CoreOS Inc.’s Rocket container runtime recently emerged from nowhere to become the biggest rival to Docker Inc.’s better known container technology, and in spite of a new initiative to create a common body of standards for software containers, the former upstart isn’t about to take its foot off the pedal any time soon.

At LinuxCon 2015 yesterday, CoreOS announced version 0.8 of Rocket (rkt), an alternative container system that borrows many of Docker’s features. However, with the new release, Rocket adds Intel-built features that support hardware-enhanced virtualization, a feature not found in any other container technology.

According to CoreOS, Rocket 0.8’s new features are derived from Intel’s Clear Containers project, which draws on the VT-x instruction sets in Intel’s chips to add hardware isolation to Rocket containers.

As opposed to the default Rocket runtime engine, Intel’s contribution launches container images as full KVM virtual machines, rather than firing up containers using Linux kernel-based sandbox technologies. The approach uses more system resources than regular Linux containers, but the benefit comes with the same kind of enhanced security found in hypervisors. In addition, Intel reckons its VT-x instruction sets minimize performance overheads.

“By optimizing the heck out of the Linux boot process, we have shown that Linux can boot with the security normally associated with virtual machines, almost as quickly as a traditional container,” said Intel’s Arjan Van De Ven in a blog post. “Thus we combine security rooted in hardware, via Intel Virtualization Technology (VT-x), with the development and deployment benefits which have caused application developers to gravitate to containers. Problem solved.”

Such isolation might seem over-the-top, but container security remains a big concern because technologies like cgroups and namespaces do not provide any isolation. But in a multitenant environment, the issue of isolation can be vital to security.

It remains to be seen if Rocket’s new features will be adopted by the Open Container Initiative (OCI), and therefore Docker.

“Today rkt is an implementation of the App Container spec (appc), and in the future we hope to make rkt an implementation of the Open Container Initiative (OCI) specification,” CoreOS’ Brandon Philips said. “However, the OCI effort is still in its infancy and there is a lot of work left to do.”

Image credit: WikiImages via pixabay.com