Research On Microkernel-Based Container Resource Isolation Mechanism

With the advance of Artificial Intelligence and Internet of Things,more and more smart devices need operating system support.Microkernel architecture operating system has the characteristics of simple kernel and weak coupling of system services,which makes it easy to tailor or expand to adapt to various devices.However,integrating various heterogeneous devices in the cloud and edge through one system poses great challenges to the deployment and migration of applications.Containers can provide a reliable lightweight virtual operating environment for various applications,which provides a solution to these challenges.However,microkernel architecture operating system lacks resource isolation mechanism necessary for containers.It is difficult to ensure that each container fairly shares physical resources of host.In order to solve this problem,considering features of the microkernel architecture operating system's service abstraction and modularization,microkernel-based resource isolation mechanism was designed and implemented while maintaining the simplicity of the kernel.The resource isolation mechanism is composed of a pseudo-file system and various resource isolation subsystems existing in the user space of operating system: 1)Pseudo file system acts as a medium for users to interact with each resource isolation subsystem,and forwards control information to each resource isolation subsystem;2)Combined with existing process scheduling strategy of system,CPU resource isolation subsystem allocates time slices to processes according to CPU weight value set by users,so as to ensure the quantitative allocation of CPU resources;3)According to the system's memory allocation strategy in units of physical blocks,memory resource isolation subsystem determines whether each memory request of target process exceeds the hard limit value set by users,and then determines whether to satisfy its memory request,thereby limiting the amount of memory resources that the process can use;4)Freezer process control subsystem changes the status flag bit of process in the kernel process table through system calls,and controls running status of the process with the help of process scheduling mechanism in the kernel.Based on Minix,an open-source microkernel architecture operating system,resource isolation mechanism is realized.The resource isolation mechanism makes physical resources of system user-controllable.It ensures that there will be no disorderly competition for physical resources between containers,so as to avoid mutual interference between containers.Test results show that the resource isolation mechanism can achieve a good isolation effect,and the implementation of the resource isolation mechanism only brings a maximum of 3.14% performance overhead to system.