Due to its rising carbon footprint, new paradigms for carbon-efficient computing are needed. For distributed computing systems, one option is to shift computing loads in space or time to take advantage of low-carbon electricity, a paradigm known as carbon-aware computing. We present a literature review of carbon-aware scheduling techniques, which shows that most of the literature carried out either spatial or temporal shifting but not both. Of the 28 analyzed studies, 11 considered both spatial and temporal shifting, and only 2 developed a combined optimization algorithm. Additionally, existing approaches typically focus on operational electricity alone. With the growing decarbonization of electricity, however, device production (which involves various industrial processes and cannot be easily decarbonized) is bound to become more relevant and needs to be considered. We thus suggest a novel spatio-temporal scheduling algorithm for cloud and edge computing. Our algorithm performs simultaneous spatio-temporal shifting while taking into consideration both device production and operation. As temporal shifting requires forecasts of future workloads, we also put forward a workload predictor. Although not fully implemented yet, we bring various theoretical arguments in support of our proposed algorithm.

Kubernetes (K8s) has grown in popularity over the past few years to become the de-facto standard for container orchestration in cloud-native environments. While research is not new to topics such as containerization and access control security, the Application Programming Interface (API) interactions between K8s and its runtime interfaces have not been studied thoroughly. In particular, the CRI-API is responsible for abstracting the container runtime, managing the creation and lifecycle of containers along with the downloads of the respective images. However, this decoupling of concerns and the abstraction of the container runtime renders K8s unaware of the status of the downloading process of the container images, obstructing the monitoring of the resources allocated to such process. In this paper, we discuss how this lack of status information can be exploited as a Denial of Service attack in a K8s cluster. We show how such attacks can impact worker nodes, generating up to 95% average CPU usage, prevent downloads of new container images, and increase I/O and network usage for a potentially unlimited amount of time.We argue that solving this problem would require a radical architectural change in the relationship between K8s and the CRI-API, which would be unfeasible in the short term. Thus, as a stopgap solution, we propose MAGI: an eBPF-based, proof-of-concept mitigation that detects and terminates potential attacks.