Fahad Shaon
SWE working in Google Cloud BigQuery.
Previously worked on Google Cloud Filesolutions team. Formerly, led a research startup building secure big data platforms. Earned a Ph.D. in Computer Science from UT Dallas focusing on building secure data analytics systems using trusted hardware.
Research Areas
Authored Publications
Sort By
Evaluating Container Debloaters
Muhammad Hassan
Talha Tahir
Muhammad Farrukh
Abdullah Naveed
Anas Naeem
Fareed Zaffar
Ashish Gehani
Sazzadur Rahaman
IEEE Secure Development Conference, SecDev 2023
Preview abstract
Docker containers have been widely used by organizations because they are lightweight and single hardware can run multiple instances of a container. However, this ease of virtualization comes with weaker isolation as compared to virtual machines. A compromised container can allow the attacker to escape to the host and gain privileged access. Several approaches have been developed to reduce the attack surface of containers either through the reduction of system calls or through slimming container images. Unfortunately, measuring the performance of container debloaters is challenging as there exists no platform for this purpose. This paper aims to address this gap, by building a unified platform to benchmark them.
Currently, our benchmark includes 7 workload applications, and 3 container debloaters, i.e., Speaker, Confine (syscalls reduction tools), and Slimtoolkit (image size reduction tool). We added several evaluation metrics in the framework, which include category-based system call reduction, CVEs mitigated, size reduction, and execution correctness.
Our evaluation revealed interesting insights into the existing techniques. Both the system call reduction tools were able to produce correct debloated containers as compared to Slimtoolkit (tool to reduce image size) which worked well too by reducing almost 79 percent of the size of the image but it failed to produce correct results on 2 out of 7 applications.
View details
