RDNet: An RDMA-aware Container Network Interface for Cloud Environments

Remote Direct Memory Access (RDMA) is increasingly adopted in container-based cloud environments for its ability to deliver high-performance communication, making it essential for distributed microservices and AI workloads. However, current container network interfaces (CNIs) face two critical limitations when supporting RDMA: (i) insufficient observability of RDMA operations and (ii) lack of transparent support for legacy TCP/IP containers. RDMA’s kernel bypass nature prevents CNIs from monitoring container-level RDMA activities, hindering efficient resource monitoring and exposing multi-tenant environments to security risks. In addition, enabling RDMA for TCP/IP containers requires substantial code modifications due to the differences between RDMA verbs and socket APIs. This paper presents RDNet, a novel RDMA-aware CNI that integrates seamlessly with existing container platforms. RDNet leverages a user-space eBPF runtime to provide fine-grained RDMA observability at the container level and in-line RDMA policy enforcement with minimal overhead. For TCP/IP containers, RDNet relays traffic through a transparent RDMA proxy with eBPF-based traffic redirection, avoiding code changes while improving communication performance. Experimental results show RDNet incurs less than 5% monitoring overhead, blocks unauthorized RDMA operations, and enhances TCP/IP container throughput by up to 2× for HTTP and gRPC workloads.