Manuela Capano
email: capano@cerege.fr

Nicoletta Martinelli

Marco Baioni

Thibaut Tuna

Mauro Bernabei

Edouard Bard

Is the dating of short tree-ring series still a challenge? New evidence from the pile dwelling of Lucone di Polpenazze (northern Italy)

Keywords: short tree-ring series, dendrochronology, dendrotypology, annual 14 C calibration curve, woodland management, Bronze Age

ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

The context of this study is the Alpine pile-dwelling phenomenon, spanning 6 countries around the Alps, where pile-dwelling villages were inhabited during a wide temporal range, i.e. from the Neolithic to the Iron Age (from about 5000 to 500 BC). Due to the substantial amount of wooden material discovered in these sites, a very precise chronology of settlement development is available in those countries having undertaken extensive archaeological excavations for which multi-millennial reference curves are available (e.g. France, Germany and Switzerland). However, dendrochronological analysis has also highlighted other aspects of ancient human life, such as the interaction of these early peoples with their environment. This topic has been widely addressed using dendrotypology. The technique consists of the analysis of several parameters of tree-ring series, both forestry-related (cambial age, growth trend, trunk diameter) and techno-morphology-related (tree species, proportion of sapwood, degree and type of stem conversion; [START_REF] Billamboz | Applying dendro-typology to large timber series[END_REF].

Dendrotypology has been widely employed in the study of pile dwellings of Southern Germany by André Billamboz, who developed the model for its utilization [START_REF] Billamboz | Applying dendro-typology to large timber series[END_REF]. The first step of the analysis consists in grouping the tree-ring series according to the above-mentioned parameters, which allows the building of dendrogroups (DGs). When applying dendrotypology to large sample series, it is possible to link DGs to the history of forestry practices. A recurrent problem encountered has been the dating of posts exhibiting short tree-ring series, which are difficult to match against site and reference chronologies [START_REF] Billamboz | Dealing with heteroconnections and short tree-ring series at different levels of dating in the dendrochronology of the Southwest German pile-dwellings[END_REF][START_REF] Trouet | Dendro-archeoecology in North America and Europe: Re-purposing Historical Materials to Study Ancient Human-Environment Interactions[END_REF].

We investigate this task in a pile-dwelling settlement in Northern Italy, Lucone D, dated to the Early Bronze Age (EBA). Two main problems hamper research at this site and at all prehistoric pile-dwelling sites of Northern Italy where oak is the main exploited wood. Firstly, there are no existing oak multi-millennial reference chronologies for the region and attempts to teleconnect the floating chronologies with references from regions north of the Alps have usually been unsuccessful [START_REF] Haneca | Oaks, tree-rings and wooden cultural heritage: a review of the main characteristics and applications of oak dendrochronology in Europe[END_REF][START_REF] Martinelli | Dendroarchaeology between teleconnection and regional patterns[END_REF]). In addition, the lack of large-scale archaeological excavations limits the available information. However, pile dwellings from the beginning of the EBA are not attested in the other Alpine countries, making the study of this site extremely important for the understanding of pile dwelling dynamics in relation to climatic and environmental changes.

The objective of our project is to analyze the woodland management practiced by the ancient population of the Lucone D settlement on a long prospective, by adding into the dendrotypological model the short tree-ring series which had previously been excluded due to the difficulties involved in dendrochronological synchronization. In the present investigation, in order to overcome the challenge of dating the short tree-ring series, we combine dendrochronology and high-resolution 14 C analysis and speculate on the preliminary woodland patterns, highlighted from the dating of young woods.

Dating short tree-ring series

With short tree-ring series it is possible to define series with fewer than 50 rings [START_REF] Lambert | L'état de la dendrochronologie en Europe Occidentale[END_REF][START_REF] Hillam | Sapwood estimates and the dating of short ring sequences[END_REF][START_REF] Billamboz | Dealing with heteroconnections and short tree-ring series at different levels of dating in the dendrochronology of the Southwest German pile-dwellings[END_REF][START_REF] Haneca | Oaks, tree-rings and wooden cultural heritage: a review of the main characteristics and applications of oak dendrochronology in Europe[END_REF]. The classic method of dendrochronology, based on statistic correlations, is suitable for long and sensitive tree-ring series.

At the opposite, in the analysis of short series the statistical parameters of comparison are generally low and statistically insignificant or, if occasionally high, may lead to erroneous dating. However, a large part of archaeological woods shows short tree-ring series [START_REF] Hillam | Dendrochronology and roman London[END_REF][START_REF] Billamboz | Tree rings and wetland occupation in southwest Germany between 2000 and 500 BC: dendroarchaeology beyond dating in tribute to F.H. Schweingruber[END_REF][START_REF] Billamboz | Dealing with heteroconnections and short tree-ring series at different levels of dating in the dendrochronology of the Southwest German pile-dwellings[END_REF][START_REF] Haneca | Dendrochronology in suboptimal conditions: tree rings from medieval oak from Flanders (Belgium) as dating tools and archives of past forest management[END_REF][START_REF] Haneca | Oaks, tree-rings and wooden cultural heritage: a review of the main characteristics and applications of oak dendrochronology in Europe[END_REF].

In pile-dwelling contexts, timber from young wood is not rare and its dating is extremely important for the reconstruction of short-term settlement development, testifying timings and characteristics of building activity that are tightly linked to changing strategies of timber supply and woodland management [START_REF] Billamboz | Dealing with heteroconnections and short tree-ring series at different levels of dating in the dendrochronology of the Southwest German pile-dwellings[END_REF].

One proposed solution for the dating of short series is the initial synchronization through visual matching. Based on raw measurements of ring widths, visual matching considers specific characters of growth and variations at high and medium frequency, most highlighted from the analysis of detrended series. Statistical tests can be finally used to correlate groups between themselves and to cross-date them against a site or master chronology [START_REF] Hillam | Dendrochronology and roman London[END_REF][START_REF] Hillam | Sapwood estimates and the dating of short ring sequences[END_REF][START_REF] Billamboz | Tree rings and wetland occupation in southwest Germany between 2000 and 500 BC: dendroarchaeology beyond dating in tribute to F.H. Schweingruber[END_REF][START_REF] Billamboz | Dealing with heteroconnections and short tree-ring series at different levels of dating in the dendrochronology of the Southwest German pile-dwellings[END_REF].

To guarantee the reliability and consistency of results, André Billamboz defined three levels of quality for dendro-dating [START_REF] Billamboz | Dealing with heteroconnections and short tree-ring series at different levels of dating in the dendrochronology of the Southwest German pile-dwellings[END_REF][START_REF] Billamboz | Applying dendro-typology to large timber series[END_REF]. Level A includes high-quality independent dendrochronological dating, with high statistical and visual correlations; level B indicates a lower quality of dating than level A, which is supported by external information, such as archaeological context, historical sources or 14 C dating; and level C refers to first tentative of dating which is open to discussion within the research team. It is this level that generally pertains to short tree-ring series of fewer than 40 years. In these cases, 14 C analysis can be used as support for dating.

14 C dating, however, is far from having the same precision of dendrochronology. Normal error associated to AMS-14 C ages are in the order of 2-3‰. The variability associated with measurements may then vary when calibrating the results, depending on the shape of the calibration curve, i.e. large slope and the presence of wiggles, which favors the precision of dating with respect to the flat parts of the curve [START_REF] Reimer | IntCal13 and Marine13 radiocarbon age calibration curves 0-50,000 years Cal BP[END_REF][START_REF] Reimer | The IntCal20 Northern Hemisphere radiocarbon age calibration curve (0-55 kcal BP)[END_REF]. Wiggle-matching dating generally provides higher precision in dating wood series than does single measurement dating, because it combines in one model information concerning annual growth rings (i.e. known relative age interval between sampled rings) with 14 C dating [START_REF] Bronk Ramsey | Wiggle matching" radiocarbon dates[END_REF] Consequently, wiggle-matching should be applied to wood species exhibiting distinguishable annual rings, which is the case for the predominantly oak timbers discovered in pile-dwelling settlements.

If it has been shown that wiggle-matching models can yield reliable results for the dating of long tree-ring series (i.e. min 100-yr long; Galimberti 2004), the same cannot be guaranteed for the calibration of short tree-ring series [START_REF] Bayliss | Informing conservation: towards 14C wiggle-matching of short tree-ring sequences from medieval buildings in England[END_REF][START_REF] Hogg | The first accurate and precise calendar dating of New Zealand Māori Pā, using Otāhau Pā as a case study[END_REF][START_REF] Hogg | The Influence of Calibration Curve Construction and Composition on the Accuracy and Precision of Radiocarbon Wiggle-Matching of Tree Rings, Illustrated by Southern Hemisphere Atmospheric Data Sets from AD 1500-1950[END_REF]. Indeed, two main problems arise: I) the possibility that the 14 C dating lands entirely on a long, flat section of the calibration curve, in which case the short length of the tree-ring series may lead to high dating uncertainty; and II) difficulties in the resolution of both the dated short-sequence sample and the calibration curve, where a different resolution reduces the probability of obtaining reliable results [START_REF] Jacobsson | Refining the Hallstatt Plateau: Short-Term 14C Variability and Small Scale Offsets in 50 Consecutive Single Tree-Rings from Southwest Scotland Dendro-Dated to 510-460 BC[END_REF][START_REF] Marshall | 14C wiggle-matching of short tree-ring sequences from post-medieval buildings in England[END_REF]. Indeed, if single-year tree-ring measurement should, in principle, be preferable for maximizing the short-term radiocarbon variability, and hence the precision of calibration results [START_REF] Wacker | Radiocarbon Dating to a Single Year by Means of Rapid Atmospheric 14C Changes[END_REF], comparison with the IntCal13 calibration curve based on a minimal resolution of 10 years from 1500 AD back in time [START_REF] Reimer | IntCal13 and Marine13 radiocarbon age calibration curves 0-50,000 years Cal BP[END_REF], reveals that the desired increase in precision fails and that the obtained fit is in fact more likely to show a systematic offset [START_REF] Jacobsson | Radiocarbon wiggle-match dating in the intertidal zone[END_REF][START_REF] Jacobsson | Refining the Hallstatt Plateau: Short-Term 14C Variability and Small Scale Offsets in 50 Consecutive Single Tree-Rings from Southwest Scotland Dendro-Dated to 510-460 BC[END_REF]. The current effort of the IntCal working group concerns the reconstruction of the calibration curve at annual resolution, and several studies have already contributed to this task [START_REF] Pearson | Annual radiocarbon record indicates 16th century BCE date for the Thera eruption[END_REF][START_REF] Capano | Wood 14C dating with AixMICADAS: methods and application to tree-ring sequences from the Younger Dryas event in the southern French Alps[END_REF][START_REF] Capano | Onset of the Younger Dryas recorded with 14C at annual resolution in French subfossil trees[END_REF][START_REF] Sava | Intervalidation of Dendrochronology and 14C Dating on a 700-yr Tree-Ring Sequence Originating from the Eastern Carpathians[END_REF][START_REF] Eastoe | Δ14C and δ13C in Annual Tree-Ring Samples from Sequoiadendron Giganteum, AD 998-1510: Solar Cycles and Climate[END_REF][START_REF] Reimer | The IntCal20 Northern Hemisphere radiocarbon age calibration curve (0-55 kcal BP)[END_REF].

In this study we try to overcome the challenge of dating short tree-ring series by coupling dendrotypology and high-resolution 14 C analysis. To remediate the problem of the low-resolution calibration curve and possible dating errors when comparing with high-resolution samples, we have dated at annual resolution subfossil trees included in a coniferous master curve and used the new calibration curve to date our annual-resolution samples of young woods from the Lucone D pile dwelling.

The site

The pile-dwelling settlement of Lucone D is located in the eastern part of the archaeological area of Lake Lucone (Brescia, Italy; 252 m a.s.l.), not far from Lake Garda (Figure 1). Piledwelling sites and other kinds of archaeological remains are scattered over five different sites (from Lucone A to Lucone E) in the basin around the small lake and along the slopes of the surrounding hills. The ancient small lake was reclaimed in the historical era and the archaeological site of Lucone D is today buried by peaty sediment. The site has been under excavation since 2007 and has produced a large number of archaeological artefacts (ceramic, stone, bone-antler, wood and fabric) together with botanical and zoological remains.

The settlement is dated to the first phases of the EBA. Dendrodates from samples with the waney edge indicate that frequent cutting operations for wood supply took place in nearby forests over a period of fewer than 70 years, from 2034 to 1967 ±10 cal BC, according to the previous dating result obtained using wiggle-matching [START_REF] Martinelli | Datazioni dendrocronologiche per l'età del Bronzo dell'area alpina. Randsborg K (edited by) Absolute Chronology[END_REF][START_REF] Martinelli | Dendro-typology in Italy: The case studies of the pile-dwelling villages Lucone D (Brescia) and Sabbione[END_REF]. Dendrochronology allows to ascertain that numerous felling episodes occurred very frequently, often in consecutive years, highlighting the possibility of timber storage and reuse [START_REF] Baioni | Le palafitte: definizione e caratteristiche di un fenomeno complesso attraverso alcuni casi di studio[END_REF]Baioni et al. in press).

Stratigraphic analysis clearly identifies two main occupation phases, which are separated by a fire event [START_REF] Baioni | Le palafitte: definizione e caratteristiche di un fenomeno complesso attraverso alcuni casi di studio[END_REF]. The dating of the fire event on the basis of tree-ring chronology

is not yet defined, because of the absence of horizontal timbers in primary deposition. Dendrotypological analysis identified 3 main phases of settlement construction. During the three phases timber supply comes from old-aged trees, both from dense stands and sparser ones, thus attesting the practices of clearing and thinning. Nevertheless, it is possible that this result may also have been affected by a paucity of data, i.e. the lack of samples from the non-investigated part of the village [START_REF] Martinelli | Dendro-typology in Italy: The case studies of the pile-dwelling villages Lucone D (Brescia) and Sabbione[END_REF]. Furthermore, young woods, which account for more than 50 posts, are not represented in the models either, due to the ongoing inability to cross-date them.

Materials and methods

Dendrochronology -dendrotypology

More than 1200 vertical and horizontal wooden elements have been identified at Lucone D (1060 in Sector 1), all of which have been carefully catalogued. Vertical posts belong to oak species (Quercus sp. Sectio ROBUR, with the exception of 1 post which belongs to Quercus sp.

Sectio CERRIS) sensu Cambini (1967a and1967b). Horizontal elements belong to different species (alder, ash, beech, hazelnut tree, maple, silver fir), with a high prevalence of oak [START_REF] Baioni | Le palafitte: definizione e caratteristiche di un fenomeno complesso attraverso alcuni casi di studio[END_REF]. Twenty samples were analyzed after the first sampling campaign in 1986. From the excavations carried out from 2005 to 2019, more than 400 samples have been subjected to dendrochronological analysis and more than 300 have been dated against the local oak site chronology. A first chronology built for Lucone D has become part of the original oak regional chronology GARDA1 (2171 -1837 ±10 cal BC), which was 14 C dated by wiggle-matching 9 decadal (or larger) groups of rings against the decadal calibration curve by Suiver and Becker (1993;[START_REF] Martinelli | Datazioni dendrocronologiche per l'età del Bronzo dell'area alpina. Randsborg K (edited by) Absolute Chronology[END_REF]. For woods from Lucone D, precise annual dates in relative chronology are available for 83 items bearing a waney edge. For the other 84 samples, in which the outermost sapwood was subject to erosion, a precision within 2-3 years is possible, while 112 dates have been determined through sapwood estimates, within a range of between 4 and 30 years.

The young-wood posts analyzed in this study, as well as the other posts and horizontal beams from the site, were sampled in the archaeological excavation by means of a hand saw. An approximately 10 cm thick section was taken for dendrochronological analysis. Wet wood samples were wrapped in plastic film and transported to the laboratory for processing in water-filled plastic bags to prevent drying and to thus limit deterioration.

At least 2 radii were selected and prepared with razor blades and ring width was measured using LINTAB measuring system with a precision of 0.01 mm. Data processing was done using Catras [START_REF] Aniol | Tree ring analysis using Catras[END_REF] and TSAPWin softwares (TSAP-WinTM 1996e 2003), following the dendrochronological standard procedures [START_REF] Baillie | Tree-ring dating and archaeology[END_REF]. Posts with short tree-ring series (i.e. <50 rings) were also involved in the creation of dendrogroups. Visual and statistical comparisons were used for this purpose. Dendrotypological parameters (e.g. cambial age, trunk diameter, sapwood thickness, growth trend and pointer years) were then analyzed in order to update the previously elaborated model of forest management reconstruction, which fail to take into account the short tree-ring series [START_REF] Martinelli | Dendro-typology in Italy: The case studies of the pile-dwelling villages Lucone D (Brescia) and Sabbione[END_REF].

In order to date the tree felling years, the series of young woods and their subchronology were matched against the local chronology created for the Lucone D settlement and the DG series elaborated for dendrotypology (Martinelli 2013, Martinelli unpublished).

14 C analysis

For the dating of a floating subchronology, two posts from Lucone D were selected for 14 C analysis: post no. 553, 33-years long, and post 641, 34-years long. Several rings were selected at annual resolution for 14 C measurements (rings n. 1, 4, 7, 11, 15, 19 and 23 from P. 553 and no. 1, 5, 9, 11, 13, 15, 17, 19, 21, 23, 26 from P. 641).

In northern Italy deciduous oak species guarantee the annual radial growth of trees on the whole stem circumference, without the occurrence of missing rings. Oak has distinct ring porous structure with large earlywood vessels, which are formed at the beginning of the growing season, before the complete foliation. For the cellulose formation of earlywood vessels, therefore, trees need to use photosynthates from previous years [START_REF] Pilcher | Biological considerations in the interpretation of stable isotope ratios in oak treerings[END_REF]. In ideal conditions, only the latewood from oak posts would be sampled, but the state of preservation of waterlogged wood is generally critical and the scalpel separation of rings not as clearly-defined as with dry wood. Moreover, we did not expect to get a sufficient yield after the chemical pretreatment. For all these reasons, we sampled the whole ring, including both earlywood and latewood.

Rings were separated using a scalpel under a binocular microscope and sliced into small pieces. They were oven-dried at 50 °C for 48 hours, after which at least 200 mg of dry wood for each sample was treated for cellulose extraction using the ABA-B method at CEREGE (Aix-en-Provence, France). This method consists in a classic ABA treatment, with solutions of HCl and NaOH at 4% concentration, followed by a bleaching step performed with 60 g of NaClO2 in 1 L of ultrapure water in acid solution (HCl) at pH 3 [START_REF] Capano | Wood 14C dating with AixMICADAS: methods and application to tree-ring sequences from the Younger Dryas event in the southern French Alps[END_REF].

Two coniferous subfossil woods from the Eastern Italian Alps were chosen for the new calibration curve measured at annual resolution (the new annual calibration curve is named Aix-BA): LDM_55A from a lake context (46.267N-10.816E; 1900 m a.s.l; Lago delle Malghette, Italy) and MGM_421 from a peat bog context (46.137N-10.694E; 1900 m a.s.l; Malga Germenega, Italy; Figure 1). Both trees belong to Picea abies Karst. species and are synchronized in a conifer chronology of 3219 years, absolutely dated to 4961-1743 BC against the Eastern Alpine Conifer Chronology (EACC) with high statistical values: GlK = 64%; TBP = 25.2; TH = 27.4 [START_REF] Nicolussi | A 9111 yearlong conifer tree-ring chronology for the European Alps: A base for environmental and climatic investigations[END_REF][START_REF] Nicolussi | A question of time: Extension of the Eastern Alpine Conifer Chronology backto 10 071 b2k[END_REF][START_REF] Bernabei | Observations on Holocene subfossil tree remains from high-elevation sites in the Italian Alps[END_REF]. Sampling was performed on a selection of rings from each tree: rings corresponding to years from -2065 to -1986 for LDM_55A and from -1983 to -1929 for MGM_421. Every third ring of the two sequences was measured for 14 C, which has been demonstrated to be sufficient for obtaining reliable results [START_REF] Capano | Onset of the Younger Dryas recorded with 14C at annual resolution in French subfossil trees[END_REF]. Moreover, the rings corresponding to years -2013, -2010, -2004 and -1998, which are already measured in LDM_55A, were repeated in MGM_421 for further confirmation of 14 C ages. The rings dated to -2032 and -2031 of LDM_55A were coupled in one sample for the small ring width (Figure 2).

In contrast to deciduous trees, evergreen conifers perform year-round photosynthetic activity [START_REF] Adams | Photoprotective Strategies of Overwintering Evergreens[END_REF], which means that earlywood cellulose is produced by carbon assimilated in the corresponding growth year. Indeed, for Norway Spruce woods, the whole ring was used for analysis. The described ABA-B pretreatment was performed for the cellulose extraction of samples.

After chemical pretreatment, the dried residues of archaeological and subfossil woods were weighed in tin capsules, combusted with the elemental analyzer, and the evolved CO2 was finally transformed into graphite with the AGE III system. The graphite target was then analyzed for its 14 C/ 12 C and 13 C/ 12 C ratios using the AixMICADAS system [START_REF] Bard | AixMICADAS, the accelerator mass spectrometer dedicated to 14C recently installed in Aix-en-Provence, France[END_REF]. Standards (OxA2 NIST SRM4990C) and blanks (VIRI-K, chemically treated like the other wood samples) were processed together with samples and used for normalization and blank correction, respectively. In addition, IAEA-C3 (cellulose) and IAEA-C8 (oxalic acid) standards were pretreated (IAEA-C3 also underwent the chemical pretreatment) and measured for 14 C in the same batches, serving as control standards.

High precision 14 C measurements were performed with long AMS runs to reach at least 800,000 ion counts for each OxA2 standard target on the same magazine. An additional uncertainty of 1.6 ‰ was propagated in the 14 C analytical errors and background correction following the convention described in [START_REF] Capano | Wood 14C dating with AixMICADAS: methods and application to tree-ring sequences from the Younger Dryas event in the southern French Alps[END_REF]. The successful participation of the Aix laboratory in a recent International Intercomparison on annual tree-ring dating guarantees, moreover, the precision and accuracy of 14 C results [START_REF] Reimer | The IntCal20 Northern Hemisphere radiocarbon age calibration curve (0-55 kcal BP)[END_REF]; indeed, data produced at the Aix laboratory will also be included in the upcoming IntCal20 calibration curve [START_REF] Capano | Onset of the Younger Dryas recorded with 14C at annual resolution in French subfossil trees[END_REF][START_REF] Reimer | The IntCal20 Northern Hemisphere radiocarbon age calibration curve (0-55 kcal BP)[END_REF]. The data are reported in terms of conventional 14 C age in years BP [START_REF] Stuiver | Discussion: reporting of 14C data[END_REF].

The 14 C ages of the archaeological materials were finally wiggle-matched with the IntCal13 and the new Aix-BA calibration curves. The OxCal v.4.3 wiggle-matching program was used for calibrations [START_REF] Ramsey | Radiocarbon calibration and analysis of stratigraphy: The OxCal program[END_REF][START_REF] Bronk Ramsey | Wiggle matching" radiocarbon dates[END_REF]. Moreover, the new Aix-BA curve was compared to IntCal13 to investigate possible differences of 14 C oscillations in time.

Results

Dendrochronological analysis of pile-dwelling posts

Among the 400 analyzed posts for this site (all Quercus sp. Sectio ROBUR), about 50 present less than 50 rings: woods do not exceed 35 years, with the exclusion of 1 post with 41 rings, sampled in 1986, that we have excluded from 14 C analysis due to suspected suboptimal wood preservation.

To increase the chances of finding dendromatches between the series, only the series with at least 20 rings have been analyzed in this study, i.e. 32 posts. Twenty-seven of these posts have bark/cambium. Visual comparison between series allowed the crossdating of 10 posts and the elaboration of a 44-year long subchronology (the subchronology of 10 posts is named M912Q; Table 1; Figure 3). The series in the subchronology M912Q show different felling dates on the relative chronological scale (Figure 3), thus indicating that the posts belong to different felling episodes over 12 years. All these posts come from young trees, aged between ca. 30 and 40 years, with relatively small dimensions. With the exception of the element P468 (estimated diameter about 30 cm), all the others are thought to have been from 12 to 23 cm in diameter. Despite their size, the trunks were split into from 2 to 8 longitudinal sections Due to its short length, the tree-ring subchronology (M912Q), 44-years long, revealed two possible different matches against the local chronology from Lucone D and the regional chronology GARDA1, thus preventing dating of the series on the relative scale of the settlement and the region. For this study, a newly formulated version of the first 309-year long part of the chronology, named GARDA1-I (Martinelli, in press) has been used. The site chronology of Lucone is part of the GARDA1-I chronology from ring 32 to 238; while the last year of the subchronology M912Q may correspond to years 126 or 252 of GARDA1-I, but no felling date is attested by the long-series elements from Lucone D, dated between the years 170 and 238 of GARDA1-I.

The choice of the correct position from the solely dendrochronological analysis is not possible, because of the good visual comparison of both the date and the similarity of the statistical values (Table 2). Moreover, cross-dating against the local chronology from Lucone D reveals an overlap of only 30 years. The shortness of the series prevents the choice of one or the other, leaving M912Q subchronology undated.

14 C measurement for calibration purposes

Two tree-ring series from spruce subfossil trees have been analyzed and their 14 C content measured in selected rings. The yield percentage after cellulose extraction was in the range of wellpreserved wood (between 30% and 40%; [START_REF] Capano | Wood 14C dating with AixMICADAS: methods and application to tree-ring sequences from the Younger Dryas event in the southern French Alps[END_REF]). The rings corresponding to 4 years (-2013, -2010, -2004 and -1998) were measured in both series for a further validation of the results; the 14 C values of duplicate rings for each year are strongly consistent at 1 σ range (Table 3), confirming the reproducibility of 14 C measurements. Indeed, the 14 C values of each couple were averaged and the series of the two posts were incorporated in a 136-year long sequence, dated to 4015-3879 cal BP (i.e. 2065-1929 BC). This sequence was compared with the IntCal13 calibration curve and with the raw data of the sequences that make it up (Figure 4; Reimer et al 2013). In the period that we measured at annual resolution, IntCal13 is composed of three records of 2-year range (11 measurements on woods from the German oak chronology, measured at Pretoria), 10year range (20 measurements on woods from the German oak chronology, measured at Heidelberg) and 20-year range (7 measurements on woods from the Irish oak and the German oak chronologies, measured at Belfast). We did not compare Aix-BA with the upcoming IntCal20, because the latter is not yet available. However, we do know that the period of our concern indicates no important changes in the upcoming calibration curve [START_REF] Reimer | The IntCal20 Northern Hemisphere radiocarbon age calibration curve (0-55 kcal BP)[END_REF]. A clear 14 C offset is present in annual measurements compared to the IntCal13 curve, with oscillations of new data mostly versus older ages and an average offset of 25±8 years (Table 4). However, 14 C values of Aix-BA fall within the 2 σ range of most of the raw 14 C data of IntCal13 (Figure 4). In Figure 5, the Aix-BA curve is constructed with the same Bayesian statistics as IntCal13 and compared with it [START_REF] Niu | The Bayesian approach to radiocarbon calibration curve estimation: The IntCal13, Marine13, and SHCal13 methodologies[END_REF]). The highest offset concerns the period 3966-3960 cal BP (Figure 6), into which fall two of the rings with replicated 14 C measurements: years 3960 and 3963 cal BP (i.e. -2013 and -2010), whose very good agreement confirms the accuracy of the measurements (Table 3). Moreover, a previous study analyzed the 14 C annual oscillation in trees of the BA for a younger period (i.e. 1700-1500 cal BC) and found a similar offset of annual measurement with respect to IntCal13 data [START_REF] Pearson | Annual radiocarbon record indicates 16th century BCE date for the Thera eruption[END_REF].

Indeed, the previously discovered offset in 14 C values for the BA period, in addition to the consistency of our repeated measurements for 4 rings and the successful participation of the Aix laboratory in a recent International Intercomparison on annual tree-ring dating [START_REF] Reimer | The IntCal20 Northern Hemisphere radiocarbon age calibration curve (0-55 kcal BP)[END_REF] have prompted us to exclude the possibility of laboratory bias concerning the found offset.

In order to test the accuracy of dating when using the IntCal13 calibration curve, we compared our Aix-BA curve as an unknown age sequence against IntCal13 using the OxCal wiggle-matching model (Bronk [START_REF] Bronk Ramsey | Wiggle matching" radiocarbon dates[END_REF]. As expected, because of the offset the calibration revealed reliable results, with a high percentage of agreement, only when applying a ΔR(-50,50) offset to IntCal13 (Table 4; Bronk Ramsey 2009).

14 C dating of the archaeological sequences

The low yield after cellulose extraction of the archaeological woods (between 1 and 4%) confirms the advanced state of degradation supposed for these materials and supports our decision to sample the whole ring instead of only the latewood for oak species. 5, Figure 7). For this reason, rings 19 and 23 of the subchronology M912Q, which presented the highest dispersion, were also measured in post 641. The results of the measurements for these two rings are in agreement (at 2σ range for ring 19 and 1σ range for ring 23; Figure 7; Table 5). Indeed, the values were averaged for each year and the sequences of posts 553 and 641 were combined for the calibration (LucD 14 C sequence, 34-years long). 14 C results for this sequence are positioned along a "plateau"; thus predicting difficulties in the high-precision calibration purpose (Figure 7).

The 14 C sequence of each post and the LucD 14 C sequence were calibrated to the new Aix-BA curve and, for further comparison, against the IntCal13, using the OxCal wiggle-matching program (Bronk [START_REF] Bronk Ramsey | Wiggle matching" radiocarbon dates[END_REF]. The results of the calibration of the sequences of posts 553 and 641 are the same as the LucD 14 C sequence both after comparison with Aix-BA and with IntCal13 (Table 6). When comparing the LucD 14 C sequence with Aix-BA, the last ring of the sequence is dated to 3936-3894 cal BP (-1986 to -1944) with 95.4% probability: indeed, the LucD 14 C sequence is dated to 3948-3915±21 cal BP (-1998/-1965±21; Figure 8; Table 6). The results of calibration against the IntCal13 curve with the same 95.4% probability indicate a dating to 3978-3927 cal BP (-2028 to -1977) for the last ring of the LucD 14 C sequence, enabling dating the sequence to 3986-3953±26 cal BP (-2036/-2003±26; Figure 9; Table 6). The age difference when using Aix-BA or IntCal13 is, indeed, ca. 40 years, with older ages obtained when using IntCal13.

Examination of the 68.2% probability results reveals that the age difference increases to ca. 50 years (Table 6). It should also be noted that the agreement of OxCal when calculated by Bayesian statistics is higher when matching the LucD 14 C sequence with the Aix-BA curve than with IntCal13 (Table 6). Accepting this last calibration as the best possibility, the M912Q subchronology can be dated to 3948-3905±21 cal BP (-1998/-1955±21), while the last ring of the M912Q subchronology (i.e. ring 44) dates to 3905±21 cal BP (-1955±21).

After examination of the results of the calibration of the LucD 14 C sequence and the discordances of the results when using the IntCal13 or Aix-BA curves, we decided to recalibrate the 14 C values of the GARDA1-I chronology as well, in the aim of avoiding all possible bias in the calibrated ages, which are now 33 years longer vs previous ages than was the previous 14 C-dated chronology [START_REF] Martinelli | Datazioni dendrocronologiche per l'età del Bronzo dell'area alpina. Randsborg K (edited by) Absolute Chronology[END_REF]. However, we limited the sequence to the first part of the chronology for the highly consistent dendro-matches (GARDA1-I; Martinelli, in press), and to the first 7 14 C dated tree-ring groups of GARDA1-I, thus excluding the last two groups of 50 and 80 rings from Lazise-La Quercia. We initially recalibrated: I) a portion (5 samples out of 7) of the previous 14 C measurements of GARDA1-I with Aix-BA, as the entire sequence is longer than the new Aix-BA curve; and II) the entire sequence of GARDA1-I with IntCal13, by substituting the new 14 C data of Aix-BA to IntCal13 values from 4015 to 3879 cal BP (Aix-BA+IntCal13; Table 7). Then, for comparison, we contrasted the GARDA1-I sequence with IntCal13 twice, with and without introducing a ΔR offset (N, 25±8), corresponding to the offset calculated by OxCal when comparing Aix-BA with the IntCal13 curve (Table 4). Examination of the results of calibration in the 2σ range indicate that all four options are in agreement, but the calibrations against IntCal13 (without offset) show slightly older ages and smaller uncertainties, which could potentially lead to erroneous absolute ages (Table 7). The highest agreement was obtained when GARDA1-I was compared against Aix-BA+IntCal13 (Figure 10), which enabled to date the last ring of the 14 C sequence (i.e. ring 208, as the middle point of rings 193-223) to 3954-3908 cal BP (i.e. 2004-1958 BC); the chronology GARDA1-I is thus dated to 4138-3831±23 cal BP (-2188/-1881±23).

The dendrochronological series of Lucone is part of the GARDA1 chronology.

Considering the results of the last ring of Lucone series only (i.e. ring 238 of GARDA1), it now dates to 3901±23 cal BP (-1951±23).

Discussion

High-resolution calibration curve and its implication for the dating of short tree-ring series

The offset discovered between annual 14 C values of the Aix-BA and IntCal13 curves (Figures 56) highlights the possibility of erroneous calibration of archaeological materials. We present two examples of calibration of archaeological wood series with both the IntCal13 and Aix-BA curves. Regarding the calibration of the LucD 14 C sequence, the comparison of high-resolution data against IntCal13 gives ages of ca. 40 years older than are obtained when using Aix-BA.

Moreover, the higher percentage of agreement found for calibration against Aix-BA confirms the importance of comparing datasets at the same resolution [START_REF] Jacobsson | Refining the Hallstatt Plateau: Short-Term 14C Variability and Small Scale Offsets in 50 Consecutive Single Tree-Rings from Southwest Scotland Dendro-Dated to 510-460 BC[END_REF][START_REF] Marshall | 14C wiggle-matching of short tree-ring sequences from post-medieval buildings in England[END_REF].

With regard to the recalibration of previous low-resolution, but long-time sequences, 14 C values for the GARDA1-I chronology (made up of samples comprising 10 to 30 rings, comparable to the resolution of IntCal13), we obtained the same results using the two curves, but with a smaller age range for the calibration against IntCal13, which limits dating to older ages than are obtained when calibrating with Aix-BA. In this last case, the lower error associated to calibration with IntCal13 increases dating precision, but may also lead to erroneous dating.

We also tried to calibrate the absolute new sequence Aix-BA against IntCal13 and obtained reliable results with very good agreement indices at 68.2% probability only when applying a ΔR offset (-50,50) to IntCal13. At 95.4% probability, the offset for obtaining true ages is not necessary, but the very low agreement results in uncertainty concerning the accuracy of the results (Table 4).

A previous study analyzed a tree-ring sequence of cedar wood dated to the BA and compared the low-resolution (i.e. mostly 10-ring samples) 14 C values of their sequences against the IntCal13 calibration curve [START_REF] Manning | Dating the Thera (Santorini) eruption: Archaeological and scientific evidence supporting a high chronology[END_REF]. Those authors found a mean offset of 17±6 years in the period -2200 to -1900, increasing notably at ca. -2103. They interpreted this offset as being due to the different growing seasons of trees originating from different climate regions, i.e. central Europe for trees of the IntCal calibration curve, and the south-eastern Mediterranean areas for their investigated samples. This variation was deemed to have been accentuated by the cold climate episode that occurred at ca. 4200 BP [START_REF] Manning | Dating the Thera (Santorini) eruption: Archaeological and scientific evidence supporting a high chronology[END_REF]. Other earlier studies had also explained 14 C offsets as the result of different growing seasons of trees [START_REF] Bronk Ramsey | Radiocarbon-based chronology for dynastic Egypt[END_REF][START_REF] Dee | Investigating the likelihood of a reservoir offset in the radiocarbon record for ancient Egypt[END_REF]. However, the 14 C offset revealed by [START_REF] Manning | Dating the Thera (Santorini) eruption: Archaeological and scientific evidence supporting a high chronology[END_REF] in tree-ring series is very similar to and occurs in the same years as the offset we found in the Aix-BA sequence, which is built using trees from the Italian Alps at roughly 2000 m altitude. The Italian Alps, as well as Central Europe including areas of provenance of IntCal13 subfossil trees, were characterized by a cold-humid phase during the 4200-BP event [START_REF] Frisia | Variazioni climatiche ed eventi sismici negli ultimi 4500 anni nel Trentino meridionale da una stalagmite della Cogola Grande di Giazzera[END_REF], which attests to a similarity in climate variability. If 14 C values from the Italian Alps and south-eastern Mediterranean areas show the same offset with respect to central Europe due to being characterized by the same climate variabilities as the Italian Alps, then the theory used to explain the offset , which posits the accentuation of different growing seasons during periods of cold climate, seems to be debateable, meaning that the 14 C offset of cedar wood compared to IntCal13 is very probably an analytical bias of previous low-resolution 14 C measurements. In fact, when dating a sample composed of many rings (e.g. 10 rings) the short-time fluctuations of 14 C are lost [START_REF] Miyake | A signature of cosmic-ray increase in AD 774-775 from tree rings in Japan[END_REF][START_REF] Miyake | Another rapid event in the carbon-14 content of tree rings[END_REF]. In the dating of short tree-ring series this loss can lead on one hand, to a lack of accuracy in the calibration of 14 C data [START_REF] Wacker | Radiocarbon Dating to a Single Year by Means of Rapid Atmospheric 14C Changes[END_REF], and on the other hand, to erroneous dating, as our LucD 14 C sequence demonstrated.

A calibration curve at high resolution (i.e. annual) is, indeed, extremely important for highprecision dating of short tree-ring series. The IntCal community is working to increase the precision of datasets. The forthcoming update of IntCal13 (IntCal20) will replace many parts of the 2013 version with new annual data derived from tree-rings. However, the majority of the curve will remain at the mostly decadal/bidecadal low resolution of the 2013 IntCal13 [START_REF] Reimer | The IntCal20 Northern Hemisphere radiocarbon age calibration curve (0-55 kcal BP)[END_REF]).

Woodland management in the light of dating of new short tree-ring series

Three main phases of construction have been identified at the Lucone D settlement. All are characterized by thinning activity in a dense forest, as is associated with clearing, and by the use of mature trees only [START_REF] Martinelli | Dendro-typology in Italy: The case studies of the pile-dwelling villages Lucone D (Brescia) and Sabbione[END_REF][START_REF] Martinelli | Dendrocronologia delle palafitte dell'Italia settentrionale: uno strumento per lo studio dell'evoluzione dell'intervento dell'uomo sul territorio nel corso dell'età del Bronzo[END_REF]. This supposed partiality for old trees has been associated with a presumed limited potential for forest regeneration [START_REF] Billamboz | Applying dendro-typology to large timber series[END_REF]) and led to the hypothesis of a strong sufferance of vegetation in the settlement surrounding. This depletion was thought to have resulted in the need to explore the depths of the forest with the consequent abandonment of the village [START_REF] Martinelli | Dendro-typology in Italy: The case studies of the pile-dwelling villages Lucone D (Brescia) and Sabbione[END_REF].

The analysis and dating of short tree-ring series change this model, by attesting the use of and, indeed, the choice of young trees.

The dendrotypological analysis of young woods highlighted the presence of two main groups in the forest stand: a majority of young trees of fast growth with small number of sapwood rings, indicating trees with low competition; and others of more reduced growth with high number of sapwood rings, indicating trees with higher competition (Figure 11). However, the small number of cross-dated posts (i.e. 10) enables the identification of several DGs from the M912Q subchronology and does not provide sufficient material to statistically distinguish a preference for coppice or young trees as opposed to mature canopy forest. Nor indeed, does it permit to identify the kind of woodland management practiced by ancient populations. Nevertheless, the analysis of new posts with short tree-ring series that will come to light in the ongoing archaeological excavation will help clarify this point.

However, several factors can be considered on the basis of the dating of these young woods.

We have already discussed the two possibilities of cross-dating the M912Q subchronology against the GARDA1 chronology at the relative ring positions 126 and 252 of GARDA1 (Table 2).

Examination of the 14 C dating of the M912Q subchronology (i.e. 3905±21 cal BP, or -1955±21) enables us to definitively exclude the position at ring 126, whose new 14 C dating (4013±23 cal BP, or -2063±23) does not match with the 14 C results of the M912Q subchronology. The only dating possibility of the M912Q subchronology is, indeed, at ring position 252 of the GARDA1 chronology (3887±23 cal BP, or -1937±23). This dating position is posterior to the previously analyzed felling dates of Lucone D posts, ending at ring position 238 of the GARDA1 chronology.

However, most of the felling episodes of the 44-yr long M912Q subchronology occur between rings 32 and 35, dated at ring positions 240-243 of the GARDA1 chronology, or just 2-5 years after the last felling episode already attested at the Lucone D site (Figure 12).

The dating of the young wood posts at the end of settlement occupation bears no correspondence with the cycle of woodland management of Neolithic and Bronze Age pile dwellings at north of the Alps [START_REF] Billamboz | Regional patterns of settlement and woodland developments: Dendroarchaeology in the Neolithic pile-dwellings on Lake Constance (Germany)[END_REF]. Indeed, at sites in Southern Germany, it has been seen that the construction of new villages is related to the clearing of dense forests, as is reflected in the presence of slow-growth tree-ring series from trees of different ages. The development phases of the village are characterized by expanding building activity with the extensive use of coppice practices, as is seen through the presence of short and fast-growth tree-ring series. Finally, the last phase of the village is characterized by the reduction of building activity and the practice of thinning with the use of old trees only [START_REF] Billamboz | Regional patterns of settlement and woodland developments: Dendroarchaeology in the Neolithic pile-dwellings on Lake Constance (Germany)[END_REF]).

The EBA is unfortunately not attested north of the Alps, but in the village of Bande di Cavriana (Mantova, Northern Italy), coeval to Lucone D, the last phase of occupation is characterized by the additional use of young woods, in opposition to the 2 earlier phases during which the use of young woods was almost exclusively coupled to the use of old woods (Martinelli 2017[START_REF] Martinelli | Dendrocronologia delle palafitte dell'Italia settentrionale: uno strumento per lo studio dell'evoluzione dell'intervento dell'uomo sul territorio nel corso dell'età del Bronzo[END_REF]. However, the young woods of Bande di Cavriana are large in circumference (ca. 40 cm) and 60-80 rings, thus excluding a possible analogy with the Lucone D settlement where the tree circumference of young woods is equal to or less than 30 cm, and where the tree-ring series do not exceed 41 rings. Strong forest exploitation is attested in other villages beginning only in the 18 th century BC (e.g. the pile dwelling of Frassino, near Verona; Martinelli 2013), with increasing human impact in the following centuries (e.g. the pile dwelling of Sabbione, near Varese, dated to the end of 17 th -beginning of 16 th century; Martinelli 2013). In these last two examples, the last phase of the settlement is characterized by the use of other less prestigious species of wood than Quercus sp. Sectio ROBUR, such as Quercus sp. Sectio CERRIS at the Frassino site [START_REF] Martinelli | Dendrocronologia delle palafitte dell'Italia settentrionale: uno strumento per lo studio dell'evoluzione dell'intervento dell'uomo sul territorio nel corso dell'età del Bronzo[END_REF]) and Fagus sp., Betula sp. and Corylus sp. at the Sabbione site [START_REF] Martinelli | Dendro-typology in Italy: The case studies of the pile-dwelling villages Lucone D (Brescia) and Sabbione[END_REF]. This has been interpreted as evidence of the final exploitation of the surrounding forest before the abandonment of the site. This is not the case at Lucone D, where the analyzed posts all belong to deciduous oak species. The young woods from the Lucone D settlement seem, indeed, to be in no way analogous to other villages. It should be noted, however, that posts such as the ones analyzed in this study, with short tree-ring series but unearthed from other pile dwellings remain undated. It seems essential therefore to precisely date all short tree-ring series from all pile-dwelling sites in order to enable more realistic comparisons.

Considering the small number of posts with short tree-ring series discovered until now at Lucone D and the small dimension of these posts (trees with a diameter ≤30 cm were split into 2to-8 longitudinal sectors before being used), two hypotheses can be advanced:

1. The presence of a short fourth phase of building construction before the abandonment of the site, characterized by the use of available trees in the surrounding forest. These trees would not have been selected according to desired characteristics (e.g. age of the tree, diameter of the trunk or typology of the forest), but rather, would have been chosen on the basis of the low availability of suitable trees remaining in a collapsed forest, in which regeneration was highly limited by the previous strong thinning activity. This strong diminution of vegetation in the forests surrounding the settlement may have contributed to the abandonment of the village.

2. A second hypothesis suggests that young trees may have been selected only for renovation of already existing structures, in which case, the presence of small posts does not necessarily imply forest collapse. It does appear, however, that the investigated area of the settlement was abandoned shortly after this renovation phase involving young woods; indeed, this change in forest management strategy seems to have anticipated the abandonment of the village.

The pursuit of archaeological excavations and newly discovered wooden elements provide insights into the use of young wood in the context of forest management. The dating of young woods from other EBA villages in Northern Italy will also permit the creation of comparative models to improve understanding of how young woods were used, thus providing significant assistance in the planimetric reconstruction of pile-dwelling structures.

Conclusions

The posts from the Lucone D pile dwelling showing short tree-ring series have been analyzed in this study. Dendrochronological analysis provided information concerning age (not exceeding 40 years), presence of bark, trunk diameter and portion of sapwood, whose width and ring thickness point to the presence of both coppice and isolated stems.

Randomly-sampled annual rings from two posts included in a subchronology of 10 series A combination of dendrochronological and 14 C analyses has permitted to find the correct dating position of young woods on the regional chronology GARDA1-I, which has, in turn, been recalibrated on the new calibration curve.

The felling episodes of the young woods are dated 2-14 years later than the previously identified final construction phase of the Lucone D settlement, highlighting the possibility of either a fourth construction phase, or the use of small posts for the renovation of the already existing structures of the village. The analysis of new young woods emerging from the ongoing archaeological excavations will give insights to better describe woodland management. However, the dating of young woods illustrates their utilization just prior to the abandonment of the and with IntCal13, with and without a ΔR offset (N25,8). We report the part of the recalibrated chronology, the ages cal BP with probabilities at 68.2%, 95.4% and 99.7% and the index of agreement given by OxCal (Acomb).

  14 C results for posts 553 and 641 confirm their dendrochronological synchronization, despite post 553 showing more dispersed values, in particular ring 19, whose cellulose yield after chemical pretreatment was only 0.6 mg (approximately 250 μg of C; Table

  were14 C measured with high precision and then wiggle-match dated against a new calibration curve (Aix-BA, spanning 136 years from -2065 to -1929), obtained from the annual measurement of absolutely-dated subfossil trees. From the comparison of the new calibration curve with IntCal13, an offset of ca. 25 years emerged, highlighting possible bias in the IntCal13 curve in the analyzed period, probably due to the low-resolution, decadal and bidecadal samples of IntCal13.The dating of short tree-ring series, in fact, shows 40-year difference depending on the calibration curve used, where with Aix-BA the ages are younger than with IntCal13.

Figure 1 .

 1 Figure 1. A) Map of Northern Italy with the location of I) the Lucone D pile dwelling archaeological site (yellow star) and II) the sites of the absolutely-dated subfossil trees that have been used herein for the realization of a new calibration curve (red and blue points). B) Map of the archaeological excavation of Lucone D site: wooden elements in brown.

Figure 2 .

 2 Figure 2. Dendrochronological matching of tree-ring sequences of subfossil trees (LDM_55A and MGM_421) used for the realization of the new 14 C calibration curve.

Figure 3 .

 3 Figure 3. Dendrochronological matching of short tree-ring series from the Lucone D pile dwelling.A subchronology of 44 rings (called M912Q) is derived from the matching of short series.

Figure 4 .

 4 Figure 4. Comparison between the IntCal13 curve, its raw data and the new Aix-BA series. Errors are at 1σ range. A clear 14 C offset is present in annual measurements of the Aix-BA compared to the IntCal13 curve, with oscillations of new data mostly versus older ages. 14 C values of Aix-BA fall within the 2 σ range of most of the raw 14 C data of IntCal13.

Figure 5 .

 5 Figure 5. Comparison between the IntCal13 (blue) and the Aix-BA (green) series, modelled with the same statistics as IntCal13 (Niu et al. 2013). Both curves are represented at 1σ range.

Figure 6 .

 6 Figure 6. Offset between the Aix-BA and IntCal13 curves. The black line indicates mid-point values of the linear interpolation of IntCal13; blue points represent the deviation of 14 C values of the Aix-BA curve from IntCal13; the error bars of the blue points were calculated taking into consideration both the measured errors of Aix-BA values and the errors of the interpolated annual IntCal13 curve. An average offset of 25±8 years has been calculated (Table 4). The highest offset concerns the period 3966-3960 cal BP, into which fall two of the rings with replicated 14 C measurement: years 3960 and 3963 cal BP (i.e. -2013 and -2010): their very good agreement confirms the accuracy of the measurements.

Figure 7 .

 7 Figure 7. 14 C results of random rings sampled from posts 553 and 641 from the Lucone D pile dwelling confirm their dendrochronological synchronization, despite post 553 showing more dispersed values. For this reason, rings 19 and 23 of the M912Q subchronology, which presented the highest dispersion, were also measured in post 641. The results of the two measurements for ring are in agreement (at 2σ range for ring 19 and 1σ range for ring 23; indeed, the values were averaged for each year and the series of posts 553 and 641 were combined for the calibration (LucD 14 C sequence, 34-years long). 14 C results of this series are positioned along a "plateau"; thus suggesting difficulties in the high-precision calibration purpose. Errors are at 1σ range.

Figure 8 .

 8 Figure 8. Results of the wiggle-matching dating of the LucD series against the Aix-BA curve.Errors are at 1σ range. When comparing the LucD 14 C sequence with Aix-BA, the last ring of the series is dated to 3936-3894 cal BP(-1986 to -1944) at 95.4% probability, which dates the LucD 14 C series to 3948-3915±21 cal BP(-1998/-1965±21).

Figure 9 .

 9 Figure 9. Results of the wiggle-matching dating of the LucD series against the IntCal13 curve. Errors are at 1σ range. The results of calibration against IntCal13 curve date, at 95.4% probability, the series to 3978-3927 cal BP (-2028 to -1977) for the last ring of the LucD 14 C sequence, enabling to date the series to 3986-3953±26 cal BP (-2036/-2003±26).

Figure 10 .

 10 Figure 10. Calibration of the GARDA1-I chronology against A) the Aix-BA calibration curve, completed in the missing portion by IntCal13 (Aix-BA+IntCal13) and B) against the IntCal13 calibration curve. The highest agreement is obtained when comparing GARDA1-I against Aix-BA+IntCal13, which enables to date the last ring of the 14 C series (i.e. ring 208, as the middle point of rings 193-223) to 3954-3908 cal BP (i.e. 2004-1958 BC), whereas when using IntCal13 it is dated to 3961-3940 cal BP (i.e. 2011-1990 BC).

Figure 11 .

 11 Figure 11. Two groups highlighted by preliminary dendrotypological analysis: A) high growthrate series with small number of sapwood rings, indicating young trees with low competition; B)

Figure 12 .

 12 Figure 12. Schematic summary of the methodological and interpretative steps of the research. In blue 14 C sequences and in green dendrochronological series. With the exception of step 1 and 2, with their own relative scale, all the other steps are on the same chronological scale. It should be noted that GARDA1-I chronology and the related Lucone and M912Q chronologies are dated by 14 C wiggle-matching with an uncertainty of ±23 years (2σ).

Table 1 .

 1 settlement.by N.M. and M.C. Sampling, dendrochronological analysis and absolute dating of subfossil trees from Trentino by M.Be. Revisions by all authors. Characteristics of the short tree-ring series averaged in the M912Q subchronology: code of Dendrodata Laboratory (VR, Italy); mean ring width (MRW); pith and bark presence.

	Tables
	Posts	Code lab	N. rings	MRW Pith Bark/cambium
	16	0003076Q	31	165	Yes Yes
	28	0003483Q	32	189	Yes Yes
	169	BS03012Q 35	164	Yes Yes
	553	BS04822Q 33	295	Yes -
	18	0003068Q	41	160	Yes Yes
	669	BS04837Q 29	250	Yes Yes
	468	BS04803Q 29	345	Yes -
	99	BS03119Q 30	279	Yes Yes
	641	BS04890Q 26	315	Yes Yes
	613	BS04885Q 24	260	Yes Yes
	OVL Glk	GSL TV	TVBP TVH	CDI Position
	44	73	**	5.3	3.4	4.0	27	126
	44	67	*	7.5	3.5	4.4	26	252
	Table 2. Statistical values from the dendrochronological cross-dating of the M912Q
	subchronology against the GARDA1-I chronology.

Table 3 .

 3 Results of 14 C dating of selected years from two absolutely dated subfossil trees(Bernabei

	751
	752	et al 2018) and their 1σ errors.
	753
	754
			68.2%	95.4%	99.7%	Acomb	real age BP offset
		no offset	3894-3880	3901-3875	3908-3871 11.4	3879	-
		ΔR(-50,50)	3887-3872	3890-3860	3896-3854 172.8	3879	25±8

Table 4 .

 4 Comparison of the Aix-BA series with IntCal13 using the OxCal wiggle-matching model

	758
	759
	760
	Code Lab	Post	Ring	Position in M912Q subchronology	14 C	err
	11391.1.1	553	1	1	3661	19
	11392.1.1	553	4	4	3684	19
	11393.1.1	553	7	7	3630	20
	11394.1.1	553	11	11	3658	19
	11395.1.1	553	15	15	3634	20
	11396.1.1	553	19	19	3718	23
	11397.1.1	553	23	23	3619	21
	11399.1.1	641	1	9	3660	20
	11400.1.1	641	5	13	3657	20
	11401.1.1	641	9	17	3662	21
	11577.1.1	641	11	19	3648	19
	11402.1.1	641	13	21	3653	19
	11578.1.1	641	15	23	3634	20
	11403.1.1	641	17	25	3648	20
	11407.1.1	641	19	27	3652	19
	11404.1.1	641	21	29	3640	19
	11405.1.1	641	23	31	3655	19
	11406.1.1	641	26	34	3644	19

755

(Bronk

[START_REF] Bronk Ramsey | Wiggle matching" radiocarbon dates[END_REF]

: ages are reported for probabilities at 68.2%, 95.4% and 99.7%. A 756 reliable dating is obtained at 68.2%, with high percentages of agreement (Acomb), when applying 757 an offset to IntCal13.

Table 5 .

 5 LucD 14 C series, composed of rings from post 553 and 641. Errors of 14 C values are at 1σ.

	Series IntCal13				Aix-BA
	68.2%	95.4%	99.7%	Acomb	68.2%	95.4%	99.7%	Acomb
	P.553 3975-3955 4054-3920 4060-3908 30.6	3935-3902 3950-3893 3965-3890 46.7
	P.641 3974-3929 3978-3920 3980-3910 170.4	3925-3905 3945-3895 3956-3891 156.7
	LucD 3972-3956 3978-3927 3980-3915 72.3	3925-3905 3936-3894 3950-3890 116.8

Table 6 .

 6 Comparison of 14 C results of posts 553 and 641 and of LucD 14 C series against IntCal13 and Aix-BA calibration curves. The ages cal BP are reported with probabilities at 68.2%, 95.4% and 99.7%, with the index of agreement given by OxCal (Acomb).

	Calibration curve	Samples of GARDA1-I	Cal BP (68.2%)	Cal BP (95.4%)	Cal BP (99.7%)	Acomb
	Aix-BA	Rings 158-208	3952-3926	3959-3895	3993-3886 77.2
	Aix-BA+IntCal13	Rings 48-208	3949-3912	3954-3908	3959-3889 86.6
	IntCal13	Rings 48-208	3957-3947	3961-3940	3965-3931 62.5
	IntCal13_DeltaR(N 25,8)	Rings 48-208	3954-3914	3959-3906	3961-3878 45

Table 7 .

 7 Part

of the ancient 14 C values of ring groups from the GARDA1-I chronology was calibrated with the new calibration curve Aix-BA, with a combination of Aix-BA and IntCal13

Acknowledgements

AixMICADAS and its operation are funded by the Collège de France, the EQUIPEX ASTER-CEREGE and the ANR project CARBOTRYDH (PI E.B.). We wish to thank the anonymous reviewers, especially the second one, for his detailed and helpful suggestions.

Dendrochronological and dendrotypological analysis on samples from Lucone D were funded by the Italian Ministry of Cultural Heritage (Fondi Legge 20 febbraio 2006 n. 77 "Misure speciali di tutela e fruizione dei siti e degli elementi italiani di interesse culturale, paesaggistico e ambientale, inseriti nella "lista del patrimonio mondiale", posti sotto la tutela dell' UNESCO" and Regione Lombardia (years 2009, 2011, 2013, 2017 and 2019).

Author contributions


Olivier Flauzac

Fabien Mauhourat

Florent Nolot
email: florent.nolot@univ-reims.fr

A review of native container security for running applications

Keywords: Containers, LXC, LXD, Singularity, Docker, Kata-containers, gVisor

Containers offer an efficient solution allowing the application's isolation. Most of the papers dealing with the container's isolation focus on benchmarking container's solutions. However, in this study, we focus on a static comparison of different features proposed by container solutions. First, we will focus on the container's runtimes, then, we present the different solutions used in the study. The most common container solutions are compared, such as LXC, LXD, Singularity, Docker, Kata-containers, and gVisor. We consider container features as isolation, storage, network, and security capabilities. For each container feature, all container solutions will be compared to find the most efficient one. Finally, this paper compares the different default container configurations and attempts to find the most efficient container solution based on all compared features.

Introduction

Virtual machines (VMs) provide efficient security. However, as mentioned in [START_REF] Joy | Performance comparison between Linux containers and virtual machines[END_REF][START_REF] Martin | System Performance Evaluation of Para Virtualization, Container Virtualization, and Full Virtualization Using Xen, OpenVZ, and XenServer[END_REF][START_REF] Zhang | A Comparative Study of Containers and Virtual Machines in Big Data Environment[END_REF] their isolation security creates a bottleneck for the total number of VMs that can run on a server because each VM should have its copy of the operating system (OS), libraries, dedicated resources, and applications. As authors claim in [START_REF] Joy | Performance comparison between Linux containers and virtual machines[END_REF][START_REF] Martin | System Performance Evaluation of Para Virtualization, Container Virtualization, and Full Virtualization Using Xen, OpenVZ, and XenServer[END_REF][START_REF] Watada | Emerging Trends, Techniques and Open Issues of Containerization: A Review[END_REF][START_REF] Kovács | Comparison of different Linux containers[END_REF] containerbased virtualization is an alternative to conventional virtualization because it potentially reduces resource overhead and thus improves the use of data-centers. In containerization, an individual instance runs on top of a shared OS kernel. However, there are plenty of solutions [START_REF] Watada | Emerging Trends, Techniques and Open Issues of Containerization: A Review[END_REF][START_REF] Kovács | Comparison of different Linux containers[END_REF][START_REF] Xavier | Performance Evaluation of Container-Based Virtualization for High Performance Computing Environments[END_REF] that can be used to create containers, and select a solution for an application is not an easy task. This study aims to compare the different characteristics of the main container solutions to find the best solution for executing an application in terms of security, i.e. ensuring perfect isolation of the system resources used such as storage, network, processor, or memory. Although there are different uses of containers and in different application contexts, in this study, we do not distinguish between them. Similarly, we do not focus on container environments. Thus, neither the host security mechanisms nor the security of the applications running within the container are studied. In this paper, we will compare container solutions in their default configuration in terms of process and memory isolation, storage, network, and security features and presented also all mechanisms which can be improved. For each solution, we tested if the feature is present, if it's enabled by default and if it's working by applying some basic configuration. Most of the features are tested individually disabling all the other ones like for the security, storage, and network features to measure the impact of their activation.

State of the art

Many papers focus on benchmarking different container solutions but few of them are focusing only on a particular feature comparison of containers. In [START_REF] Joy | Performance comparison between Linux containers and virtual machines[END_REF][START_REF] Martin | System Performance Evaluation of Para Virtualization, Container Virtualization, and Full Virtualization Using Xen, OpenVZ, and XenServer[END_REF][START_REF] Zhang | A Comparative Study of Containers and Virtual Machines in Big Data Environment[END_REF][START_REF] Watada | Emerging Trends, Techniques and Open Issues of Containerization: A Review[END_REF][START_REF] Kovács | Comparison of different Linux containers[END_REF][START_REF] Xavier | Performance Evaluation of Container-Based Virtualization for High Performance Computing Environments[END_REF][START_REF] Sultan | Container Security: Issues Challenges and the Road Ahead[END_REF][START_REF] Xie | The Performance Comparison of Native and Containers for the Cloud[END_REF], the main container's solutions such as Docker, LXC, OpenVZ, Singularity are compared with hypervisors like KVM and Xen in terms of performance. Those works mainly measure the CPU and memory load, networking bandwidth, and disk I/O. Results point to the overhead of hypervisorbased virtual machines and also the lack of security of the container solutions. The OpenVZ and Linux-Vserver solutions have been gradually dropped [START_REF] Martin | System Performance Evaluation of Para Virtualization, Container Virtualization, and Full Virtualization Using Xen, OpenVZ, and XenServer[END_REF][START_REF] Watada | Emerging Trends, Techniques and Open Issues of Containerization: A Review[END_REF], and replaced by solutions such as Docker and LXC because they do not require a specific kernel to work. In [START_REF] Xavier | Performance Evaluation of Container-Based Virtualization for High Performance Computing Environments[END_REF] the authors focus on an important comparison aspect: the boot-up speed. Booting up a container is much faster than booting up a virtual machine because the system does not have to boot a different kernel to start an instance. In [START_REF] Joy | Performance comparison between Linux containers and virtual machines[END_REF] another axis of comparison is used: the virtual machine environments as well as the performance of application inside the virtual machine. They found that the performance for an application, in this case, the Joomla content management system (https://www.joomla.org/), was around 4 times higher in a docker container than in a virtual machine. This study also exhibits that the container's scaling and processing time for a large number of requests is very much less than the scaling time of a new virtual machine to handle the request. A recent study on container security [START_REF] Martin | System Performance Evaluation of Para Virtualization, Container Virtualization, and Full Virtualization Using Xen, OpenVZ, and XenServer[END_REF] revealed that one of the primary drag to container's widespread deployment is the security issue. They expose four types of threats in container security to show how current solutions can be used to enhance container security: (i) protecting a container from applications inside it, (ii) inter-container protection, (iii) protecting the host from containers, and (iv) protecting containers from a malicious or semi-honest host. All these papers contribute to different aspects of benchmarking and comparing these solutions. However, none of these studies compares as many container solutions as this paper does and they don't allow us to choose a container solution for certain use cases that require features compare to theses solutions. Especially LXD, gVisor [START_REF] Young | The True Cost of Containing: A gVisor Case Study[END_REF], and Kata-containers [START_REF] Randazzo | Kata Containers: An Emerging Architecture for Enabling MEC Services in Fast and Secure Way[END_REF] solutions have been rarely studied. Furthermore, most of them only compare solutions focusing on benchmarking rather than features between solutions. Instead, this study focuses on the static analysis and comparison of the different features.

Container Solutions

We focus on the 6 following main container solutions: LXC, LXD, Singularity, Docker (runc), Kata-containers (kata-runtime), and gVisor (runsc). We first propose an overview of the definition, format of container runtimes, Then we briefly describe each container solution.

LXC and LXD

LXC [START_REF] Ma | The Virtualization and Performance Comparison with LXC-LXD in ARM64bit Server[END_REF] is a userspace interface for the Linux kernel containment features. Through a powerful API and simple tools, it lets Linux users easily create and manage systems or application containers. LXD [START_REF] Ma | The Virtualization and Performance Comparison with LXC-LXD in ARM64bit Server[END_REF] is building on top of LXC to provide an alternative to LXC's tools and distribution template. Its image-based with pre-made images available for a wide number of Linux distributions and is built around a very powerful, yet pretty simple, REST API.

Singularity

Singularity [START_REF] Alles | Assessing the Computation and Communication Overhead of Linux Containers for HPC Applications[END_REF] is a container platform. Singularity was created to run complex applications on HPC clusters in a simple, portable, and reproducible way. This container is a single file, and there is not much worry about how to install all the software you need on each different operating system and system. Moreover, a user, without any administrator rights, can run applications thanks to Singularity.

Container runtimes

OCI is an acronym for the Open Containers Initiative (https://www.opencontainers.org/) which is an independent organization designing standards for containers and containerization. The OCI created two specifications to enhance the interoperability between solutions: image specification and runtime specification. The image specification defines the format of the image considering filesystem layers and metadata. The runtime specification defines the configuration, execution environment and the methods to manage the container lifecycle, for example starting, stoping or killing a container. The configuration and environment format of a container are known as the filesystem bundle. The OCI Compliant Filesystem Bundle contains all the information needed to load and run a container. This includes the following artifacts residing ( locally in a single directory): Config.json file, and Container's root filesystem. The config.json file contains the configuration data of the container and must reside in the root of the bundle directory under this name. The container's root filesystem is a referenced directory in the config.json file. The OCI Runtime specification allows a modular architecture of the containers considering two components: the High-level and the Low-level container runtime. The High-level container runtime is used to manage the container images, the network during the container creation process and also create the filesystem bundle from the image and pass it to the Low-level container runtime. Image management includes the possibility to pull or to push an image from a remote to a local repository, just as well as we build an image locally from a definition file. The Low-level container runtime implements the OCI runtime specification and allows to create a container from the "filesystem bundle". This means that a High-level container runtime can use any Low-level container runtime that implements the OCI runtime specification. The list of Low-level containers OCI compliant runtimes is: runc, gVisor, kata-containers. Runc is the default Low-level runtime for Docker. gVisor is a Low-level runtime used to create sandbox and kata-runtime is a Low-level runtime designed to create containers inside virtual machines. Docker can use any of these 3 low levels container runtimes. Docker (runc). Docker [START_REF] Watada | Emerging Trends, Techniques and Open Issues of Containerization: A Review[END_REF][START_REF] Kovács | Comparison of different Linux containers[END_REF] is an open-source containerization technology for building and containerizing applications. The in-host daemon communicates with the Docker client to execute commands to build, ship, and run containers.

Kata-containers (kata-runtime). Kata-containers [START_REF] Randazzo | Kata Containers: An Emerging Architecture for Enabling MEC Services in Fast and Secure Way[END_REF] is an open project supports by the OpenStack Foundation (OSF) working to build a standard implementation of lightweight Virtual Machines (VMs) that feel and perform like containers, but provide the workload isolation and security advantages of VMs. The Kata-containers runtime (kataruntime) is compatible with the OCI runtime specification. In other words, docker can select without changing any configuration between the default Docker container runtime (runc) and kata-runtime.

gVisor (runsc). gVisor [START_REF] Young | The True Cost of Containing: A gVisor Case Study[END_REF] is a user-space kernel, written in Go, that implements a substantial portion of the Linux system call interface. gVisor intercepts the application system calls and acts as the guest kernel. As gVisor has not implemented all the Linux syscalls, applications that use unimplemented syscalls can't run in gVisor. The gVisor runtime (runsc) is compatible with the OCI runtime specification.

Isolation Features

The main isolation feature that forms the basis of a container is the namespace concept. Namespace [START_REF] Sultan | Container Security: Issues Challenges and the Road Ahead[END_REF][START_REF] Hertz | Abusing Privileged and Unprivileged Linux Containers[END_REF][START_REF] Grattafiori | Understanding and Hardening Linux Containers[END_REF][START_REF] Pothula | Run Time Container Security Hardening Using A Proposed Model Of Security Control Map[END_REF] is a security feature of the Linux kernel in version 2.4.19 allowing resource isolation to a group of processes. This allows a group of processes to use their isolated instance of system resources. Theses resources are invisible from another namespace. Each process has a /proc/[pid]/ns/subdirectory containing one entry for each namespace. The kernel provides six namespaces to isolate different resources: Mount, IPC, Network, PID, User, and UTS. The Mount namespace provides isolation of the list of mount points seen by the processes inside the namespace. The IPC namespace provides isolation of IPC resources like System V IPC objects and POSIX message queue. The Network namespace provides isolation of the networking resources like network devices, IP routing tables. The PID namespace provides an isolated tree of process IDs (PIDs). The User namespace provides isolation for the security identifiers (user ids and group ids) and attributes like capabilities. The UTS namespace provides isolation of two system identifiers: the hostname and the NIS domain name. All the container's solutions use namespace features to isolate resources. To create a new namespace, except for the user namespace, it requires the capability(http://man7.org/linux/man-pages/man7/capabilities.7.html) CAP SYS ADMIN. In other words, it requires to be root to create a container. This means that the uid 0 user inside the container is mapped to the root user (uid 0) inside the host. There is a huge security risk because if an attacker escapes from the container, as presented in [START_REF] Hertz | Abusing Privileged and Unprivileged Linux Containers[END_REF][START_REF] Grattafiori | Understanding and Hardening Linux Containers[END_REF], he will be root on the host. To reduce the risk of escaping the container, the user namespace feature of the kernel allows creating unprivileged container which means that the user, inside the container, is mapped to an unprivileged user on the host. The main security issue in a namespace is that all containers use a shared kernel. If there is a vulnerability in the Linux kernel then all containers will be impacted. For each namespace, we tested whether it is used by verifying that the identifier in the /proc/PID/ns directory of the namespace inside the container is different from the host. If this identifier is different, we conclude that the namespace is used by the solution. Two other isolation features increase the isolation of containers and namespaces: Hypervisor and Kernel isolation. Hypervisor isolation [START_REF] Joy | Performance comparison between Linux containers and virtual machines[END_REF][START_REF] Martin | System Performance Evaluation of Para Virtualization, Container Virtualization, and Full Virtualization Using Xen, OpenVZ, and XenServer[END_REF] allows to run containers inside virtual machine. Kernel isolation [START_REF] Watada | Emerging Trends, Techniques and Open Issues of Containerization: A Review[END_REF][START_REF] Young | The True Cost of Containing: A gVisor Case Study[END_REF] allows running containers with their isolated kernel. Table 1 summarizes the isolation features handled by the solutions.

To avoid any misconceptions, the following parameters are defined as to their use in the table for this study:

• Default: The feature is enabled by default,

• Optional: The feature can be optionally configured. This can be considered as a week default configuration, • Optional manual: The feature can be optionally configured but not as part as the solutions, this requires to use external solution to support the feature, • Not Possible: The feature cannot be configured in any way, no documentation exists, the feature is still under development, or the feature is not planned to be implemented. LXC/LXD is the solution that provides the third highest isolation. Those solutions provide a strong default configuration of namespace using the user namespace which allows creating unprivileged containers. However, LXC requires a lightweight configuration to be able to run unprivileged containers. Singularity is the solution that provides the lowest isolation of different resources. This solution only supports the namespace feature and only isolates the mount point of the host. This is not a given weakness because by default Singularity uses an unprivileged user to create unprivileged containers. Since Singularity runtime dynamically writes UID and GID information to the appropriate files within the container at runtime, the user remains the same inside and outside the container. Moreover, by default, the container is mounted in read-only and the only directory that is writable (bind mount) is the home directory of the user that created the container. Docker (runc) in a bit less secure than LCD/LXD because the user namespace is not enabled by default. Accordingly, docker only creates privileged containers by default. Kata-containers is the solution that provides the most isolation with the use of hypervisor isolation. This allows container isolation inside a virtual machine. Based on hypervisor isolation, Kata-containers also isolate the kernel from the host. The container is created inside the virtual machine the same way as on the host with the use of the same namespace as docker and runc. gVisor offers a valuable alternative to kata-containers considering isolation, offering kernel isolation from the host. This allows containers to have their isolated kernel. The gVisor container has to be created as root, such as docker does, but this is not a weakness because the gVisor kernel runs as an unprivileged user on the host. Considering isolation features, Kata-containers may be the most efficient choice.

Network Features

Network management for containers is a key point. There are three main solutions to link a container to the network: System Bridge, Open vSwitch and Physical. A System Bridge behaves like a virtual network switch where real devices (e.g. eth0) and virtual devices (e.g. tap0) can be connected to it. Open vSwitch (https://www.openvswitch.org/) is a software implementation of a virtual multilayer network switch, designed to enable effective network automation through programmatic extensions, while supporting standard management interfaces and protocols. The Physical network feature allows to dedicate a physical interface to the container. Within the context of container security, it is interesting to be able to limit the bandwidth of the containers to avoid a denial of service [START_REF] Sultan | Container Security: Issues Challenges and the Road Ahead[END_REF][START_REF] Hertz | Abusing Privileged and Unprivileged Linux Containers[END_REF][START_REF] Grattafiori | Understanding and Hardening Linux Containers[END_REF] of network of the host and other containers. Table 2 summarizes the network features handled by the solutions.

Optional manual

By default, all solutions allow you to link a container to a Linux bridge but with the exception of the LXC and Docker solutions, connecting a container to an Open vSwitch bridge has to be done manually. Bandwidth limitation is by default only possible on Singularity. For the other solutions the implementation is manual either through the QoS on an Open vSwitch bridge either through traffic control and the use of Cgroups https://www.kernel.org/doc/Documentation/cgroup-v1/ for identify the flow from the containers. Dedicated a physical interface to a container is by default only possible with LXC and LXD. In terms of network features, LXD may be the most efficient choice.

Storage Features

Storage options

Container storage management is an important element that can significantly affect the performances [START_REF] Watada | Emerging Trends, Techniques and Open Issues of Containerization: A Review[END_REF][START_REF] Martin | System Performance Evaluation of Para Virtualization, Container Virtualization, and Full Virtualization Using Xen, OpenVZ, and XenServer[END_REF] depending on the formats used. First of all, it is necessary to dedicate a partition or a disk for the storage of the containers to isolate it from the rest of the system and thus avoid the risk of denial of service. The establishment of quotas for each container is an essential element to isolate the storage and thus avoid the saturation of disk space by a few containers. Many storage backends can be used to store containers data: Directory, SIF, BTRFS, LVM, ZFS, and OverlayFS. The Directory backend used a simple directory to store the root of containers. The Singularity Image Format (SIF) (https://sylabs.io/guides/3.5/user-guide/security.html#singularity-imageformat-sif) allows creating immutable, complete and encapsulated container environments stored in a single file. BTRFS (https://btrfs.wiki.kernel.org/index.php/Main Page) is a copy on write (CoW) filesystem for Linux aimed at implementing advanced features like subvolumes, quotas, compression, deduplication, snapshot. Logical Volume Management (LVM) (https://wiki.gentoo.org/wiki/LVM) utilizes the Linux kernel's device-mapper feature to provide a system of partitions independent of the underlying disk layout. This allows a complete abstraction of the storage with "virtual partitions" that are extending/shrinking easier. ZFS (https://zfsonlinux.org/) is a combined filesystem and logical volume manager that includes extended features like BTRFS. The Overlay filesystem (OverlayFS) (https://www.kernel.org/doc/Documentation/filesystems/overlayfs.txt) allows one, usually read-write, directory tree to be overlaid onto another, read-only directory tree. All modifications go to the upper, writable layer. 3 summarizes the storage features handled by the solutions. LXC, Docker, Kata-containers, and gVisor are compatible with a large number of storage formats compared to singularity. LXC/LXD does not support the overlay storage format with the management of images and containers in layers to optimize storage. This implies an overuse of storage due to duplication of the same data for each container. By default, singularity uses the SIF image format which allows the files in the container to be used in a single read-only file. Write management can be done either by the sandbox mode which implies the creation of a directory for each container or by the tmpfs mode which implies the non-saving of changes when stopping the Container. Docker, Kata-containers, and gVisor propose by default the use of the overlay format which allows for high storage efficiency through the copy on write, which shares unmodified data between all the containers of the same image. A warning concerning kata container, because the use of storage formats other than LVM, implies the use of the 9p (http://9p.cat-v.org/documentation/) protocol by the virtio-9pfs (https://wiki.qemu.org/Documentation/9psetup) filesystem passthrough which allows the sharing of the container directory from the host to the virtual machine. The performance of the 9p protocol is very limited and the use of a block-type storage format such as LVM makes it possible to partly solve this problem. Indeed, the logical volume will be able to be mounted as a classic disk using the virtio-scsi drivers or virtio-blk. The LVM storage format is however deprecated since version 18.09.0 of docker and will have to be removed in future versions. The solution gVisor also uses the 9pfs filesystem regardless of the storage format used. In terms of storage features, LXC, LXD, and docker may be the most efficient choice.

Storage Quotas

The establishment of quotas for each container depends on the storage format used. By default, the quota management is native only on the BTRFS and ZFS filesystems. Indeed, the classic EXT4 (https://www.kernel.org/doc/Documentation/filesystems/ext4/ext4.rst) and XFS (https://www.kernel.org/doc/Documentation/filesystems/xfs.txt) filesystems only allow quotas to be set up on the user level and not per container. For LVM, quotas are made using thin-provisioning type volumes. These volumes do not need to pre-allocate storage for each container, which allows for better storage management during the use of logical volumes. Table 4 summarizes the storage quotas features handled by the solutions. The LXC solution implements the implementation of quotas only with the Lvm format. This feature can only be used by the root user. The setting of BTRFS and ZFS quotas is done manually. The Singularity solution allows the creation of quotas only using fixed size overlay images. The solutions Docker, Kata-containers and gVisor implement quotas with all compatible formats, i.e. OverlayFS, BTRFS, ZFS and LVM. In terms of storage quotas, LXD may be the most efficient choice.

Security Features

As mentioned in [START_REF] Sultan | Container Security: Issues Challenges and the Road Ahead[END_REF][START_REF] Hertz | Abusing Privileged and Unprivileged Linux Containers[END_REF][START_REF] Grattafiori | Understanding and Hardening Linux Containers[END_REF] many other Linux kernel features are involved in the security of a container: Control Groups, Capabilities, Seccomp, and Apparmor. Control Groups (Cgroups) isolate and limit hardware resource to a process or collection of processes. Capabilities is a kernel feature that divides the privileges traditionally associated with superuser into distinct units, known as capabilities, which can be independently enabled and disabled. Seccomp (https://www.kernel.org/doc/html/v4.16/userspace-api/seccomp filter.html) provides a method to reduce the number of system calls available for application to interface with the kernel. Apparmor (https://gitlab.com/apparmor/apparmor/-/wikis/home) provides a way to confine programs to a limited set of resources. This utility is mainly used to restrict access and mount options to filesystems paths. For each solution, we tested if the feature is present and if it's working by applying some CPU/RAM limitation with Cgroups, dropping the CAP SYS ADMIN capability, apply an Apparmor profile that denies the mount syscall and also apply a Seccomp profile that denies the same syscall as Apparmor and then verify the application of the feature by trying to make a mount point inside the container. Each feature is tested individually disabling all the other ones. All these security features are complementary and should be used together if the solution allows it. 5 summarizes the security features handled by the solutions. LXC/LXD and docker are compatibles with the fourth security features. They enable the same features by default that are capabilities dropping, AppArmor and seccomp. The only differences are the way theses solutions use these security features. Docker provides the most secure policy with all these features than LXC/LXD. Singularity also supports all four security features, but does not use any by default. So these solutions provide less restriction than the three solutions studied before. Kata-containers only uses capabilities dropping and supports cgroups but because it uses hypervisor isolation, the uses of additional security features are not necessary. Also, Cgroups are not necessary because we use the limitation of the resources of the virtual machine. gVisor doesn't support Cgroups, so there is no way to limit the usage of gVisor containers resource. gVisor provides strong security policies with capabilities dropping and seccomp. The uses of AppArmor is not necessary because each container uses its own kernel, so restrict /proc or /sys is not a priority. In terms of security features, Kata-containers may be the most efficient choice.

Conclusion

We have studied in this paper the isolation features offered by the 6 following virtualization solutions: LXC, LXD, Singularity, Runc, Kata-container, and gVisor. We show Kata-containers could be the best solution to isolate an application execution. LXD may be a good alternative to Kata-containers for its network and storage features, without losing the advantage of isolation and security offered. In this study, we only focus on a comparison of each feature that can be used by default for each solution. In future work, we have to compare the performances of each solution.

Table 1 .

 1 The use of isolation features by the solutions

	Isolation features / Solutions	LXC/LXD	Singularity	Runc	Kata-containers	gVisor
	IPC Namespace	Default	Optional	Default	Default	Default
	Network Namespace	Default	Optional	Default	Default	Default
	Mount Namespace	Default	Default	Default	Default	Default
	PID Namespace	Default	Optional	Default	Default	Default
	User Namespace	Default (un-privileged)	Optional	Optional	Optional	Optional
	UTS	(hostname)	Default	Optional	Default	Default	Default
	Namespace
	Hypervisor Isolation	Not possible	Not possible	Not possible	Default	Not possible
	Kernel Isolation	Not possible	Not possible	Not possible	Default	Default

Table 2 .

 2 The use of network features by the solutions

	Network features /	LXC	LXD	Singular-ity	Runc	Kata-containers	gVisor
	Solutions
	Bridge	Default	Default	Default	Default	Default	Default
	Open vSwitch	Default	Default	Optional manual	Optional manual	Optional manual	Optional manual
	Physical	Default	Default	Not possible	Not possible	Not possible	Not possible
	Bandwidth limit	Optional manual	Default	Default	Optional manual	Optional manual

Table 3 .

 3 The use of storage backend by the solutions

	Storage backend / So-lutions	LXC	LXD	Singular-ity	Runc	Kata-containers	gVisor
	Directory		Default	Default	Default	Not possible	Not possible	Not possible
	Singularity Format (SIF)	Image	Not possible	Not possible	Default	Not possible	Not possible	Not possible
	BTRFS		Default	Default	Not possible	Default	Default	Default
	LVM		Default	Default	Not possible	Default	Default	Default
	ZFS		Default	Default	Not possible	Default	Default	Default
	OverlayFS		Not possible	Not possible	Default	Default	Default	Default
	Table

Table 4 .

 4 The use of storage quotas by the solutions

	Storage quotas / Solu-tions	LXC	LXD	Singular-ity	Runc	Kata-containers	gVisor
	Directory		Not possible	Default	Not possible	-	-	-
	Singularity	Image	-	-	Default	-	-	-
	Format (SIF)
	BTRFS		Optional manual	Default	-	Default	Default	Default
	LVM		Default	Default	-	Default	Default	Default
	ZFS		Optional manual	Default	-	Default	Default	Default
	OverlayFS		-	-	Default	Optional	Optional	Optional

Table 5 .

 5 The use of security features by the solutions

	Security features / Solutions LXC/LXD Singularity	Runc	Kata-containers	gVisor
	Cgroups	Optional	Optional	Optional	Optional	Not possible
	Capabilities Dropping	Default	Optional	Default	Default	Default
	Mac AppArmor	Default	Optional	Default	Not possible	Not possible
	Seccomp Filters	Default	Optional	Default	Not possible	Default
	Table

Acknowledgements

This work is supported by a public grant overseen by the French National Research Agency (ANR) as part of the "Investissements d'avenir" program (reference: ANR-16-DUNE-0001-EOLE).