![](\"https:\/\/cdn.pblzr.de\/dacbb27c-1270-4041-b681-e2b95f06f8a1\/2025\/07\/barkhauseninstitut-logo-400x300_TEXT.jpg\"){kind=logo}
<\/p>\n<\/p>\n
When we use online services such as social networks, online banking or video streaming, we access program code via the internet that is executed on servers in a data center. Programs from different users run in parallel on the same server. A standard operating system such as Linux is usually used for this. A central problem is that the security of Linux must be specifically strengthened for use in such server environments. This is precisely where container technologies come in. They isolate applications and processes within a common operating system. To do this, they use security mechanisms such as seccomp, namespaces and cgroups. However, these additions increase the complexity of the overall system and therefore also potentially increase the attack surface. In the worst-case scenario, this can even jeopardize security rather than improve it.<\/p>\n
We use a system based on the L4Re microkernel instead of Linux. In contrast to Linux, this offers strong security features by design and does not require additional protection mechanisms to be retrofitted. However, microkernels have not yet been used for typical server hardware and with workloads that are typical for data centers. Therefore, we have not only designed and implemented a container environment for micro cores, but also made numerous performance optimizations. In this way, microkernels become suitable for use in data centers. <\/p>\n
Our development creates an execution environment for server programs that offers a significant security gain over Linux through the use of a microkernel. Data centers can thus be better protected against attacks. At the same time, the L4Re system now provides a domestic solution that can also strengthen digital sovereignty in the data center sector.<\/p>\n
MettEagle: Costs and Benefits of Implementing Containers on Microkernels
Till Miemietz, Viktor Reusch, and Matthias Hille, Barkhausen Institute; Lars Wrenger, Leibniz University Hannover; Jana Eisoldt, Barkhausen Institute; Jan Kl\u00f6tzke, Kernkonzept GmbH; Max Kurze, Technische Universit\u00e4t Dresden; Adam Lackorzynski, Technische Universit\u00e4t Dresden and Kernkonzept GmbH; Michael Roitzsch, Barkhausen Institut; Hermann H\u00e4rtig, Barkhausen Institut and Technische Universit\u00e4t Dresden<\/p>\n
– – – – – –<\/p>\n