关键词: 容器, MNT名字空间, 文件名加密, 随机化

Abstract: As a virtualization technology of operating system layer, container is widely considered to be the top resources utilization rate virtualization method, MNT name space is an important technology for container file system isolation, but procfs and sysfs file system does not support namespace, there is the risk of information leakage. In view of the insufficiency of MNT name space, this paper puts forward and realizes the randomization of MNT name space. The work process is created by modifying the Linux MNT namespace, AES encryption methods are used for filename/directory processing, using the name space can see the process of fuzzy file directory tree, shielding of the directory. The experimental results show that the method can effective prevent scanning software from attacking on enumeration directory and specific sensitive files, and performance loss is small, only increases about 1.82% of the operating expenses.

Key words: container, mount namespace（MNT namespace）, filename encryption, randomization