Secure container runtimes serve as the foundational layer for creating and running containers, which is the bedrock of emerging computing paradigms like microservices and serverless computing. Although existing secure container runtimes indeed enhance security via running containers over a guest kernel and a Virtual Machine Monitor (VMM or Hypervisor), they incur performance penalties in critical areas such as networking, container startup, and I/O system calls. In our practice of operating microservices and serverless computing, we build a high-performance secure container runtime named Quark. Unlike existing solutions that rely on traditional VM technologies by importing Linux for the guest kernel and QEMU for the VMM, we take a different approach to building Quark from the ground up, paving the way for extreme customization to unlock high performance. Our development centers on co-designing a custom guest kernel and a VMM for secure containers. To this end, we build a lightweight guest OS kernel named QKernel and a specialized VMM named QVisor. The QKernel-QVisor codesign allows us to deliver three key advancements: high-performance RDMA-based container networking, fast container startup mode, and efficient mechanisms for executing I/O syscalls. In our practice with real-world apps like Redis, Quark cuts down P95 latency by 79.3% and increases throughput by 2.43x compared to Kata. Moreover, Quark container startup achieves 96.5% lower latency than the cold-start mode while saving 81.3% memory cost to the keep-warm mode. Quark is open-source with an industry-standard codebase in Rust.

翻译：安全容器运行时是创建和运行容器的基础层，也是微服务和无服务器计算等新兴计算范式的基石。尽管现有的安全容器运行时通过客户内核和虚拟机监控器（VMM或Hypervisor）运行容器来增强安全性，但在网络、容器启动和I/O系统调用等关键领域存在性能损失。在微服务和无服务器计算的实践中，我们构建了名为Quark的高性能安全容器运行时。与依赖传统VM技术（引入Linux作为客户内核、QEMU作为VMM）的现有解决方案不同，我们采用自底向上的全新方法构建Quark，通过极致定制化实现高性能。我们的开发核心在于协同设计面向安全容器的定制客户内核和VMM。为此，我们构建了轻量级客户操作系统内核QKernel和专用VMM QVisor。QKernel-QVisor协同设计实现了三大关键突破：基于RDMA的高性能容器网络、快速容器启动模式以及高效的I/O系统调用执行机制。在Redis等真实应用的实践中，与Kata相比，Quark将P95延迟降低79.3%，吞吐量提升2.43倍。此外，Quark容器启动延迟比冷启动模式低96.5%，同时内存开销比保温模式节省81.3%。Quark采用Rust语言编写，基于工业级标准开源。