Selecting a container runtime environment for the safe launch of external computational components of the liquid radioactive media handling simulation system for nuclear power plants

V.E. Melnikov, Yu.A. Andrienko

Abstract


This paper discusses the development of a module for connecting external calculation components (user scripts) for an automated system for digital modeling of production and process chains for handling liquid radioactive waste at nuclear power plants. The main objective of this module is the reliable and secure execution of untrusted code prepared by system users. The module is implemented on the .NET 8.0 platform using Docker containerization. To achieve optimal module performance and reliability, a comprehensive comparative study of four container runtimes was conducted: runc, sysbox-runc, gVisor (runsc), and Kata Containers (with QEMU and Cloud Hypervisor hypervisors). The evaluation was conducted based on key parameters: container start time (including the impact of placement density), CPU and RAM consumption, file system performance, and the degree of isolation. According to the experimental results, gVisor demonstrated the most balanced combination of a strengthened isolation boundary, resistance to mutual influence of containers, and moderate overhead. The experience and conclusions gained during the development and implementation of the module can be used in other engineering systems that require the secure execution of dynamically loaded or automatically generated code

Full Text:

PDF (Russian)

References


E.Jonas, Q.Pu, S.Venkataraman, I.Stoica, and B.Recht Occupy the cloud: distributed computing for the 99%, in Proc. 2017 Symposium on Cloud Computing (SoCC '17), Santa Clara, CA, USA, pp. 445–451, 2017.

A.Agache, M.Brooker, A.Iordache, A.Liguori, R.Neugebauer, P.Piwonka, and D.-M.Popa Firecracker: lightweight virtualization for serverless applications, in Proc. 17th USENIX Symposium on Networked Systems Design and Implementation (NSDI '20), Santa Clara, CA, USA, pp. 419–434, 2020.

S.Wasik, M.Antczak, J.Badura, A.Laskowski, and T.Sternal A survey on online judge systems and their applications, ACM Computing Surveys, vol. 51, no. 1, Article 3, pp. 1–34, 2018.

M.Chen, J.Tworek, H.Jun, Q.Yuan, and others Evaluating large language models trained on code, arXiv preprint arXiv:2107.03374, 2021. https://arxiv.org/abs/2107.03374

R.Rabin, J.Hostetler, S.McGregor, and others SandboxEval: Towards Securing Test Environment for Untrusted Code, arXiv preprint arXiv:2504.00018, 2025. https://arxiv.org/abs/2504.00018

runc vulnerable to container breakout through process.cwd trickery and leaked fds, CVE-2024-21626, GitHub Security Advisory GHSA-xr7r-f8xq-vfvv, Open Container Initiative, 31.01.2024. https://github.com/opencontainers/runc/security/advisories/GHSA-xr7r-f8xq-vfvv

Yu.A.Andrienko, E.S.Annenkova, V.M.Zhabitskii, M.G.Zhabitskii, O.V.Zolotareva, Yu.N.Konev, V.V.Konkov, P.A.Kuznetsova, M.Y.Kuzov, A.A.Lyubarsky, A.E.Mazurov, G.A.Povalnova, A.S.Serova, V.A.Sychev, K.V.Tsyguleva Digital Modeling Automated System for Liquid NPP Radioactive Media Treatment, International Journal of Open Information Technologies, vol. 14, no. 7, pp. 66–77, 2026.

R.Sekar, V.N.Venkatakrishnan, S.Basu, S.Bhatkar, and D.C.DuVarney Model-carrying code: a practical approach for safe execution of untrusted applications, in Proc. 19th ACM Symposium on Operating Systems Principles (SOSP '03), Bolton Landing, NY, USA, pp. 15–28, 2003. https://doi.org/10.1145/945445.945448

M.Payer, T.Hartmann, and T.R.Gross Safe loading — a foundation for secure execution of untrusted programs, in 2012 IEEE Symposium on Security and Privacy, San Francisco, CA, USA, pp. 18–32, 2012. https://doi.org/10.1109/SP.2012.11

T.Caraza-Harter and M.M.Swift Blending containers and virtual machines: a study of Firecracker and gVisor, in Proc. 16th ACM SIGPLAN/SIGOPS International Conference on Virtual Execution Environments (VEE '20), pp. 101–113, 2020.

M.G.Zhabitsky, Yu.A.Andrienko, Yu.N.Konev, G.V.Sverdlik, V.N.Malyshev The Concept of Digital Modeling Tools for Integrated Technologies at the Full Life Cycle of Innovative Industries, International Journal of Open Information Technologies, vol. 13, no. 8, pp. 41–50, 2025.

Yu.A.Andrienko, E.S.Annenkova, M.G.Zhabitsky, O.V.Zolotareva, Yu.N.Konev, V.V.Konkov, P.A.Kuznetsova, A.A.Lyubarsky, A.E.Mazurov, G.A.Povalnova, A.S.Serova, V.A.Sychev, K.V.Tsyguleva Computer Program "VERSION 1.0 ASNI", Certificate of State Registration of the Computer Program No RU 2025694053, Application No 2025692238, registration 19.11.2025, publication 03.12.2025. Copyright holder: Rosenergoatom Concern JSC.

Docker Documentation, Docker Inc. https://docs.docker.com/

Open Container Initiative Runtime Specification. https://github.com/opencontainers/runtime-spec

Nestybox Sysbox User Guide: Security. https://github.com/nestybox/sysbox/blob/master/docs/user-guide/security.md

gVisor Performance Guide, Google Open Source. https://gvisor.dev/docs/architecture_guide/performance/

gVisor Security Model, Google Open Source. https://gvisor.dev/docs/architecture_guide/security/

Kata Containers Documentation. https://katacontainers.io/

Cloud Hypervisor Documentation. https://www.cloudhypervisor.org/

R.Krebs, C.Momm, and S.Kounev Metrics and techniques for quantifying performance isolation in cloud environments, Science of Computer Programming, vol. 90, Part B, pp. 116–134, 2014. https://doi.org/10.1016/j.scico.2013.08.003

X.Wang, J.Du, and H.Liu Performance and isolation analysis of RunC, gVisor and Kata Containers runtimes, Cluster Computing, vol. 25, no. 2, pp. 1497–1513, 2022. https://doi.org/10.1007/s10586-021-03517-8

-8


Refbacks

  • There are currently no refbacks.


Abava  Кибербезопасность Monetec 2026 СНЭ

ISSN: 2307-8162