KVM and Container Performance and Isolation Deep Dive

1
KVM and Container Performance and Isolation Deep
Dive
2
KVM vs Container -- ?
3
KVM vs Container -- CPU
4
KVM vs Container -- Memory
5
KVM vs Container -- Network
6
X86 Privilege Rings
Ring 3
Least-trusted level
Ring 2
Ring 1
Ring 0
Most-trusted level
7
X86 Architecture
8
Linux Process memory structure
9
KVM shadow page table
10
Intel EPT
11
Container technology

• mnt
• pid
• net
• ipc
• uts
• user
• device? not yet

• cgroup

• cpuset

12
Container security