CloudABI
summary
CloudABI defines a concrete runtime and syscall ABI that confines processes by explicit capabilities instead of global namespaces it passes capability-based file-descriptor rights to a process so a web server only gets an HTTP socket a readonly document-directory and an append-only log it supplies a small C library called cloudlibc lightweight C library and a launcher that reads service dependencies as structured YAML so cloudabi-run configuration via YAML binds sockets opens files and supplies deterministic FDs the FreeBSD kernel module is upstreamed and ports for Linux NetBSD and x86_64 are in progress
AI-written summary · about
chapters (19)
- 0:00Start
- 4:42What is wrong with UNIX?
- 6:02UNIX security problem #1
- 10:24Reusability and testability
- 11:07Reuse and testing in Java 13
- 15:12Reusable and testable web server
- 16:14Overview
- 17:30Default rights
- 19:00Additional rights: file descriptors
- 21:36Secure web service
- 22:24Defence in depth #1
- 25:09Testability of CloudAll processes
- 25:53Cross-platform support
- 26:59Supported platforms
- 33:18Isn't there a better way?
- 36:24Web server configuration in YAML
- 41:04Advantages of using cloudabi-run
- 43:09Secure hardware appliances
- 47:21High-level cluster management
related talks
13mTowards unified confidential computing ABIs
52mIntra-Process Memory Protection for Applications on ARM and X86: Leveraging the ELF ABI
32mDon't Get Owned by Your Dependencies
42mDefending the Branch: PAC, BTI & GCS on Linux
21mArmoring Cloud Native Workloads With LSM Superpowers
29mOverview and Recent Developments: AppArmor
07mLightning Talk: Armoring Cloud Native Workloads with BPF LSM
15mCore slicing: closing the gap between leaky confidential VMs and bare-metal cloud