信息安全研究2026，Vol.12Issue(1)：2-15,14.DOI:10.12379/j.issn.2096-1057.2026.01.01
基于系统调用隔离的安全容器研究综述
Review of Secure Containers Based on System Call Isolation
摘要
Abstract
This article elucidates the research progress in enhancing container security through the isolation of system calls.The article firstly outlines the development background of containerization technology and its major security challenges.Subsequently,an in-depth analysis is conducted on the role of system call isolation in enhancing the security of containers,including the techniques of limiting the system calls of containerized applications to reduce the attack surface,and leveraging operating system middleware and hardware protection mechanisms to accomplish the isolation and protection of containers.By comparing the implementation principles,performance,and their effects on isolation,reduction of attack surfaces,and data protection,the article reveals the advantages and limitations of system call isolation technologies in enhancing container security.关键词
安全容器/系统调用/隔离/Seccomp BPF/操作系统中间件/硬件保护机制Key words
secure container/system call/isolation/Seccomp BPF/operating system middleware/hardware protection mechanism分类
信息技术与安全科学引用本文复制引用
Zhang Tian,Zhang Jie,Liu Weijie,Liu Ximeng..基于系统调用隔离的安全容器研究综述[J].信息安全研究,2026,12(1):2-15,14.基金项目
国家自然科学基金项目(62072109) （62072109）
福建省自然科学基金项目(2021J06013) （2021J06013）
天津市自然科学基金青年项目(24JCQNJC02140) （24JCQNJC02140）
