Secure containers leverage hardware virtualization to isolate container sandboxes, enabling dedicated guest kernels to mitigate shared kernel attacks prevalent in traditional systems. However, existing approaches struggle with a fundamental trade-off: VM-based solutions (e.g., Kata) prioritize performance but lack elasticity and on-demand usage for volatile and bursty workloads, while lightweight methods (e.g., gVisor) rely on the host kernel for dynamic resource management at the cost of significant performance degradation due to guest-host dependencies.

Virtualization environments (e.g., containers and hypervisors) achieve isolation of multiple runtime entities but result in two mutually isolated guest and host layers. Such cross-ayer isolation could cause high latency and low throughput of the system. Previous aware scheduling and double scheduling fail to achieve bidirectional coordination between the guest and host layers. To address this challenge, we develop DCS3, a Dual-layer Co-aware Scheduler that combines stealing balance and synchronized priority. Stealing balancing migrates tasks between virtual CPU (vCPU) queues for load balance based on the workloads of physical CPUs (pCPUs). Synchronized priority dynamically adjusts the thread priorities running on the pCPUs according to the current vCPU workloads. The vCPUs and pC-PUs belong to the guest and host layers, respectively. Compared with aware scheduling, double scheduling, and DCS2 (i.e., DCS3 without synchronized priority), DCS3 has the following obvious advantages: 1) Requests Per Second (RPS) increases by up to 52%, 55%, and 2%, respectively; 2) request latency decreases by up to 72%, 71%, and 20%, respectively.

Recently, internal buffer module and multi-level parallel components have already become the standard elements of SSDs. The internal buffer module is always used as a write cache, reducing the erasures and thus improving overall performance. The multi-level parallelism is exploited to service requests in a concurrent or interleaving manner, which promotes the system throughput. These two aspects have been extensively discussed in the literature. However, current buffer algorithms cannot take full advantage of parallelism inside SSDs. In this paper, we propose a novel write buffer management scheme called Parallelism-Aware Buffer (PAB). In this scheme, the buffer is divided into two parts named as Work-Zone and Para-Zone respectively. Conventional buffer algorithms are employed in the Work-Zone, while the Para-Zone is responsible for reorganizing the requests evicted from Work-Zone according to the underlying parallelism. Simulation results show that with only a small size of Para-Zone, PAB can achieve 19.2% ~ 68.1% enhanced performance compared with LRU based on a page-mapping FTL, while this improvement scope becomes 5.6% ~ 35.6% compared with BPLRU based on the state-of-the-art block-mapping FTL known as FAST.