Linux Namespaces and cgroups as OS Primitives for Lightweight Virtualization: Architecture, Isolation Mechanisms, and Performance Evaluation
Main Article Content
Abstract
Linux namespaces and control groups (cgroups) are key kernel primitives that enable lightweight virtualization by creating isolated environments called containers. These containers share the host kernel while maintaining process isolation and resource control, providing a balance between traditional hypervisor-based virtualization and bare-metal deployment. This paper examines the architecture, isolation mechanisms, and performance characteristics of namespaces and cgroups. We highlight how these features form the foundation of popular container technologies such as Docker and LXC, and compare their efficiency and isolation properties with conventional virtualization approaches.
Downloads
Metrics
Article Details
This work is licensed under a Creative Commons Attribution 4.0 International License.
You are free to:
- Share — copy and redistribute the material in any medium or format for any purpose, even commercially.
- Adapt — remix, transform, and build upon the material for any purpose, even commercially.
- The licensor cannot revoke these freedoms as long as you follow the license terms.
Under the following terms:
- Attribution — You must give appropriate credit , provide a link to the license, and indicate if changes were made . You may do so in any reasonable manner, but not in any way that suggests the licensor endorses you or your use.
- No additional restrictions — You may not apply legal terms or technological measures that legally restrict others from doing anything the license permits.
Notices:
You do not have to comply with the license for elements of the material in the public domain or where your use is permitted by an applicable exception or limitation .
No warranties are given. The license may not give you all of the permissions necessary for your intended use. For example, other rights such as publicity, privacy, or moral rights may limit how you use the material.
References
Bernstein, D. (2014). Containers and cloud: From LXC to Docker to Kubernetes. IEEE Cloud Computing, 1(3), 81–84. https://doi.org/10.1109/MCC.2014.51
Felter, W., Ferreira, A., Rajamony, R., & Rubio, J. (2015). An updated performance comparison of virtual machines and Linux containers. Proceedings of the 2015 IEEE International Symposium on Performance Analysis of Systems and Software (ISPASS), 171–172. https://doi.org/10.1109/ISPASS.2015.7095802
Merkel, D. (2014). Docker: Lightweight Linux containers for consistent development and deployment. Linux Journal, 2014(239), 2.
Soltesz, S., Pötzl, H., Fiuczynski, M. E., Bavier, A., & Peterson, L. (2007). Container-based operating system virtualization: A scalable, high-performance alternative to hypervisors. ACM SIGOPS Operating Systems Review, 41(3), 275–287. https://doi.org/10.1145/1272996.1273025
Price, B., & Tucker, C. (2014). Containers: Why they're worth using and what to watch out for. ACM Queue, 12(5), 1–10. https://doi.org/10.1145/2693085.2693090
Anderson, J. (2015). Docker and Linux containers: The kernel layer of next-generation infrastructure. Linux Journal, 2015(263), 2.
Kumar, R., & Raj, R. (2016). Performance analysis of Docker container and virtual machine in cloud environment. International Journal of Computer Applications, 145(6), 1–5. https://doi.org/10.5120/ijca2016910984
Pahl, C., & Lee, B. (2015). Containers and clusters for edge cloud architectures: A technology review. 2015 IEEE International Conference on Future Internet of Things and Cloud, 379–386. https://doi.org/10.1109/FiCloud.2015.14
Di Costanzo, A., De Assunção, M. D., & Buyya, R. (2009). Harnessing cloud technologies for a virtualized distributed computing infrastructure. IEEE Internet Computing, 13(5), 24–33. https://doi.org/10.1109/MIC.2009.97
Grattafiori, A. (2016). Understanding and hardening Linux containers. IOActive White Paper. Retrieved from https://ioactive.com/pdfs/Understanding-and-Hardening-Linux-Containers.pdf
Wasko, C. (2017). Exploring container security. SANS Institute InfoSec Reading Room. Retrieved from https://www.sans.org/reading-room/whitepapers/containers/exploring-container-security-38140
Garfinkel, T., Adams, K., Warfield, A., & Franklin, J. (2007). Compatibility is not transparency: VMM detection myths and realities. Proceedings of the 11th Workshop on Hot Topics in Operating Systems (HotOS XI), 106–111.
Williams, J. (2016). Comparing container and virtual machine architectures. Network World. Retrieved from https://www.networkworld.com/article/3145989/
IBM Research. (2015). An introduction to Linux containers. IBM DeveloperWorks. Retrieved from https://developer.ibm.com/articles/l-lxc-containers/
Rosenblum, M., & Garfinkel, T. (2005). Virtual machine monitors: Current technology and future trends. IEEE Computer, 38(5), 39–47. https://doi.org/10.1109/MC.2005.173
McDougall, R., & Anderson, J. (2006). Solaris containers: Operating system-level virtualization. Prentice Hall.
Xavier, M. G., Neves, M. V., Rossi, F. R., & De Rose, C. A. F. (2014). A performance comparison of container-based and virtual machine-based cloud environments. 2013 IEEE International Conference on Cloud Computing and Technology and Science, 371–378. https://doi.org/10.1109/CloudCom.2013.55
Madhavapeddy, A., & Scott, D. (2014). Unikernels: The rise of the virtual library operating system. Communications of the ACM, 57(1), 61–69. https://doi.org/10.1145/2541883