Linux containers and Docker have gained immense popularity as a lightweight alternative to hypervisor based Virtual Machines (VMs). In the context of High Performance Computing and the scientific community, it is clear that containers can serve many useful purposes from system administration, to improved cluster resource management and as a format for sharing reproducible research. However, when compared to VMs, containers seem to trade isolation for performance and ease of use, which poses unique security challenges. In this paper we review how Docker is being used in science, highlight easy to perform exploits, and evaluate the impact of these on HPC deployments. We also summarise a number of strategies for hardening such a system to reduce the vulnerability of hosting User Defined Containers. Based on these, an original solution to enforce default options and container ownership for nonadministrative users in the HPC use case is presented, in addition to the experience of implementing such a system on a cluster at the University of Huddersfield.
|Title of host publication
|2016 International Conference on High Performance Computing and Simulation, HPCS 2016
|Institute of Electrical and Electronics Engineers Inc.
|Number of pages
|Published - 13 Sep 2016
|14th International Conference on High Performance Computing and Simulation - Innsbruck, Austria
Duration: 18 Jul 2016 → 22 Jul 2016
Conference number: 14
http://hpcs2016.cisedu.info/ (Link to Conference Website)
|14th International Conference on High Performance Computing and Simulation
|18/07/16 → 22/07/16
|The 2016 International Conference on High Performance Computing & Simulation (HPCS 2016) will be held on July 18 - 22, 2016 in Innsbruck, Austria. Under the theme of “HPC and Modeling & Simulation for the 21st Century," HPCS 2016 will focus on a wide range of the state-of-the-art as well as emerging topics pertaining to high performance and large scale computing systems at both the client and backend levels.