  We propose xRAC to permit users to run special applications on managed hosts
and to grant them access to protected network resources. We use restricted
application containers (RACs) for that purpose. A RAC is a virtualization
container with only a selected set of applications. Authentication verifies the
RAC user's identity and the integrity of the RAC image. If the user is
permitted to use the RAC on a managed host, launching the RAC is authorized and
access to protected network resources may be given, e.g., to internal networks,
servers, or the Internet. xRAC simplifies traffic control as the traffic of a
RAC has a unique IPv6 address so that it can be easily identified in the
network. The architecture of xRAC reuses standard technologies, protocols, and
infrastructure. Those are the Docker virtualization platform and 802.1X
including EAP-over-UDP and RADIUS. Thus, xRAC improves network security without
modifying core parts of applications, hosts, and infrastructure. In this paper,
we review the technological background of xRAC, explain its architecture,
discuss selected use cases, and investigate on the performance. To demonstrate
the feasibility of xRAC, we implement it based on standard components with only
a few modifications. Finally, we validate xRAC through experiments.
