept application system calls and acts as the guest kernel.Mini user space kernelSmall set of syscalls Separate processes for file system access.Syscall interception methodsPtracekvmArchitecture - gVisorptrace platformSentry as user space kernelSyscall interception Ptrace:sysemu

3、 SyscallExceptionAppSentryGoferHost KernelPtrace: sysemuSeccompNamespaceArchitecture gVisor kvm platformApp in KVMSentry in HostGoferHost KernelKVM: syscall/exceptionSeccompNamespaceSentrysentry module in guest kernelSentry in host as user space kernel & type 2 hypervisorSyscall interception Syscall

4、ExceptionSentry KVM Guest KernelArchitecture gVisor storageSentryGoferFileSystem AccessFile system operations are sent to a proxy, called a Gofer, via a 9P connectionHost KernelrunscSentryGoferApp9PFSSystem callSystem callSystem callArchitecture gVisor networkingThe Gvisor Sentry implements its own

5、network stack (also written in Go) callednetstackNetstack is a user space IP stack.It already supported Tun/veth device./google/netstackA network passthrough mode to get best performance is also supportedGvisor uses user space IP stack, the name is netstack.Running “Hello world” on Arm ptrace platfo

6、rmEntryrunsc/main.gocmd.a(CreateDeleteCheckpointsExecKillPause)Initboot.a(load)ptrace.a/vdso.a/kernel.a/watchdog.aSeccomp Running “Hello world” on Arm ptrace platformptrace.aInitstub/subprocessLinux.aArch.aFilemem.aInterrupt.aProcid.aSafecopy.aUermem.adepsKvm platform - Memory managementMap pagetables: gva ipa PA: 48, VA: 48, pteSize:4K, 4 LevelsSetMemoryRegion: ipa hvaKvm platform Modify contextFix bug in sigactionEnabled type 2 hypervisor on Arm platformvm-exit on Arm platformEnabled vector-tableothersWhat We Have DoneRunning hello-world Enabled ptrace platfor