Abstract: This article elucidates the research progress in enhancing container security through the isolation of system calls. The article firstly outlines the development background of containerization technology and its major security challenges. Subsequently, an indepth analysis is conducted on the role of system call isolation in enhancing the security of containers, including the techniques of limiting the system calls of containerized applications to reduce the attack surface, and leveraging operating system middleware and hardware protection mechanisms to accomplish the isolation and protection of containers. By comparing the implementation principles, performance, and their effects on isolation, reduction of attack surfaces, and data protection, the article reveals the advantages and limitations of system call isolation technologies in enhancing container security.

Key words: secure container, system call, isolation, Seccomp BPF, operating system middleware, hardware protection mechanism

摘要： 阐述了基于系统调用隔离增强容器安全性的研究进展.首先概述了容器技术的发展背景及其面临的主要安全挑战，随后深入分析了系统调用隔离在提升容器安全性中的作用，包括限制容器应用程序的系统调用以减少攻击面、使用操作系统中间件和硬件保护机制等技术实现对容器的隔离和保护.通过比较这些技术的实现原理、性能以及它们在隔离性、减少攻击面和数据保护方面的效果，揭示了系统调用隔离技术在提升容器安全性方面的优势和局限.

关键词: 安全容器, 系统调用, 隔离, Seccomp BPF, 操作系统中间件, 硬件保护机制