Sign inDemoInstall

Package Overview
File Explorer

Install Socket

Protect your apps from supply chain attacks



Version published


# Accelerated Container Image

Accelerated Container Image is an open-source implementation of paper **["DADI: Block-Level Image Service for Agile and Elastic Application Deployment. USENIX ATC'20"](**.

DADI (Data Accelerator for Disaggregated Infrastructure) is a solution for container acceleration including remote image and other features which has been widely used in Alibaba and Alibaba Cloud. By now, it has been already integrated by **Alibaba Cloud Registry (ACR)**, and **Alibaba serverless services (FC [FaaSNet. USENIX ATC'21]( / SAE / ECI, etc)** which enter **the Forrester leader quadrant**.

At the heart of the acceleration is overlaybd, which is a new remote image format based on block device. Overlaybd backstore provides a merged view of a sequence of block-based layers in userspace and outputs as a virtual blocks device through [TCMU](
It can be used for container acceleration by supporting fetching image data on-demand without downloading and unpacking the whole image before a container running. With overlaybd image format, we can cold start a container instantly.

The key features are:

* **High Performance**

    It's a block-device-based storage of OCI image, which has much lower complexity than filesystem-based implementations. For example, cross-layer hardlink and non-copy commands like chown are very complex for filesystem-based image without copying up, but is natively supported by overlaybd. Overlaybd outperforms filesystem-based solutions in performance. Evaluation data is stated in [DADI paper](

* **High Reliability**

    Overlaybd outputs virtual block devices through TCMU, which is widely used and supported in most operation systems. Overlaybd backstore can recover from failures or crashes, which is difficult for FUSE-based image formats.

* **[Native Support for Writable](docs/**

    Overlaybd can be used as writable/container layer. It can be used as container layer for runtime instead of overlayfs upper layer, or used to build overlaybd images.

* **[Multiple File System Supported](docs/**

    Overlaybd outputs virtual block devices, which is supported to be formatted by multiple file system. It's convenient for user to choose ideal file system.

Accelerated Container Image is a __non-core__ sub-project of containerd.

## Components

* [overlaybd - Native](

    Overlaybd provides a merged view of block-based layer sequence as an virtual block device in user space.

* overlaybd-snapshotter

    It is a [containerd]( snapshotter plugin for overlaybd image. This snapshotter is compatible for OCI image, as well as overlayfs snapshotter.

* embedded image-convertor

    We provide a modified CLI tool(ctr) to facilitate image pull, and custom conversion from traditional OCI tarball format to overlaybd format.

    The convertor supports layer deduplication, which prevents duplication of layer conversion for every image conversion.

* standalone userspace image-convertor

    Standalone userspace image-convertor has similar functionality to embedded image-convertor but runs in the userspace. It does not require root privilege and dependence on tcmu, configfs, snapshotter, or even on containerd. which makes it much more convenient to run in a container.

    What's more, standalone userspace image-convertor is faster than embedded image-convertor when used with our [customized libext2fs]( See [USERSPACE_CONVERTOR]( for more details.

* [buildkit for overlaybd]( (Experimental)

    It is a customized buildkit for overlaybd images. It fetches the data of base images on demand without pulling whole data and uses overlaybd writable layer to build new layers.

* [overlaybd - turboOCIv1](docs/

    It is an overlaybd-based remote image format which enables the original OCI image to be a remote one without conversion. It is similar to [SOCI](, but provides block device interface, which has advantages than FUSE-based formats in performance and stability.

## Getting Started

* [QUICKSTART](docs/ helps quickly run an overlaybd image including basic usage.

* See how to setup overlaybd backstore at [README](

* See how to build snaphshotter and ctr plugin components at [BUILDING](docs/

* After build or install, see our [EXAMPLES](docs/ about how to run an accelerated container. see [EXAMPLES_CRI](docs/ if you run containers by k8s/cri.

* See the [PERFORMANCE](docs/ test about the acceleration.

* See how to convert OCI image into overlaybd with specified file system at [MULTI_FS_SUPPORT](docs/

* See how to use layer deduplication for image conversion at [IMAGE_CONVERTOR](docs/

* See how to use overlaybd writable layer at [WRITABLE](docs/

* See how to use Prometheus to monitor metrics like latency/error count of snapshotter GRPC APIs at [PROMETHEUS](docs/

* See how to use TurboOCIv1 at [TurboOCIv1](docs/

* Welcome to contribute! [CONTRIBUTING](docs/

## Release Version Support

There will be an annotation `` in the manifest of the converted image to specify the format version, following is the
overlaybd release version required by them.

* `0.1.0`: for now, all release versions of overlaybd support this.

* `0.1.0-turbo.ociv1`: overlaybd >= v0.6.10

## Overview

With OCI image spec, an image layer blob is saved as a tarball on the registry, describing the [changeset]( based on it's previous layer. However, tarball is not designed to be seekable and random access is not supported. Complete downloading of all blobs is always necessary before bringing up a container.

An overlaybd blob is a collection of modified data blocks under the filesystem and corresponding to the files added, modified or deleted by the layer. The overlaybd backstore is used to provide the merged view of layers and provides a virtual block device. Filesystem is mounted on top of the device and an overlaybd blob can be accessed randomly and supports on-demond reading natively.

![image data flow](docs/images/image-flow.jpg "image data flow")

The raw data of block differences, together with an index to the raw data, constitute the overlaybd blob. When attaching and mounting an overlaybd device, only indexes of each layer are loaded from remote, and stored in memory. For data reading, overlaybd performs a range lookup in the index to find out where in the blob to read and then performs a remote fetching. That blob is in Zfile format.

Zfile is a new compression file format to support seekable decompression, which can reduce storage and transmission costs. And also the checksum information to protect against data corruptions for on-demand reading is stored in Zfile. In order to be compatible with existing registries and container engines, Zfile is wrapped by a tar file, which has only one Zfile inside.

![io-path](docs/images/io-path.png "io-path")

Overlaybd connects with applications through a filesystem mounted on an virtual block device. Overlaybd is agnostic to the choice of filesystem so users can select one that best fits their needs. I/O requests go from applications to a regular filesystem such as ext4. From there they go to the loopback device (through TCM_loopback) and then to the user space overlaybd backstore (through TCMU). Backend read operations are always on layer files. Some of the layer files may have already been downloaded, so these reads would hit local filesystem. Other reads will be directed to registry, or hit the registry cache. Write and trim operations are handled by overlaybd backstore which writes the data and index files of the writable layer to the local file system. For more details, see the [paper](

## Communication
For async communication and long running discussions please use issues and pull requests on the github repo. This will be the best place to discuss design and implementation.

For sync communication catch us in the #overlaybd slack channels on Cloud Native Computing Foundation's (CNCF) slack - Everyone is welcome to join and chat. [Get Invite to CNCF slack.](

## Licenses

Accelerated Container Image is released under the Apache License, Version 2.0.


Last updated on 24 Nov 2023

Did you know?

Socket installs a GitHub app to automatically flag issues on every pull request and report the health of your dependencies. Find out what is inside your node modules and prevent malicious activity before you update the dependencies.


Related posts

SocketSocket SOC 2 Logo


  • Package Alerts
  • Integrations
  • Docs
  • Pricing
  • FAQ
  • Roadmap

Stay in touch

Get open source security insights delivered straight into your inbox.

  • Terms
  • Privacy
  • Security

Made with ⚡️ by Socket Inc