A review of native container security for running applications
Olivier Flauzac, Fabien Mauhourat, Florent Nolot
Abstract
Containers offer an efficient solution allowing the application’s isolation. Most of the papers dealing with the container’s isolation focus on benchmarking container’s solutions. However, in this study, we focus on a static comparison of different features proposed by container solutions. First, we will focus on the container’s runtimes, then, we present the different solutions used in the study. The most common container solutions are compared, such as LXC, LXD, Singularity, Docker, Kata-containers, and gVisor. We consider container features as isolation, storage, network, and security capabilities. For each container feature, all container solutions will be compared to find the most efficient one. Finally, this paper compares the different default container configurations and attempts to find the most efficient container solution based on all compared features.