  "Rootless containers" is a concept to run the entire container runtimes and
containers without the root privileges. It protects the host environment from
attackers exploiting container runtime vulnerabilities. However, when rootless
containers communicate with external endpoints, the network performance is low
compared to rootful containers because of the overhead of rootless networking
components. In this paper, we propose bypass4netns that accelerates TCP/IP
communications in rootless containers by bypassing slow networking components.
bypass4netns uses sockets allocated on the host. It switches sockets in
containers to the host's sockets by intercepting syscalls and injecting the
file descriptors using Seccomp. Our method with Seccomp can handle statically
linked applications that previous works could not handle. Also, we propose
high-performance rootless multi-node communication. We confirmed that rootless
containers with bypass4netns achieve more than 30x faster throughput than
rootless containers without it. In addition, we evaluated performance with
applications and it showed large improvements on some applications.
