cells（14）

Figure 1 provides an overview of the Cells system architecture. We describe Cells using Android since our prototype is based on it. Each VP runs a stock Android user space environment. Cells leverages lightweight OS virtualization [3, 23] to isolate VPs from one another. Cells uses a single OS kernel across all VPs that virtualizes identifiers, kernel interfaces, and hardware resources such that several execution environments can exist side-by-side in virtual OS sandboxes. Each VP has its own private virtual namespace so that VPs can run concurrently and use the same OS resource names inside their respective namespaces, yet be isolated from and not conflict with each other. This is done by transparently remapping OS resource identifiers to virtual ones that are used by processes within each VP. File system paths, process identifiers (PIDs), IPC identifiers, network interface names, and user names (UIDs) must all be virtualized to prevent conflicts and ensure that processes running in one VP cannot see processes in other VPs. The Linux kernel, including the version used by Android, provides virtualization for these identifiers through namespaces [3]. For example: the file system (FS) is virtualized using mount namespaces that allow different independent views of the FS and provide isolated private FS jails for VPs [16].

图1提供了Cells系统架构的总揽。我们用android来描述Cells因为我们的原型是基于android的。每个VP跑一个android用户空间环境。Cells修改轻量级OS虚拟化来进行VP隔离。Cells让所有的VP使用一个OS内核，VP来虚拟出标示符，内核接口和硬件资源，因此几个可执行环境可以在虚拟OS沙盒中并列存在。每个VP有他自己的私有虚拟名字空间，因此VP可以一起跑，并且在各自的名字空间使用相同的OS资源名字，它们被隔离并彼此不冲突。这是通过明显的重映射OS资源标示符到每个VP中的进程使用的虚拟的资源。文件系统路径，进程标示符（PID），IPC标示符，网络接口名字，和用户名字（UID）必须全部被虚拟化来避免冲突，保证在一个VP里跑的进程看不到其他VP里跑的进程。Linux内核，包括android使用的版本，提供通过名字空间来虚拟化这些标示符。