With the ever-increasing pervasiveness of the cloud computing paradigm, strong isolation guarantees and low performance overhead from isolation platforms are paramount. An ideal isolation platform offers both: an impermeable isolation boundary while imposing a negligible performance overhead. In this paper, we examine various isolation platforms (containers, secure containers, hypervisors, unikernels), and conduct a wide array of experiments to measure the performance overhead and degree of isolation offered by the platforms. We find that container platforms have the best, near-native, performance while the newly emerging secure containers suffer from various overheads. The highest degree of isolation is achieved by unikernels, closely followed by traditional containers.

翻译：随着云计算模式的日益普及,强有力的隔离保障和孤立平台低效管理管理是至高无上的。理想的隔离平台既提供了:一个不可渗透的隔离边界,又强加了微不足道的绩效管理。在本文中,我们审视了各种隔离平台(容器、安全集装箱、超声波、独木灯),并进行了一系列广泛的实验,以衡量平台提供的性能管理费用和隔离程度。我们发现,集装箱平台的性能是最佳的、近亲性的,而新兴的安全集装箱则受到各种管理。最高度的隔离是由传统集装箱紧随其后的独木墙所实现的。