CleanNode - Automatic containerization for secure, and efficient sanitization of compute nodes in HPC systems

High-performance computing (HPC) systems are increasingly crucial across diverse sectors, but the complexity of managing and securely sanitizing the heterogeneous resources (e.g., memory, disks, GPUs, NICs) used by jobs in these environments remains a critical challenge. Traditional sanitation methods introduce significant performance overhead and fail to handle the real-time tracking and cleaning of HPC-specific hardware efficiently. As HPC systems are including cloud-like features, the need for efficient and secure resource sanitation is growing. We propose CleanNode, a highly efficient containerization and resource management framework designed to address these problems. CleanNode will containerize, track, and sanitize job-specific resources in HPC systems in real-time, to enable secure and efficient cleaning of resources such as memory, disk, GPU, and NIC. By leveraging hardware-aware techniques and integrating sanitation seamlessly into the job scheduler, CleanNode will maintain high performance while improving system security. What are to be done in phase I. Phase I will focus on developing the core CleanNode framework and implementing efficient, hardware-specific resource tracking and cleaning methods. This includes integrating eBPF for memory cleaning, TRIM for disk sanitation, and GPU reset techniques, along with developing an on-demand cleaning verification process using DM-Verity. The system will be tested for performance impacts on memory- and compute-intensive HPC workloads to ensure negligible overhead. We will also establish secure, auditable logging mechanisms to verify the effectiveness of the resource sanitation processes. The successful development of CleanNode will have wide ranging applications in both academic and industrial HPC environments, improving security and resource management in sectors like scientific research, finance, and healthcare. CleanNode’s containerization and sanitization features will enable stronger user isolation and system security. This technology could also be adopted by cloud service providers for enhancing HPC-as-a-service offerings, which would benefit a broader range of users and improve public trust in cloud-based HPC systems.