Achieving Isolation in Mixed-Criticality Industrial Edge Systems with Real-Time Containers (Artifact)

Real-time containers are a promising solution to reduce latencies in time-sensitive cloud systems. Recent efforts are emerging to extend their usage in industrial edge systems with mixed-criticality constraints. In these contexts, isolation becomes a major concern: a disturbance (such as timing faults or unexpected overloads) affecting a container must not impact the behavior of other containers deployed on the same hardware. In this paper, we propose a novel architectural solution to achieve isolation in real-time containers, based on real-time co-kernels, hierarchical scheduling, and time-division networking. The architecture has been implemented on Linux patched with the Xenomai co-kernel, extended with a new hierarchical scheduling policy, named SCHED_DS , and integrating the RTNet stack. Experimental results are promising in terms of overhead and latency compared to other Linux-based solutions. More importantly, the isolation of containers is guaranteed even in presence of severe co-located disturbances, such as faulty tasks (elapsing more time than declared) or high CPU, network, or I/O stress on the same machine. on Docker containers on a PREEMPT_RT -based Linux kernel, in the context of an automotive scenario. In [29] a container-based architecture for real-time automation controllers is proposed, using Docker and LXC containers on top of a Linux patched with the PREEMPT_RT real-time kernel patch. Experiments have been done using both Docker and LXC containers running on top of a Linux OS patched with the PREEMPT_RT real-time kernel patch. Tests emphasize that the use of containers for control applications can meet the requirements of the target systems.