  Virtualization improves resource efficiency and ensures security and
performance isolation for cloud applications. To that end, operators today use
a layered architecture that runs a separate network stack instance in each VM
and container connected to a separate virtual switch. Decoupling through
layering reduces complexity, but induces performance and resource overheads
that are at odds with increasing demands for network bandwidth, communication
requirements for large distributed applications, and low latency.
  We present Virtuoso, a new software networking stack for VMs and containers.
Virtuoso performs a fundamental re-organization of the networking stack to
maximize CPU utilization, enforce isolation, and minimize networking stack
overheads. We maximize utilization by running one elastically shared network
stack instance on dedicated cores; we enforce isolation by performing central
and fine-grained per-packet resource accounting and scheduling; we reduce
overheads by building a single-layer data path with a one-shot fast-path
incorporating all processing from the TCP transport layer through network
virtualization and virtual switching. Virtuoso improves resource utilization by
up to 50%, latencies by up to 42% compared to other virtualized network stacks
without sacrificing isolation, and keeps processing overhead within 11.5% of
unvirtualized network stacks.
