In the last years, many projects have been developed to increase security and isolation in the cloud and containers, such as Kata Containers, Nitro Enclaves, and libkrun. All these projects leverage Linux KVM (Kernel-based virtual machines) to create a more isolated environment. They use VM sockets (vsock) to provide a communication channel between constrained and less constrained worlds, reducing the attack surface.

These VM sockets are provided by the AF_VSOCK address family and the virtio-vsock device. They offer a very simple configuration and the possibility to use POSIX sockets to communicate between hosts and VMs.

Andra and Stefano will give a brief introduction of AF_VSOCK and virtio-vsock. Then they will illustrate how the projects and features, mentioned at the beginning, use VM sockets. They will present a couple of demos to explain how to use several tools for easier debugging and performance evaluation of vsock.

At the end, they will share an overview of a set of new features such as namespaces, multiqueue, and shared memory. These are planned as future work to further grow the ecosystem for virtio-vsock.