"Rootless containers" is a concept to run the entire container runtimes and containers without the root privileges. It protects the host environment from attackers exploiting container runtime vulnerabilities. However, when rootless containers communicate with external endpoints, the network performance is low compared to rootful containers because of the overhead of rootless networking components. In this paper, we propose bypass4netns that accelerates TCP/IP communications in rootless containers by bypassing slow networking components. bypass4netns uses sockets allocated on the host. It switches sockets in containers to the host's sockets by intercepting syscalls and injecting the file descriptors using Seccomp. Our method with Seccomp can handle statically linked applications that previous works could not handle. Also, we propose high-performance rootless multi-node communication. We confirmed that rootless containers with bypass4netns achieve more than 30x faster throughput than rootless containers without it. In addition, we evaluated performance with applications and it showed large improvements on some applications.

翻译：“无根容器”是一种无需root权限即可运行整个容器运行时和容器的概念。它能保护主机环境免受利用容器运行时漏洞的攻击者的侵害。然而，当无根容器与外部端点通信时，由于无根网络组件的开销，网络性能低于有根容器。本文提出bypass4netns，通过绕过慢速网络组件来加速无根容器中的TCP/IP通信。bypass4netns使用主机上分配的套接字。它通过拦截系统调用，并使用Seccomp注入文件描述符，将容器中的套接字切换为主机的套接字。我们的Seccomp方法能够处理先前工作无法处理的静态链接应用程序。此外，我们提出了高性能的无根多节点通信。我们确认，使用bypass4netns的无根容器的吞吐量比未使用它的无根容器快30倍以上。此外，我们使用应用程序评估了性能，发现某些应用程序有大幅提升。