A Security Benchmarking Framework for Empirical Evaluation of Container Confinement

This thesis presents Houdini, a modular framework for empirically testing container confinement. Houdini executes scripted tests, called tricks, inside an isolated virtual machine to observe whether features like namespaces, cgroups, seccomp, and AppArmor are enforced at runtime. By simulating container actions, Houdini reveals when isolation mechanisms silently fail. Through a series of case studies, Houdini reveals misconfigurations, enforcement failures, and security inconsistencies in container behavior across different combinations of Docker, runc, and Linux kernel versions. These case studies demonstrate how seemingly secure containers can violate isolation guarantees due to subtle interactions between runtime settings and system versions. By making container confinement observable and testable, Houdini provides a practical, empirical foundation for building and validating more secure container systems.

Name thesis:degree_name

Master of Computer Science (M.C.S.)

Level thesis:degree_level

Master's

Discipline thesis:degree_discipline

Computer Science

Grantor dc:publisher

Carleton University

Year dc:date.issued

2025

Author dc:creator

• Patel, Huzaifa Habib

Statement dc:rights

• Copyright © 2025 the author(s). Theses may be used for non-commercial research, educational, or related academic purposes only. Such uses include personal study, distribution to students, research and scholarship. Theses may only be shared by linking to the Carleton University Institutional Repository and no part may be copied without proper attribution to the author; no part may be used for commercial purposes directly or indirectly via a for-profit platform; no adaptation or derivative works are permitted without consent from the copyright owner.

Language dc:language.iso

en

DOI

10.22215/etd/2025-16752

OAI identifier oai:identifier

oai:carleton.scholaris.ca:20.500.14718/44779