Understanding File System Operations of a Secure Container Runtime Using System Call Tracing Technique
Sunwoo JANG, Young‐Kyoon Suh, Byungchul Tak · IEICE Transactions on Information and Systems · 2024
This letter presents a technique that observes system call mapping behavior of the proxy kernel layer of secure container runtimes. We applied it to file system operations of a secure container runtime, gVisor. We found that gVisor's operations can become more expensive than the native by 48× more syscalls for open, and 6× for read and write.