摘要： 随着容器技术在生产环境中的广泛应用，其安全隔离机制的不足逐渐显现。提出一种基于Linux安全模块框架(Linux Security Modules, LSM)的容器多级安全隔离模型，通过定义容器化的主体与客体，引入安全标签对容器进程和文件资源进行分类标记，构建细粒度的强制访问控制策略。在此基础上，开发了DLSM(Docker LSM)原型系统，从容器进程隔离和共享数据卷隔离两个层面强化防护：限制容器对宿主机关键目录及其他容器文件系统的访问路径，防范越权与逃逸风险；对共享数据卷实施分组管理与权限分级，避免数据泄露或篡改。与SELinux、AppArmor等方案的对比实验表明，DLSM在拦截容器逃逸、敏感目录挂载及跨容器通信等攻击场景中均实现100%拦截成功率，且各项性能开销控制在5%以内，是一种兼顾安全与效率的容器隔离方案。

中图分类号：TP309文献标志码：ADOI:10.19358/j.issn.2097-1788.2026.05.002
中文引用格式：熊明俊,郭培馨.基于LSM的容器多级安全隔离系统设计与优化［J］.网络安全与数据治理，2026，45（5）：11-17.
英文引用格式：Xiong Mingjun, Guo Peixin. Design and optimization of multi-level security isolation system for containers based on LSM［J］.Cyber Security and Data Governance，2026，45（5）：11-17.

Design and optimization of multi-level security isolation system for containers based on LSM

Abstract： With the widespread adoption of container technology in production environments, deficiencies in security isolation mechanisms have become increasingly apparent. This paper proposes a multi-level security isolation model for containers based on the Linux Security Modules (LSM) framework. The model constructs fine-grained Mandatory Access Control (MAC) policies by defining containerized subjects and objects and introducing security labels to classify container processes and file resources. A Docker LSM (DLSM) prototype system is developed to strengthen protection at two levels: restricting container access to host critical directories and other container file systems to prevent privilege escalation and escape, and implementing grouped management with permission grading for shared data volumes to prevent data leakage or tampering. Comparative experiments with SELinux and AppArmor demonstrate that DLSM achieves a 100% interception rate in across container escape, sensitive directory mounting, and cross-container communication attack scenarios, with performance overhead kept below 5%, providing an effective solution balancing container security and efficiency.

Key words : container isolation; multi-level security; mandatory access control; LSM; Docker