Securing user defined containers for scientific computing

Joshua Higgins, Violeta Holmes, Colin Venters

Research output: Chapter in Book/Report/Conference proceedingConference contribution

2 Citations (Scopus)

Abstract

Linux containers and Docker have gained immense popularity as a lightweight alternative to hypervisor based Virtual Machines (VMs). In the context of High Performance Computing and the scientific community, it is clear that containers can serve many useful purposes from system administration, to improved cluster resource management and as a format for sharing reproducible research. However, when compared to VMs, containers seem to trade isolation for performance and ease of use, which poses unique security challenges. In this paper we review how Docker is being used in science, highlight easy to perform exploits, and evaluate the impact of these on HPC deployments. We also summarise a number of strategies for hardening such a system to reduce the vulnerability of hosting User Defined Containers. Based on these, an original solution to enforce default options and container ownership for nonadministrative users in the HPC use case is presented, in addition to the experience of implementing such a system on a cluster at the University of Huddersfield.

Original languageEnglish
Title of host publication2016 International Conference on High Performance Computing and Simulation, HPCS 2016
PublisherInstitute of Electrical and Electronics Engineers Inc.
Pages449-453
Number of pages5
ISBN (Electronic)9781509020881
DOIs
Publication statusPublished - 13 Sep 2016
Event14th International Conference on High Performance Computing and Simulation - Innsbruck, Austria
Duration: 18 Jul 201622 Jul 2016
Conference number: 14
http://hpcs2016.cisedu.info/ (Link to Conference Website)

Conference

Conference14th International Conference on High Performance Computing and Simulation
Abbreviated titleHPCS 2016
CountryAustria
CityInnsbruck
Period18/07/1622/07/16
OtherThe 2016 International Conference on High Performance Computing & Simulation (HPCS 2016) will be held on July 18 - 22, 2016 in Innsbruck, Austria. Under the theme of “HPC and Modeling & Simulation for the 21st Century," HPCS 2016 will focus on a wide range of the state-of-the-art as well as emerging topics pertaining to high performance and large scale computing systems at both the client and backend levels.
Internet address

Fingerprint

Natural sciences computing
Scientific Computing
Container
Containers
Virtual Machine
Linux
Resource Management
Use Case
Hardening
Vulnerability
Isolation
Sharing
High Performance
Computing
Evaluate
Alternatives

Cite this

Higgins, J., Holmes, V., & Venters, C. (2016). Securing user defined containers for scientific computing. In 2016 International Conference on High Performance Computing and Simulation, HPCS 2016 (pp. 449-453). [7568369] Institute of Electrical and Electronics Engineers Inc.. https://doi.org/10.1109/HPCSim.2016.7568369
Higgins, Joshua ; Holmes, Violeta ; Venters, Colin. / Securing user defined containers for scientific computing. 2016 International Conference on High Performance Computing and Simulation, HPCS 2016. Institute of Electrical and Electronics Engineers Inc., 2016. pp. 449-453
@inproceedings{070d36022a0c4954af8c22ae81025eb3,
title = "Securing user defined containers for scientific computing",
abstract = "Linux containers and Docker have gained immense popularity as a lightweight alternative to hypervisor based Virtual Machines (VMs). In the context of High Performance Computing and the scientific community, it is clear that containers can serve many useful purposes from system administration, to improved cluster resource management and as a format for sharing reproducible research. However, when compared to VMs, containers seem to trade isolation for performance and ease of use, which poses unique security challenges. In this paper we review how Docker is being used in science, highlight easy to perform exploits, and evaluate the impact of these on HPC deployments. We also summarise a number of strategies for hardening such a system to reduce the vulnerability of hosting User Defined Containers. Based on these, an original solution to enforce default options and container ownership for nonadministrative users in the HPC use case is presented, in addition to the experience of implementing such a system on a cluster at the University of Huddersfield.",
keywords = "Docker, HPC, security, user defined containers",
author = "Joshua Higgins and Violeta Holmes and Colin Venters",
year = "2016",
month = "9",
day = "13",
doi = "10.1109/HPCSim.2016.7568369",
language = "English",
pages = "449--453",
booktitle = "2016 International Conference on High Performance Computing and Simulation, HPCS 2016",
publisher = "Institute of Electrical and Electronics Engineers Inc.",

}

Higgins, J, Holmes, V & Venters, C 2016, Securing user defined containers for scientific computing. in 2016 International Conference on High Performance Computing and Simulation, HPCS 2016., 7568369, Institute of Electrical and Electronics Engineers Inc., pp. 449-453, 14th International Conference on High Performance Computing and Simulation, Innsbruck, Austria, 18/07/16. https://doi.org/10.1109/HPCSim.2016.7568369

Securing user defined containers for scientific computing. / Higgins, Joshua; Holmes, Violeta; Venters, Colin.

2016 International Conference on High Performance Computing and Simulation, HPCS 2016. Institute of Electrical and Electronics Engineers Inc., 2016. p. 449-453 7568369.

Research output: Chapter in Book/Report/Conference proceedingConference contribution

TY - GEN

T1 - Securing user defined containers for scientific computing

AU - Higgins, Joshua

AU - Holmes, Violeta

AU - Venters, Colin

PY - 2016/9/13

Y1 - 2016/9/13

N2 - Linux containers and Docker have gained immense popularity as a lightweight alternative to hypervisor based Virtual Machines (VMs). In the context of High Performance Computing and the scientific community, it is clear that containers can serve many useful purposes from system administration, to improved cluster resource management and as a format for sharing reproducible research. However, when compared to VMs, containers seem to trade isolation for performance and ease of use, which poses unique security challenges. In this paper we review how Docker is being used in science, highlight easy to perform exploits, and evaluate the impact of these on HPC deployments. We also summarise a number of strategies for hardening such a system to reduce the vulnerability of hosting User Defined Containers. Based on these, an original solution to enforce default options and container ownership for nonadministrative users in the HPC use case is presented, in addition to the experience of implementing such a system on a cluster at the University of Huddersfield.

AB - Linux containers and Docker have gained immense popularity as a lightweight alternative to hypervisor based Virtual Machines (VMs). In the context of High Performance Computing and the scientific community, it is clear that containers can serve many useful purposes from system administration, to improved cluster resource management and as a format for sharing reproducible research. However, when compared to VMs, containers seem to trade isolation for performance and ease of use, which poses unique security challenges. In this paper we review how Docker is being used in science, highlight easy to perform exploits, and evaluate the impact of these on HPC deployments. We also summarise a number of strategies for hardening such a system to reduce the vulnerability of hosting User Defined Containers. Based on these, an original solution to enforce default options and container ownership for nonadministrative users in the HPC use case is presented, in addition to the experience of implementing such a system on a cluster at the University of Huddersfield.

KW - Docker

KW - HPC

KW - security

KW - user defined containers

UR - http://www.scopus.com/inward/record.url?scp=84991736658&partnerID=8YFLogxK

U2 - 10.1109/HPCSim.2016.7568369

DO - 10.1109/HPCSim.2016.7568369

M3 - Conference contribution

SP - 449

EP - 453

BT - 2016 International Conference on High Performance Computing and Simulation, HPCS 2016

PB - Institute of Electrical and Electronics Engineers Inc.

ER -

Higgins J, Holmes V, Venters C. Securing user defined containers for scientific computing. In 2016 International Conference on High Performance Computing and Simulation, HPCS 2016. Institute of Electrical and Electronics Engineers Inc. 2016. p. 449-453. 7568369 https://doi.org/10.1109/HPCSim.2016.7568369