基于系统调用隔离的安全容器研究综述OA

This article elucidates the research progress in enhancing container security through the isolation of system calls.The article firstly outlines the development background of containerization technology and its major security challenges.Subsequently,an in-depth analysis is conducted on the role of system call isolation in enhancing the security of containers,including the techniques of limiting the system calls of containerized applications to reduce the attack surface,and leveraging operating system middleware and hardware protection mechanisms to accomplish the isolation and protection of containers.By comparing the implementation principles,performance,and their effects on isolation,reduction of attack surfaces,and data protection,the article reveals the advantages and limitations of system call isolation technologies in enhancing container security.