docker containerization

Containerization enhances operational efficiency but intensifies multidimensional security challenges—including runtime protection, network isolation, configuration compliance, software supply chain security, and monitoring-response capabilities. To address these, this paper proposes a five-dimensional collaborative governance model for production-grade container security, deeply integrating DevSecOps across the entire lifecycle and transcending traditional perimeter-based defense paradigms. Methodologically, the model unifies eBPF-based real-time runtime detection, OCI image signature verification, SBOM-driven supply chain auditing, zero-trust network policy enforcement, and a tightly coupled Prometheus–Falco incident response mechanism. Evaluated on mainstream cloud-native platforms, the approach reduces critical misconfigurations by 92%, shortens mean vulnerability response time to 3.7 minutes, and enables construction of a CNCF Sig-Security-certified hardened baseline—delivering a practical, layered defense framework for containerized environments.

该研究比较了Docker容器与虚拟机在架构、性能、配置和安全方面的差异，分析了两者在隔离性与效率上的权衡，并提出混合架构作为解决方案。

Research on containerization in multi-cloud environments remains fragmented, lacking a systematic, up-to-date synthesis. Method: We conduct a Systematic Mapping Study (SMS) spanning 2013–2024, analyzing 121 high-quality publications through bibliometric analysis, thematic coding, and ISO/IEC 25010 quality attribute modeling. Contribution/Results: We propose the first four-level classification framework—“Theme–Strategy–Quality Attribute–Tactic”—identifying four core research themes, 98 implementation strategies, 10 critical quality attributes, and 47 corresponding architectural tactics. Innovatively, we introduce a two-dimensional challenge-solution taxonomy organized along Security, Automation, Deployment, and Monitoring dimensions. This yields the first structured, reusable landscape of multi-cloud containerization, bridging theoretical research and industrial practice by supporting architecture design and technology selection—thereby addressing a longstanding gap in systematic knowledge integration for this domain.

Although Docker is widely assumed to ensure reproducibility of software environments, its practical efficacy remains insufficiently validated. This study presents the first systematic investigation combining a literature review with large-scale empirical analysis of 5,298 real-world GitHub projects. By reconstructing Docker images, performing differential comparisons, and mining workflow patterns, we quantitatively assess the reproducibility of Docker builds and the effectiveness of recommended best practices. Our findings reveal that a significant proportion of Docker builds are not reproducible, and existing best practices offer limited improvements in practice. These results challenge the prevailing assumption that “containers guarantee reproducibility” and provide empirical evidence and actionable insights for enhancing reproducibility in computational research.

This study addresses prolonged task completion times, low resource utilization, and high resource release latency in Docker/Kubernetes containers on cloud-native platforms running compute-intensive workloads (e.g., big data and deep learning). We systematically evaluate the performance impact of diverse resource scheduling strategies through system-level monitoring—leveraging cgroups and metrics-server—and multi-workload stress testing. For the first time, we empirically quantify how key resource configurations significantly affect task completion time (±79.4% variation) and resource release latency (+116.7% degradation). Based on these findings, we propose an evidence-driven configuration optimization paradigm that reduces maximum task completion time by up to 79.4% and precisely identifies configuration bottlenecks responsible for latency. Our results provide reproducible, transferable empirical foundations for resource management tuning and deployment decisions in cloud-native environments.

研究探讨了保护Docker容器和Kubernetes Pod免受中间人攻击的方法，通过使用通信和加密原语的概念模型、AnBxJ Java安全库及七层防火墙，并基于系统性审查提出了零信任架构。

This study addresses the limited understanding of containerization practices in machine learning (ML) projects, particularly the lack of systematic investigation into how iterative ML workflows affect Docker image size, build performance, and caching behavior. Through a large-scale empirical analysis of Dockerfiles from 1,993 open-source ML projects—integrating static parsing, build log tracing, cache behavior monitoring, and semantic mining of code commits—the work reveals ML-specific container usage patterns and proposes seven ML-tailored Dockerfile refactoring strategies. The findings show that ML images average 10.27 GB in size and require 8.84 minutes to build; 44.4% of commits trigger rebuilds, with 96.4% caused by context changes and 71% exhibiting computational redundancy. The proposed methods substantially reduce image size and improve build efficiency.

Container technologies are widely adopted, yet their full lifecycle entails significant security risks; existing software engineering literature lacks systematic, empirically grounded integration of container security knowledge. To address this gap, we conducted a systematic mapping study (SMS) complemented by bibliometric analysis and thematic coding across 129 empirical studies. Our work introduces the first structured, evidence-based taxonomy of security risks for containerized systems—identifying 23 core risk categories and vulnerabilities, explicating their root causes and impacts, and synthesizing reusable mitigation strategies. Additionally, we catalog 47 security practices and tools. The taxonomy enables cross-phase risk mapping—from development through deployment—and integrates fragmented knowledge into a coherent framework. It establishes a theoretical benchmark for container security research and delivers actionable, engineering-oriented guidance for practitioners.

本文提出一种自动化六阶段流程，通过语义聚类等方法发现企业内部安全的Dockerfile参考标准，以解决容器镜像的安全配置错误问题。

This study addresses the lack of systematic empirical investigation into how heterogeneous infrastructure affects Docker container startup latency—a critical gap that hinders performance optimization in CI/CD and serverless systems. For the first time, the container startup process is decomposed into fine-grained, quantifiable operations. Through 50 rounds of multidimensional benchmarking across three real-world heterogeneous environments—cloud SSD, cloud HDD, and macOS Docker Desktop—the work integrates key technologies including OverlayFS, Linux namespaces, volume mounts, and CPU throttling. The findings reveal several counterintuitive insights: runtime overhead dominates startup time, while image size has negligible impact (only 2.5% variation); HDDs incur 2.04× higher latency, Docker Desktop imposes a 2.69× penalty, and OverlayFS write performance degrades by two orders of magnitude. The complete toolchain and dataset are publicly released.