{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,5]],"date-time":"2026-06-05T12:59:59Z","timestamp":1780664399535,"version":"3.54.1"},"publisher-location":"New York, NY, USA","reference-count":112,"publisher":"ACM","license":[{"start":{"date-parts":[[2026,4,26]],"date-time":"2026-04-26T00:00:00Z","timestamp":1777161600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/legalcode"}],"funder":[{"name":"Smart Gird-National Science and Technology Major Project","award":["2024ZD080300"],"award-info":[{"award-number":["2024ZD080300"]}]},{"name":"National Natural Science Foundation of China","award":["2302300"],"award-info":[{"award-number":["2302300"]}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2026,4,27]]},"DOI":"10.1145\/3767295.3769332","type":"proceedings-article","created":{"date-parts":[[2026,4,24]],"date-time":"2026-04-24T20:20:04Z","timestamp":1777062004000},"page":"605-623","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":0,"title":["SKernel: An Elastic and Efficient Secure Container System at Scale with a Split-Kernel Architecture"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0009-0000-2792-2249","authenticated-orcid":false,"given":"Xiaohu","family":"Chai","sequence":"first","affiliation":[{"name":"Tsinghua University, Beijing, China"},{"name":"Ant Group, Hangzhou, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0003-6634-3604","authenticated-orcid":false,"given":"Keyang","family":"Hu","sequence":"additional","affiliation":[{"name":"Tsinghua University, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0001-0038-5997","authenticated-orcid":false,"given":"Jianfeng","family":"Tan","sequence":"additional","affiliation":[{"name":"Ant Group, Hangzhou, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0001-0286-1539","authenticated-orcid":false,"given":"Tiwei","family":"Bie","sequence":"additional","affiliation":[{"name":"Ant Group, Hangzhou, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0000-3575-0168","authenticated-orcid":false,"given":"Guotao","family":"Tan","sequence":"additional","affiliation":[{"name":"Ant Group, Hangzhou, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0009-1912-5501","authenticated-orcid":false,"given":"Tianyu","family":"Zhou","sequence":"additional","affiliation":[{"name":"Ant Group, Hangzhou, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0008-4200-5885","authenticated-orcid":false,"given":"Anqi","family":"Shen","sequence":"additional","affiliation":[{"name":"Ant Group, Hangzhou, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0001-8430-4882","authenticated-orcid":false,"given":"Dawei","family":"Shen","sequence":"additional","affiliation":[{"name":"Ant Group, Hangzhou, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0000-8230-5251","authenticated-orcid":false,"given":"Xinyao","family":"Yang","sequence":"additional","affiliation":[{"name":"Ant Group, Hangzhou, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0006-5863-3371","authenticated-orcid":false,"given":"Xin","family":"Chen","sequence":"additional","affiliation":[{"name":"Ant Group, Hangzhou, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0001-6180-266X","authenticated-orcid":false,"given":"Xu","family":"Wang","sequence":"additional","affiliation":[{"name":"Ant Group, Hangzhou, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0004-0194-8941","authenticated-orcid":false,"given":"Feng","family":"Yu","sequence":"additional","affiliation":[{"name":"Ant Group, Hangzhou, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0002-7682-1019","authenticated-orcid":false,"given":"Zhengyu","family":"He","sequence":"additional","affiliation":[{"name":"Ant Group, Hangzhou, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-7945-8430","authenticated-orcid":false,"given":"Dong","family":"Du","sequence":"additional","affiliation":[{"name":"Shanghai Jiao Tong University, Shanghai, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-6558-5298","authenticated-orcid":false,"given":"Yubin","family":"Xia","sequence":"additional","affiliation":[{"name":"Shanghai Jiao Tong University, Shanghai, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8368-1109","authenticated-orcid":false,"given":"Kang","family":"Chen","sequence":"additional","affiliation":[{"name":"Tsinghua University, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0007-8455-3663","authenticated-orcid":false,"given":"Yu","family":"Chen","sequence":"additional","affiliation":[{"name":"Quan Cheng Laboratory, Jinan, China"},{"name":"Tsinghua University, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2026,4,26]]},"reference":[{"key":"e_1_3_2_1_1_1","unstructured":"9p (protocol). https:\/\/en.wikipedia.org\/wiki\/9P_(protocol). Accessed: 2024-06-17."},{"key":"e_1_3_2_1_2_1","unstructured":"Archived-TLDK - fd.io. https:\/\/wiki.fd.io\/view\/TLDK. Accessed: 2024-06-17."},{"key":"e_1_3_2_1_3_1","unstructured":"Data plane development kit (dpdk). https:\/\/www.dpdk.org\/. Accessed: 2024-06-17."},{"key":"e_1_3_2_1_4_1","volume-title":"https:\/\/nginx.org\/en\/. Accessed","year":"2024","unstructured":"Nginx. https:\/\/nginx.org\/en\/. Accessed June 13, 2024."},{"key":"e_1_3_2_1_5_1","volume-title":"https:\/\/github.com\/firecracker-microvm\/firecracker\/issues\/1179\/","author":"Firecracker","year":"2019","unstructured":"Firecracker issue. https:\/\/github.com\/firecracker-microvm\/firecracker\/issues\/1179\/, 2019."},{"key":"e_1_3_2_1_6_1","volume-title":"Networking configuration tools","author":"Red","year":"2024","unstructured":"Red hat enterprise linux performance tuning guide: Networking configuration tools, 2024."},{"key":"e_1_3_2_1_7_1","volume-title":"Virtual function i\/o. https:\/\/docs.kernel.org\/driver-api\/vfio.html","author":"VFIO","year":"2024","unstructured":"VFIO: Virtual function i\/o. https:\/\/docs.kernel.org\/driver-api\/vfio.html, 2024. Accessed: 2024-06-20."},{"key":"e_1_3_2_1_8_1","first-page":"434","volume-title":"17th USENIX Symposium on Networked Systems Design and Implementation (NSDI 20)","author":"Agache Alexandru","year":"2020","unstructured":"Alexandru Agache, Marc Brooker, Alexandra Iordache, Anthony Liguori, Rolf Neugebauer, Phil Piwonka, and Diana-Maria Popa. Firecracker: Lightweight virtualization for serverless applications. In 17th USENIX Symposium on Networked Systems Design and Implementation (NSDI 20), pages 419\u2013434, Santa Clara, CA, February 2020. USENIX Association."},{"key":"e_1_3_2_1_9_1","first-page":"393","volume-title":"Proceedings of the 28th ACM International Conference on Architectural Support for Programming Languages and Operating Systems","volume":"4","author":"Ahmad Adil","year":"2024","unstructured":"Adil Ahmad, Botong Ou, Congyu Liu, Xiaokuan Zhang, and Pedro Fonseca. Veil: A protected services framework for confidential virtual machines. In Proceedings of the 28th ACM International Conference on Architectural Support for Programming Languages and Operating Systems, Volume 4, ASPLOS '23, page 378\u2013393, New York, NY, USA, 2024. Association for Computing Machinery."},{"key":"e_1_3_2_1_10_1","unstructured":"Amazon Web Services. What is cloud native? - cloud native applications explained - aws. https:\/\/aws.amazon.com\/what-is\/cloud-native\/?nc1=h_ls. Accessed: 2025-01-10."},{"key":"e_1_3_2_1_11_1","unstructured":"Amazon Web Services. What is service mesh? - service mesh explained - aws. https:\/\/aws.amazon.com\/what-is\/service-mesh\/. Accessed: 2025-01-10."},{"key":"e_1_3_2_1_12_1","volume-title":"Vertical pod autoscaler for amazon eks. https:\/\/docs.aws.amazon.com\/eks\/latest\/userguide\/vertical-pod-autoscaler.html","author":"Services Amazon Web","year":"2024","unstructured":"Amazon Web Services. Vertical pod autoscaler for amazon eks. https:\/\/docs.aws.amazon.com\/eks\/latest\/userguide\/vertical-pod-autoscaler.html, 2024. Accessed: 2025-05-13."},{"key":"e_1_3_2_1_13_1","volume-title":"2011 USENIX Annual Technical Conference (USENIX ATC 11)","author":"Amit Nadav","year":"2011","unstructured":"Nadav Amit, Muli Ben-Yehuda, IBM Research, Dan Tsafrir, and Assaf Schuster. vIOMMU: Efficient IOMMU emulation. In 2011 USENIX Annual Technical Conference (USENIX ATC 11), Portland, OR, June 2011. USENIX Association."},{"key":"e_1_3_2_1_14_1","first-page":"112","volume-title":"2018 USENIX Annual Technical Conference (USENIX ATC 18)","author":"Amit Nadav","year":"2018","unstructured":"Nadav Amit and Michael Wei. The design and implementation of hyperupcalls. In 2018 USENIX Annual Technical Conference (USENIX ATC 18), pages 97\u2013112, Boston, MA, July 2018. USENIX Association."},{"key":"e_1_3_2_1_15_1","volume-title":"Proceedings of the 16th ACM SIGPLAN\/SIGOPS International Conference on Virtual Execution Environments","author":"Caraza-Harter Tyler","year":"2020","unstructured":"Anjali, Tyler Caraza-Harter, and Michael M. Swift. Blending containers and virtual machines: a study of firecracker and gvisor. Proceedings of the 16th ACM SIGPLAN\/SIGOPS International Conference on Virtual Execution Environments, 2020."},{"key":"e_1_3_2_1_16_1","unstructured":"Ant Group. MOSN (Modular Open Smart Network): The Cloud-Native Network Proxy Platform. https:\/\/github.com\/mosn\/mosn. Accessed: 2025-01-12."},{"key":"e_1_3_2_1_17_1","unstructured":"AppArmor. https:\/\/www.kernel.org\/doc\/html\/v4.15\/index.html."},{"key":"e_1_3_2_1_18_1","first-page":"703","volume-title":"12th USENIX Symposium on Operating Systems Design and Implementation (OSDI 16)","author":"Arnautov Sergei","year":"2016","unstructured":"Sergei Arnautov, Bohdan Trach, Franz Gregor, Thomas Knauth, Andre Martin, Christian Priebe, Joshua Lind, Divya Muthukumaran, Dan O'Keeffe, Mark L. Stillwell, David Goltzsche, Dave Eyers, R\u00fcdiger Kapitza, Peter Pietzuch, and Christof Fetzer. SCONE: Secure linux containers with intel SGX. In 12th USENIX Symposium on Operating Systems Design and Implementation (OSDI 16), pages 689\u2013703, Savannah, GA, November 2016. USENIX Association."},{"key":"e_1_3_2_1_19_1","volume-title":"fio - flexible i\/o tester rev. 3.36. FIO's documentation!","author":"Axboe Jens","year":"2024","unstructured":"Jens Axboe. fio - flexible i\/o tester rev. 3.36. FIO's documentation!, 2024."},{"key":"e_1_3_2_1_20_1","volume-title":"Dec","author":"Barham Paul","year":"2003","unstructured":"Paul Barham, Boris Dragovic, Keir Fraser, Steven Hand, Tim Harris, Alex Ho, Rolf Neugebauer, Ian Pratt, and Andrew Warfield. Xen and the art of virtualization. ACM SIGOPS Operating Systems Review, page 164\u2013177, Dec 2003."},{"key":"e_1_3_2_1_21_1","volume-title":"Operating Systems Design and Implementation","author":"Belay Adam","year":"2012","unstructured":"Adam Belay, Andrea Bittau, Ali Mashtizadeh, David Terei, David Mazi\u00e8res, and Christos Kozyrakis. Dune: safe user-level access to privileged cpu features. Operating Systems Design and Implementation, Operating Systems Design and Implementation, Oct 2012."},{"key":"e_1_3_2_1_22_1","first-page":"65","volume-title":"11th USENIX Symposium on Operating Systems Design and Implementation (OSDI 14)","author":"Belay Adam","year":"2014","unstructured":"Adam Belay, George Prekas, Ana Klimovic, Samuel Grossman, Christos Kozyrakis, and Edouard Bugnion. IX: A protected dataplane operating system for high throughput and low latency. In 11th USENIX Symposium on Operating Systems Design and Implementation (OSDI 14), pages 49\u201365, Broomfield, CO, October 2014. USENIX Association."},{"key":"e_1_3_2_1_23_1","volume-title":"Proceedings of the 19th USENIX Conference on Operating Systems Design and Implementation, OSDI '25, USA","author":"Chai Xiaohu","year":"2025","unstructured":"Xiaohu Chai, Tianyu Zhou, Keyang Hu, Jianfeng Tan, Tiwei Bie, Anqi Shen, Dawei Shen, Qi Xing, Shun Song, Tongkai Yang, Le Gao, Feng Yu, Zhengyu He, Dong Du, Yubin Xia, Kang Chen, and Yu Chen. Fork in the road: reflections and optimizations for cold start latency in production serverless systems. In Proceedings of the 19th USENIX Conference on Operating Systems Design and Implementation, OSDI '25, USA, 2025. USENIX Association."},{"key":"e_1_3_2_1_24_1","doi-asserted-by":"publisher","DOI":"10.1145\/3302424.3303968"},{"key":"e_1_3_2_1_25_1","first-page":"105","volume-title":"13th USENIX Symposium on Operating Systems Design and Implementation (OSDI 18)","author":"Cutler Cody","year":"2018","unstructured":"Cody Cutler, M. Frans Kaashoek, and Robert T. Morris. The benefits and costs of writing a POSIX kernel in a high-level language. In 13th USENIX Symposium on Operating Systems Design and Implementation (OSDI 18), pages 89\u2013105, Carlsbad, CA, October 2018. USENIX Association."},{"key":"e_1_3_2_1_26_1","unstructured":"Docker. Docker: Accelerated container application development. https:\/\/www.docker.com. Accessed: 2025-01-10."},{"key":"e_1_3_2_1_27_1","volume-title":"Transparent huge pages. https:\/\/www.kernel.org\/doc\/html\/next\/admin-guide\/mm\/transhuge.html","author":"Documentation Linux Kernel","year":"2023","unstructured":"Linux Kernel Documentation. Transparent huge pages. https:\/\/www.kernel.org\/doc\/html\/next\/admin-guide\/mm\/transhuge.html, 2023. Accessed: 2025-05-09."},{"key":"e_1_3_2_1_28_1","volume-title":"Uber's tech stack, part one: The foundation. https:\/\/eng.uber.com\/tech-stack-part-one-foundation\/","author":"Engineering Uber","year":"2016","unstructured":"Uber Engineering. Uber's tech stack, part one: The foundation. https:\/\/eng.uber.com\/tech-stack-part-one-foundation\/, 2016. Accessed: 2025-05-15."},{"key":"e_1_3_2_1_29_1","unstructured":"The OpenStack Foundation. Kata Containers Architecture. https:\/\/github.com\/kata-containers\/documentation\/blob\/master\/design\/architecture.md."},{"key":"e_1_3_2_1_30_1","first-page":"73","volume-title":"21st USENIX Symposium on Networked Systems Design and Implementation (NSDI 24)","author":"Fried Joshua","year":"2024","unstructured":"Joshua Fried, Gohar Irfan Chaudhry, Enrique Saurez, Esha Choukse, Inigo Goiri, Sameh Elnikety, Rodrigo Fonseca, and Adam Belay. Making kernel bypass practical for the cloud with junction. In 21st USENIX Symposium on Networked Systems Design and Implementation (NSDI 24), pages 55\u201373, Santa Clara, CA, April 2024. USENIX Association."},{"key":"e_1_3_2_1_31_1","volume-title":"Proceedings of the 14th USENIX Conference on Operating Systems Design and Implementation, OSDI'20, USA","author":"Fried Joshua","year":"2020","unstructured":"Joshua Fried, Zhenyuan Ruan, Amy Ousterhout, and Adam Belay. Caladan: mitigating interference at microsecond timescales. In Proceedings of the 14th USENIX Conference on Operating Systems Design and Implementation, OSDI'20, USA, 2020. USENIX Association."},{"key":"e_1_3_2_1_32_1","first-page":"162","volume-title":"2019 USENIX Annual Technical Conference (USENIX ATC 19)","author":"Gao Xiang","year":"2019","unstructured":"Xiang Gao, Mingkai Dong, Xie Miao, Wei Du, Chao Yu, and Haibo Chen. EROFS: A compression-friendly readonly file system for resource-scarce devices. In 2019 USENIX Annual Technical Conference (USENIX ATC 19), pages 149\u2013162, Renton, WA, July 2019. USENIX Association."},{"key":"e_1_3_2_1_33_1","volume-title":"io_uring passthrough. Presented at the KVM Forum","author":"Garzarella Stefano","year":"2020","unstructured":"Stefano Garzarella. io_uring passthrough. Presented at the KVM Forum 2020, 2020. Available online: https:\/\/static.sched.com\/hosted_files\/kvmforum2020\/9c\/KVMForum_2020_io_uring_passthrough_Stefano_Garzarella.pdf."},{"key":"e_1_3_2_1_34_1","volume-title":"Vertical pod autoscaler. https:\/\/cloud.google.com\/kubernetes-engine\/docs\/concepts\/verticalpodautoscaler","author":"Cloud Google","year":"2024","unstructured":"Google Cloud. Vertical pod autoscaler. https:\/\/cloud.google.com\/kubernetes-engine\/docs\/concepts\/verticalpodautoscaler, 2024. Accessed: 2025-05-13."},{"key":"e_1_3_2_1_35_1","doi-asserted-by":"publisher","DOI":"10.1145\/3694715.3695957"},{"key":"e_1_3_2_1_36_1","volume-title":"gvisor: Users. https:\/\/gvisor.dev\/users\/","year":"2023","unstructured":"gVisor. gvisor: Users. https:\/\/gvisor.dev\/users\/, 2023. Accessed: 2025-05-15."},{"key":"e_1_3_2_1_37_1","volume-title":"Networking \u2014 gvisor user guide. https:\/\/gvisor.dev\/docs\/user_guide\/networking\/","author":"Developers Gvisor Project","year":"2024","unstructured":"Gvisor Project Developers. Networking \u2014 gvisor user guide. https:\/\/gvisor.dev\/docs\/user_guide\/networking\/, 2024."},{"key":"e_1_3_2_1_38_1","volume-title":"Accessed","author":"Hat Red","year":"2024","unstructured":"Red Hat. Red Hat Enterprise Linux 7 Performance Tuning Guide: Configuring Receive Flow Steering (RFS) Section, 2024. Accessed June 13, 2024."},{"key":"e_1_3_2_1_39_1","unstructured":"IBM. What is a service level agreement (sla)? https:\/\/www.ibm.com\/think\/topics\/service-level-agreement. Accessed: 2025-05-09."},{"key":"e_1_3_2_1_40_1","unstructured":"Google Inc. gVisor Gofer. https:\/\/pkg.go.dev\/gvisor.dev\/gvisor@v0.0.0-20240613080552-e18e311202b7\/pkg\/sentry\/fsimpl\/gofer."},{"key":"e_1_3_2_1_41_1","unstructured":"Google Inc. gVisor Sentry. https:\/\/pkg.go.dev\/gvisor.dev\/gvisor\/pkg\/sentry\/syscalls."},{"key":"e_1_3_2_1_42_1","unstructured":"Google Inc. What is gVisor? https:\/\/gvisor.dev\/docs\/."},{"key":"e_1_3_2_1_43_1","volume-title":"Paypal's journey with spring boot. https:\/\/www.infoq.com\/presentations\/paypal-spring-boot\/","author":"Q.","year":"2020","unstructured":"InfoQ. Paypal's journey with spring boot. https:\/\/www.infoq.com\/presentations\/paypal-spring-boot\/, 2020. Accessed: 2025-05-15."},{"key":"e_1_3_2_1_44_1","unstructured":"Opencontainers Initiative. runc: A cli tool for spawning and running containers. https:\/\/github.com\/opencontainers\/runc. Accessed: 2024-01-17."},{"key":"e_1_3_2_1_45_1","volume-title":"iputils: The home of ping, tracepath, clock-diff and other network debugging tools. https:\/\/github.com\/iputils\/iputils","author":"Contributors The","year":"2024","unstructured":"The iputils Contributors. iputils: The home of ping, tracepath, clock-diff and other network debugging tools. https:\/\/github.com\/iputils\/iputils, 2024. Accessed: 2024-04-05."},{"key":"e_1_3_2_1_46_1","volume-title":"Connect, secure, control, and observe services","author":"Authors Istio","year":"2024","unstructured":"Istio Authors. Istio: Connect, secure, control, and observe services, 2024. The official documentation website for the Istio service mesh."},{"key":"e_1_3_2_1_47_1","volume-title":"12th USENIX Security Symposium (USENIX Security 03)","author":"Jaeger Trent","year":"2003","unstructured":"Trent Jaeger, Reiner Sailer, and Xiaolan Zhang. Analyzing integrity protection in the SELinux example policy. In 12th USENIX Security Symposium (USENIX Security 03), Washington, D.C., August 2003. USENIX Association."},{"key":"e_1_3_2_1_48_1","first-page":"502","volume-title":"11th USENIX Symposium on Networked Systems Design and Implementation (NSDI 14)","author":"Jeong EunYoung","year":"2014","unstructured":"EunYoung Jeong, Shinae Wood, Muhammad Jamshed, Haewon Jeong, Sunghwan Ihm, Dongsu Han, and KyoungSoo Park. mTCP: a highly scalable user-level TCP stack for multicore systems. In 11th USENIX Symposium on Networked Systems Design and Implementation (NSDI 14), pages 489\u2013502, Seattle, WA, April 2014. USENIX Association."},{"key":"e_1_3_2_1_49_1","volume-title":"The state of developer ecosystem 2022: Microservices. https:\/\/www.jetbrains.com\/lp\/devecosystem-2022\/microservices\/","year":"2022","unstructured":"JetBrains. The state of developer ecosystem 2022: Microservices. https:\/\/www.jetbrains.com\/lp\/devecosystem-2022\/microservices\/, 2022. Accessed: 2025-05-15."},{"key":"e_1_3_2_1_50_1","doi-asserted-by":"publisher","DOI":"10.1145\/3552326.3567487"},{"key":"e_1_3_2_1_51_1","first-page":"454","volume-title":"2022 USENIX Annual Technical Conference (USENIX ATC 22)","author":"Jia Yuekai","year":"2022","unstructured":"Yuekai Jia, Shuang Liu, Wenhao Wang, Yu Chen, Zhengde Zhai, Shoumeng Yan, and Zhengyu He. HyperEnclave: An open and cross-platform trusted execution environment. In 2022 USENIX Annual Technical Conference (USENIX ATC 22), pages 437\u2013454, Carlsbad, CA, July 2022. USENIX Association."},{"key":"e_1_3_2_1_52_1","first-page":"360","volume-title":"16th USENIX Symposium on Networked Systems Design and Implementation (NSDI 19)","author":"Kaffes Kostis","year":"2019","unstructured":"Kostis Kaffes, Timothy Chong, Jack Tigar Humphries, Adam Belay, David Mazi\u00e8res, and Christos Kozyrakis. Shinjuku: Preemptive scheduling for \u03bcsecond-scale tail latency. In 16th USENIX Symposium on Networked Systems Design and Implementation (NSDI 19), pages 345\u2013360, Boston, MA, February 2019. USENIX Association."},{"key":"e_1_3_2_1_53_1","volume-title":"vcpu handling in runtime-rs. https:\/\/github.com\/kata-containers\/kata-containers\/blob\/main\/docs\/design\/vcpu-handling-runtime-go.md","author":"Community Kata Containers","year":"2023","unstructured":"Kata Containers Community. vcpu handling in runtime-rs. https:\/\/github.com\/kata-containers\/kata-containers\/blob\/main\/docs\/design\/vcpu-handling-runtime-go.md, 2023. Accessed: 2025-05-13."},{"key":"e_1_3_2_1_54_1","volume-title":"Understanding user namespaces. https:\/\/lwn.net\/Articles\/857228\/","author":"Kerrisk Michael","year":"2021","unstructured":"Michael Kerrisk. Understanding user namespaces. https:\/\/lwn.net\/Articles\/857228\/, 2021. Accessed: 2023-04-15."},{"key":"e_1_3_2_1_55_1","doi-asserted-by":"publisher","DOI":"10.1109\/MASCOTS.2018.00042"},{"key":"e_1_3_2_1_56_1","first-page":"144","volume-title":"2013 USENIX Annual Technical Conference (USENIX ATC 13)","author":"Kim Taesoo","year":"2013","unstructured":"Taesoo Kim and Nickolai Zeldovich. Practical and effective sandboxing for non-root users. In 2013 USENIX Annual Technical Conference (USENIX ATC 13), pages 139\u2013144, San Jose, CA, June 2013. USENIX Association."},{"key":"e_1_3_2_1_57_1","first-page":"72","volume-title":"2014 USENIX Annual Technical Conference (USENIX ATC 14)","author":"Kivity Avi","year":"2014","unstructured":"Avi Kivity, Dor Laor, Glauber Costa, Pekka Enberg, Nadav Har'El, Don Marti, and Vlad Zolotarov. OSv\u2014Optimizing the operating system for virtual machines. In 2014 USENIX Annual Technical Conference (USENIX ATC 14), pages 61\u201372, Philadelphia, PA, June 2014. USENIX Association."},{"key":"e_1_3_2_1_58_1","volume-title":"kvm: the linux virtual machine monitor","author":"Kivity Avi","year":"2007","unstructured":"Avi Kivity and Anthony Liguori. kvm: the linux virtual machine monitor. 2007."},{"key":"e_1_3_2_1_59_1","doi-asserted-by":"publisher","DOI":"10.1145\/1629575.1629596"},{"key":"e_1_3_2_1_60_1","unstructured":"Alexey Kopytov. sysbench: Scriptable database and system performance benchmark. https:\/\/github.com\/akopytov\/sysbench. Accessed: 2025-09-13."},{"key":"e_1_3_2_1_61_1","unstructured":"Kubernetes. Production-grade container orchestration. https:\/\/kubernetes.io. Accessed: 2025-01-10."},{"key":"e_1_3_2_1_62_1","volume-title":"https:\/\/kubernetes.io\/docs\/concepts\/workloads\/pods\/","year":"2024","unstructured":"Kubernetes. Pods. https:\/\/kubernetes.io\/docs\/concepts\/workloads\/pods\/, 2024. Accessed: 2025-01-08."},{"key":"e_1_3_2_1_63_1","volume-title":"Ephemeral volumes. https:\/\/kubernetes.io\/docs\/concepts\/storage\/ephemeral-volumes\/","author":"Community Kubernetes","year":"2024","unstructured":"Kubernetes Community. Ephemeral volumes. https:\/\/kubernetes.io\/docs\/concepts\/storage\/ephemeral-volumes\/, 2024."},{"key":"e_1_3_2_1_64_1","doi-asserted-by":"publisher","DOI":"10.1145\/3447786.3456248"},{"key":"e_1_3_2_1_65_1","volume-title":"Challenges revisited in supporting virt cpu hotplug. https:\/\/lore.kernel.org\/all\/82deccdf-ad02-4c7f-bcb6-20cfd2723c17@redhat.com\/T\/","author":"Kumar Amit","year":"2023","unstructured":"Amit Kumar and Salil Mehta. Challenges revisited in supporting virt cpu hotplug. https:\/\/lore.kernel.org\/all\/82deccdf-ad02-4c7f-bcb6-20cfd2723c17@redhat.com\/T\/, 2023."},{"key":"e_1_3_2_1_66_1","doi-asserted-by":"publisher","DOI":"10.1109\/CONECCT50063.2020.9198653"},{"key":"e_1_3_2_1_67_1","doi-asserted-by":"publisher","DOI":"10.1145\/3617232.3624861"},{"key":"e_1_3_2_1_68_1","first-page":"654","volume-title":"Proceedings of the ACM SIGOPS 28th Symposium on Operating Systems Principles, SOSP '21","author":"Li Dingji","year":"2021","unstructured":"Dingji Li, Zeyu Mi, Yubin Xia, Binyu Zang, Haibo Chen, and Haibing Guan. Twinvisor: Hardware-isolated confidential virtual machines for arm. In Proceedings of the ACM SIGOPS 28th Symposium on Operating Systems Principles, SOSP '21, page 638\u2013654, New York, NY, USA, 2021. Association for Computing Machinery."},{"key":"e_1_3_2_1_69_1","doi-asserted-by":"publisher","DOI":"10.14778\/3352063.3352141"},{"key":"e_1_3_2_1_70_1","doi-asserted-by":"publisher","DOI":"10.1109\/ISCA52012.2021.00032"},{"key":"e_1_3_2_1_71_1","first-page":"68","volume-title":"2022 USENIX Annual Technical Conference (USENIX ATC 22)","author":"Li Zijun","year":"2022","unstructured":"Zijun Li, Jiagan Cheng, Quan Chen, Eryu Guan, Zizheng Bian, Yi Tao, Bin Zha, Qiang Wang, Weidong Han, and Minyi Guo. RunD: A lightweight secure container runtime for high-density deployment and high-concurrency startup in serverless computing. In 2022 USENIX Annual Technical Conference (USENIX ATC 22), pages 53\u201368, Carlsbad, CA, July 2022. USENIX Association."},{"key":"e_1_3_2_1_72_1","doi-asserted-by":"publisher","DOI":"10.1145\/3552326.3587454"},{"key":"e_1_3_2_1_73_1","first-page":"472","volume-title":"Proceedings of the Eighteenth International Conference on Architectural Support for Programming Languages and Operating Systems, ASPLOS '13","author":"Madhavapeddy Anil","year":"2013","unstructured":"Anil Madhavapeddy, Richard Mortier, Charalampos Rotsos, David Scott, Balraj Singh, Thomas Gazagnaire, Steven Smith, Steven Hand, and Jon Crowcroft. Unikernels: library operating systems for the cloud. In Proceedings of the Eighteenth International Conference on Architectural Support for Programming Languages and Operating Systems, ASPLOS '13, page 461\u2013472, New York, NY, USA, 2013. Association for Computing Machinery."},{"key":"e_1_3_2_1_74_1","doi-asserted-by":"publisher","DOI":"10.1145\/3132747.3132763"},{"key":"e_1_3_2_1_75_1","doi-asserted-by":"publisher","DOI":"10.1145\/3341301.3359657"},{"issue":"2","key":"e_1_3_2_1_76_1","first-page":"2","article-title":"Docker: lightweight linux containers for consistent development and deployment","volume":"239","author":"Dirk Merkel","year":"2014","unstructured":"Dirk Merkel et al. Docker: lightweight linux containers for consistent development and deployment. Linux j, 239(2):2, 2014.","journal-title":"Linux j"},{"key":"e_1_3_2_1_77_1","volume-title":"Sidecar pattern - azure architecture center. https:\/\/learn.microsoft.com\/en-us\/azure\/architecture\/patterns\/sidecar","year":"2024","unstructured":"Microsoft. Sidecar pattern - azure architecture center. https:\/\/learn.microsoft.com\/en-us\/azure\/architecture\/patterns\/sidecar, 2024. Accessed: 2025-01-08."},{"key":"e_1_3_2_1_78_1","volume-title":"Netflix open source software center. https:\/\/netflix.github.io\/","year":"2023","unstructured":"Netflix. Netflix open source software center. https:\/\/netflix.github.io\/, 2023. Accessed: 2025-05-15."},{"key":"e_1_3_2_1_79_1","volume-title":"h2load - HTTP\/2 benchmarking tool. [Online","year":"2025","unstructured":"nghttp2.org. h2load - HTTP\/2 benchmarking tool. [Online; accessed 2025-01-12]."},{"key":"e_1_3_2_1_80_1","doi-asserted-by":"publisher","DOI":"10.1109\/TNET.2021.3129806"},{"key":"e_1_3_2_1_81_1","doi-asserted-by":"publisher","DOI":"10.1145\/3313808.3313817"},{"key":"e_1_3_2_1_82_1","volume-title":"Mysql: The world's most popular open source database","author":"Oracle Corporation","year":"2025","unstructured":"Oracle Corporation. Mysql: The world's most popular open source database, 2025. Accessed: 2025-09-13."},{"key":"e_1_3_2_1_83_1","volume-title":"January","author":"Linux Kernel Organization","year":"2024","unstructured":"Linux Kernel Organization. Credentials. https:\/\/docs.kernel.org\/security\/credentials.html, January 2024. Accessed: 2024-04-15."},{"key":"e_1_3_2_1_84_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE48619.2023.00210"},{"key":"e_1_3_2_1_85_1","first-page":"16","volume-title":"11th USENIX Symposium on Operating Systems Design and Implementation (OSDI 14)","author":"Peter Simon","year":"2014","unstructured":"Simon Peter, Jialin Li, Irene Zhang, Dan R. K. Ports, Doug Woos, Arvind Krishnamurthy, Thomas Anderson, and Timothy Roscoe. Arrakis: The operating system is the control plane. In 11th USENIX Symposium on Operating Systems Design and Implementation (OSDI 14), pages 1\u201316, Broomfield, CO, October 2014. USENIX Association."},{"key":"e_1_3_2_1_86_1","doi-asserted-by":"publisher","DOI":"10.1145\/1950365.1950399"},{"key":"e_1_3_2_1_87_1","volume-title":"https:\/\/redis.io\/","year":"2021","unstructured":"Redis. Redis. https:\/\/redis.io\/, 2021. Accessed June 13, 2024."},{"key":"e_1_3_2_1_88_1","volume-title":"Redis documentation - optimization: Benchmarks. https:\/\/redis.io\/docs\/latest\/operate\/oss_and_stack\/management\/optimization\/benchmarks\/","year":"2024","unstructured":"Redis. Redis documentation - optimization: Benchmarks. https:\/\/redis.io\/docs\/latest\/operate\/oss_and_stack\/management\/optimization\/benchmarks\/, 2024. Accessed: 2024-04-05."},{"key":"e_1_3_2_1_89_1","doi-asserted-by":"publisher","DOI":"10.1145\/1400097.1400108"},{"key":"e_1_3_2_1_90_1","first-page":"970","volume-title":"Proceedings of the Twenty-Fifth International Conference on Architectural Support for Programming Languages and Operating Systems, ASPLOS '20","author":"Shen Youren","year":"2020","unstructured":"Youren Shen, Hongliang Tian, Yu Chen, Kang Chen, Runji Wang, Yi Xu, Yubin Xia, and Shoumeng Yan. Occlum: Secure and efficient multitasking inside a single enclave of intel sgx. In Proceedings of the Twenty-Fifth International Conference on Architectural Support for Programming Languages and Operating Systems, ASPLOS '20, page 955\u2013970, New York, NY, USA, 2020. Association for Computing Machinery."},{"key":"e_1_3_2_1_91_1","first-page":"135","volume-title":"Proceedings of the Twenty-Fourth International Conference on Architectural Support for Programming Languages and Operating Systems, ASPLOS '19","author":"Shen Zhiming","year":"2019","unstructured":"Zhiming Shen, Zhen Sun, Gur-Eyal Sela, Eugene Bagdasaryan, Christina Delimitrou, Robbert Van Renesse, and Hakim Weatherspoon. X-containers: Breaking down barriers to improve performance and isolation of cloud-native containers. In Proceedings of the Twenty-Fourth International Conference on Architectural Support for Programming Languages and Operating Systems, ASPLOS '19, page 121\u2013135, New York, NY, USA, 2019. Association for Computing Machinery."},{"key":"e_1_3_2_1_92_1","volume-title":"Sofaboot: A framework for building spring boot applications with sofastack. https:\/\/github.com\/sofastack\/sofa-boot","year":"2025","unstructured":"SOFAStack. Sofaboot: A framework for building spring boot applications with sofastack. https:\/\/github.com\/sofastack\/sofa-boot, 2025. Accessed: 2025-05-15."},{"key":"e_1_3_2_1_93_1","volume-title":"What is istio ambient mode? https:\/\/www.solo.io\/topics\/istio\/ambient-mode","year":"2024","unstructured":"Solo.io. What is istio ambient mode? https:\/\/www.solo.io\/topics\/istio\/ambient-mode, 2024. Accessed: 2025-05-04."},{"key":"e_1_3_2_1_94_1","doi-asserted-by":"publisher","DOI":"10.1145\/3651890.3672221"},{"key":"e_1_3_2_1_95_1","volume-title":"Apollo: Spotify's graphql framework. https:\/\/github.com\/spotify\/apollo","year":"2023","unstructured":"Spotify. Apollo: Spotify's graphql framework. https:\/\/github.com\/spotify\/apollo, 2023. Accessed: 2025-05-15."},{"key":"e_1_3_2_1_96_1","volume-title":"How airbnb and twitter cut back on microservice complexities. https:\/\/thenewstack.io\/how-airbnb-and-twitter-cut-back-on-microservice-complexities\/","author":"Stack The New","year":"2021","unstructured":"The New Stack. How airbnb and twitter cut back on microservice complexities. https:\/\/thenewstack.io\/how-airbnb-and-twitter-cut-back-on-microservice-complexities\/, 2021. Accessed: 2025-05-15."},{"key":"e_1_3_2_1_97_1","first-page":"492","volume-title":"2020 USENIX Annual Technical Conference (USENIX ATC 20)","author":"Tian Kun","unstructured":"Kun Tian, Yu Zhang, Luwei Kang, Yan Zhao, and Yaozu Dong. coIOMMU: A virtual IOMMU with cooperative DMA buffer tracking for efficient memory management in direct I\/O. In 2020 USENIX Annual Technical Conference (USENIX ATC 20), pages 479\u2013492. USENIX Association, July 2020."},{"key":"e_1_3_2_1_98_1","doi-asserted-by":"publisher","DOI":"10.1109\/IC2E.2019.00026"},{"key":"e_1_3_2_1_99_1","doi-asserted-by":"publisher","DOI":"10.1109\/MC.2005.163"},{"key":"e_1_3_2_1_100_1","volume-title":"Virtio-fs - a shared file system for virtual machines. https:\/\/virtio-fs.gitlab.io\/","year":"2024","unstructured":"Virtio-fs. Virtio-fs - a shared file system for virtual machines. https:\/\/virtio-fs.gitlab.io\/, 2024. Accessed: 2024-06-20."},{"key":"e_1_3_2_1_101_1","unstructured":"CarlA Waldspurger. Memory resource management in vmware esx server."},{"key":"e_1_3_2_1_102_1","volume-title":"wrk: A modern http benchmarking tool. https:\/\/github.com\/wg\/wrk","author":"Walker Gil","year":"2024","unstructured":"Gil Walker. wrk: A modern http benchmarking tool. https:\/\/github.com\/wg\/wrk, 2024. Accessed: 2024-04-05."},{"key":"e_1_3_2_1_103_1","volume-title":"Apr","author":"Wang Xingyu","year":"2022","unstructured":"Xingyu Wang, Junzhao Du, and Hui Liu. Performance and isolation analysis of runc, gvisor and kata containers runtimes. Cluster Computing, page 1497\u20131513, Apr 2022."},{"key":"e_1_3_2_1_104_1","first-page":"783","volume-title":"2023 USENIX Annual Technical Conference (USENIX ATC 23)","author":"Wang Yaohui","year":"2023","unstructured":"Yaohui Wang, Ben Luo, and Yibin Shen. Efficient memory overcommitment for I\/O passthrough enabled VMs via fine-grained page meta-data management. In 2023 USENIX Annual Technical Conference (USENIX ATC 23), pages 769\u2013783, Boston, MA, July 2023. USENIX Association."},{"key":"e_1_3_2_1_105_1","doi-asserted-by":"publisher","DOI":"10.1145\/3267809.3267845"},{"key":"e_1_3_2_1_106_1","unstructured":"Gao Xiang. Enhanced read-only file system (erofs). https:\/\/www.kernel.org\/doc\/html\/latest\/filesystems\/erofs.html. Accessed: 2024-06-17."},{"key":"e_1_3_2_1_107_1","first-page":"7534","volume-title":"32nd USENIX Security Symposium (USENIX Security 23)","author":"Xiao Jietao","year":"2023","unstructured":"Jietao Xiao, Nanzi Yang, Wenbo Shen, Jinku Li, Xin Guo, Zhiqiang Dong, Fei Xie, and Jianfeng Ma. Attacks are forwarded: Breaking the isolation of MicroVM-based containers through operation forwarding. In 32nd USENIX Security Symposium (USENIX Security 23), pages 7517\u20137534, Anaheim, CA, August 2023. USENIX Association."},{"key":"e_1_3_2_1_108_1","doi-asserted-by":"publisher","DOI":"10.1145\/3460120.3484744"},{"key":"e_1_3_2_1_109_1","volume-title":"USENIX conference on Hot Topics in Cloud Ccomputing, USENIX conference on Hot Topics in Cloud Ccomputing","author":"Young Ethan G.","year":"2019","unstructured":"Ethan G. Young, Pengfei Zhu, Tyler Caraza-Harter, Andrea C. Arpaci-Dusseau, and Remzi H. Arpaci-Dusseau. The true cost of containing: A gvisor case study. USENIX conference on Hot Topics in Cloud Ccomputing, USENIX conference on Hot Topics in Cloud Ccomputing, Jan 2019."},{"key":"e_1_3_2_1_110_1","doi-asserted-by":"publisher","DOI":"10.1145\/3477132.3483569"},{"key":"e_1_3_2_1_111_1","first-page":"687","volume-title":"2023 USENIX Annual Technical Conference (USENIX ATC 23)","author":"Zhu Lingjun","year":"2023","unstructured":"Lingjun Zhu, Yifan Shen, Erci Xu, Bo Shi, Ting Fu, Shu Ma, Shuguang Chen, Zhongyu Wang, Haonan Wu, Xingyu Liao, Zhendan Yang, Zhongqing Chen, Wei Lin, Yijun Hou, Rong Liu, Chao Shi, Jiaji Zhu, and Jiesheng Wu. Deploying user-space TCP at cloud scale with LUNA. In 2023 USENIX Annual Technical Conference (USENIX ATC 23), pages 673\u2013687, Boston, MA, July 2023. USENIX Association."},{"key":"e_1_3_2_1_112_1","doi-asserted-by":"publisher","DOI":"10.1145\/3620678.3624652"}],"event":{"name":"EUROSYS '26: 21st European Conference on Computer Systems","location":"McEwan Hall\/The University of Edinburgh Edinburgh Scotland UK","acronym":"EUROSYS '26","sponsor":["SIGOPS ACM Special Interest Group on Operating Systems"]},"container-title":["Proceedings of the 21st European Conference on Computer Systems"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3767295.3769332","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,6,5]],"date-time":"2026-06-05T12:00:38Z","timestamp":1780660838000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3767295.3769332"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,4,26]]},"references-count":112,"alternative-id":["10.1145\/3767295.3769332","10.1145\/3767295"],"URL":"https:\/\/doi.org\/10.1145\/3767295.3769332","relation":{},"subject":[],"published":{"date-parts":[[2026,4,26]]},"assertion":[{"value":"2026-04-26","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}