Container-based Service Chaining: a Performance Perspective

Middleboxes, which implement specific network service functions - e.g. firewalls, load balancers, NATs - have traditionally been deployed as hardware appliances, thereby imposing significant constraints on network operators, who must ensure that the traffic is effectively routed to the appropriate set of middleboxes, following the right order. Being hardware-based, these boxes offer limited upgrade capabilities, i.e. minor tweaks for performance tuning. This problem becomes particularly significant in multi-tenant data centers where each tenant requires their own set of network service functions. A recent trend is to virtualize these middleboxes and turn them into so-called Virtualized Networks Functions (VNFs) that can be chained to offer the appropriate services to each tenant. When the VNFs are implemented as full-fledged virtual machines (VMs), a non-negligible overhead is added due to the kernel of each VM, and it is even more considerable when scaled up for a whole data center. Considering the industry's direction towards containerization technologies, e.g. Docker, we study the case of VNFs implemented as lightweight Linux containers. We seek to understand how performance evolves as a function of the length of chains of various services; and also of different configuration set-up, for example containers directly connected together or through Open vSwitch switches.