From 300a7b60e124f6632f23bdafd499d153a0fe361c Mon Sep 17 00:00:00 2001 From: Fabricio Voznika Date: Sat, 28 Apr 2018 10:43:43 -0700 Subject: Update Images PiperOrigin-RevId: 194661880 Change-Id: I2acdd63164de9a9652a00a70ee9a5d5cf5294a4d --- README.md | 8 +- g3doc/Layers.png | Bin 20778 -> 11044 bytes g3doc/Layers.svg | 317 +----------------------------------- g3doc/Machine-Virtualization.png | Bin 32237 -> 13205 bytes g3doc/Machine-Virtualization.svg | 343 +-------------------------------------- g3doc/Rule-Based-Execution.png | Bin 17585 -> 6780 bytes g3doc/Rule-Based-Execution.svg | 224 +------------------------ g3doc/Sentry-Gofer.png | Bin 19144 -> 8966 bytes g3doc/Sentry-Gofer.svg | 333 +------------------------------------ 9 files changed, 8 insertions(+), 1217 deletions(-) diff --git a/README.md b/README.md index 761226b6f..3b8ad1857 100644 --- a/README.md +++ b/README.md @@ -36,7 +36,7 @@ Two other approaches are commonly taken to provide stronger isolation than native containers. ![Machine-level virtualization](g3doc/Machine-Virtualization.png "Machine-level -virtualization") +virtualization"){style="display:block;margin:auto"} **Machine-level virtualization**, such as [KVM][kvm] and [Xen][xen], exposes virtualized hardware to a guest kernel via a Virtual Machine Monitor (VMM). This @@ -48,7 +48,7 @@ performance (though nested virtualization may bring challenges in this area), but for containers it often requires additional proxies and agents, and may require a larger resource footprint and slower start-up times. -![Rule-based execution](g3doc/Rule-Based-Execution.png "Rule-based execution") +![Rule-based execution](g3doc/Rule-Based-Execution.png "Rule-based execution"){style="display:block;margin:auto"} **Rule-based execution**, such as [seccomp][seccomp], [SELinux][selinux] and [AppArmor][apparmor], allows the specification of a fine-grained security policy @@ -63,7 +63,7 @@ making this approach challenging to apply universally. Rule-based execution is often combined with additional layers for defense-in-depth. -![gVisor](g3doc/Layers.png "gVisor") +![gVisor](g3doc/Layers.png "gVisor"){style="display:block;margin:auto"} **gVisor** provides a third isolation mechanism, distinct from those mentioned above. @@ -107,7 +107,7 @@ application to directly control the system calls it makes. ### File System Access -![Sentry](g3doc/Sentry-Gofer.png) +![Sentry](g3doc/Sentry-Gofer.png){style="display:block;margin:auto"} In order to provide defense-in-depth and limit the host system surface, the gVisor container runtime is normally split into two separate processes. First, diff --git a/g3doc/Layers.png b/g3doc/Layers.png index 46d9a8574..308c6c451 100644 Binary files a/g3doc/Layers.png and b/g3doc/Layers.png differ diff --git a/g3doc/Layers.svg b/g3doc/Layers.svg index cace8a176..0a366f841 100644 --- a/g3doc/Layers.svg +++ b/g3doc/Layers.svg @@ -1,316 +1 @@ - - - - - - image/svg+xml - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - gVisor - - - - - - - + \ No newline at end of file diff --git a/g3doc/Machine-Virtualization.png b/g3doc/Machine-Virtualization.png index 086755c64..1ba2ed6b2 100644 Binary files a/g3doc/Machine-Virtualization.png and b/g3doc/Machine-Virtualization.png differ diff --git a/g3doc/Machine-Virtualization.svg b/g3doc/Machine-Virtualization.svg index d677f6ee5..5352da07b 100644 --- a/g3doc/Machine-Virtualization.svg +++ b/g3doc/Machine-Virtualization.svg @@ -1,342 +1 @@ - - - - - - image/svg+xml - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + \ No newline at end of file diff --git a/g3doc/Rule-Based-Execution.png b/g3doc/Rule-Based-Execution.png index b84a2e0f6..b42654a90 100644 Binary files a/g3doc/Rule-Based-Execution.png and b/g3doc/Rule-Based-Execution.png differ diff --git a/g3doc/Rule-Based-Execution.svg b/g3doc/Rule-Based-Execution.svg index 9ad336685..bd6717043 100644 --- a/g3doc/Rule-Based-Execution.svg +++ b/g3doc/Rule-Based-Execution.svg @@ -1,223 +1 @@ - - - - - - image/svg+xml - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + \ No newline at end of file diff --git a/g3doc/Sentry-Gofer.png b/g3doc/Sentry-Gofer.png index 0b8206829..589ab3734 100644 Binary files a/g3doc/Sentry-Gofer.png and b/g3doc/Sentry-Gofer.png differ diff --git a/g3doc/Sentry-Gofer.svg b/g3doc/Sentry-Gofer.svg index bfb313c0b..76a012736 100644 --- a/g3doc/Sentry-Gofer.svg +++ b/g3doc/Sentry-Gofer.svg @@ -1,332 +1 @@ - - - - - - image/svg+xml - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + \ No newline at end of file -- cgit v1.2.3