Stability

Our technology combines the strong isolation offered by Virtual Machines with the low overhead offered by running containers natively on bare-metal servers. Tenants benefit from predictable behavior because each one depends on private resources and software components. Practically, this means that the throughput and latency perceived by the end users can be configured through the allocated resources and the running software rather than being affected by the activity of neighboring tenants.

Security

Our technology hardens the system security because we minimize the reliance on the common attack surface of the operating-system kernel. Known container vulnerabilities arise from container escapes to the kernel software. We prohibit such attacks by serving the containers with private service implementations that are distinct per tenant and run at user level outside the system kernel.

Elasticity

Our technology achieves resource elasticity because the software infrastructure of each tenant can be deployed dynamically over containers. This includes not only the applications, but also the client and server side of distributed storage systems and other facilities (e.g., storage engine, local filesystem, network stack software).

Stergios Anastasiadis, PhD

Co-founder

Stergios is Director of the Computer Systems Lab and Professor at the Department of Computer Science and Engineering, University of Ioannina, Greece. In the past, he held visiting positions at University of Cambridge, UK, EPFL, Switzerland, Duke University, NC, USA and HP Labs, CA, USA. His research interests include operating systems, data storage and cloud computing. He received MSc and PhD degrees in Computer Science from the University of Toronto, Canada.

This paper introduces the Danaus client architecture to let each tenant access the container root and application filesystems over a private host path. We developed a Danaus prototype that integrates a union filesystem with a Ceph distributed filesystem client and a configurable shared cache. Across different host configurations, workloads and systems, Danaus achieves improved performance stability because it handles I/O with reserved pertenant resources and avoids intensive kernel locking.

This paper introduces a methodology based on exhaustive search to optimize the performance across different platforms. We design and implement the Asterope algorithm to experimentally generate optimal memcpy parameters for two x86-64 processor models from different vendors. With experiments on microbenchmarks and two production systems, we demonstrate that Asterope respectively achieves up to 2.4x and 1.9x higher function and system performance in comparison to using the Linux kernel memcpy.

In this paper we define a relaxed ordering model that splits the queue operations into two stages, the sequential assignment to queue slots and their subsequent concurrent execution. Based on this model, we design and implement the linearizable and lock-free algorithm called Relaxed Concurrent Queue Single (RCQS). We experimentally show that RCQS achieves factors to orders of magnitude advantage over the state-of-the-art queue algorithms in operation latency and item transfer speed.

This paper introduces the Polytropon toolkit as a collection of user-level components configurable to build several types of filesystems. The toolkit provides an application library to invoke the standard I/O calls, a user-level path to isolate the tenant I/O traffic to private host resources, and user-level filesystem services distinct per tenant. Polytropon serves 32 tenants with RocksDB over network storage with 7.2-14x lower latency than kernel systems, and reduces up to 2.9x the timespan to execute source-code processing in the containers of 32 tenants.

In this paper we propose to isolate the I/O path of each tenant by running dedicated storage systems at user level on reserved resources. We introduce the libservices as a unified user-level storage abstraction to dynamically provision per tenant container root filesystems, application data filesystems and image repositories. We outline several examples of container storage systems whose clients and servers can be composed from libservices. We demonstrate efficiency, flexibility, and performance advantage of a distributed filesystem built with libservices over existing user-level or kernel-level approaches.

The scalable deployment of filesystems in such environments is challenging due to intermediate translation layers required for networked file access or identity management. First we define the entities involved in a multitenant filesystem and present relevant security requirements. Then we introduce the design of the Dike authorization architecture. It combines native access control with tenant namespace isolation and compatibility to object-based filesystems. We introduce secure protocols to authenticate the participating entities and authorize the data access over the network.