  With the ever-increasing pervasiveness of the cloud computing paradigm,
strong isolation guarantees and low performance overhead from isolation
platforms are paramount. An ideal isolation platform offers both: an
impermeable isolation boundary while imposing a negligible performance
overhead. In this paper, we examine various isolation platforms (containers,
secure containers, hypervisors, unikernels), and conduct a wide array of
experiments to measure the performance overhead and degree of isolation offered
by the platforms. We find that container platforms have the best, near-native,
performance while the newly emerging secure containers suffer from various
overheads. The highest degree of isolation is achieved by unikernels, closely
followed by traditional containers.
