Isolation without Containers
summary
Claims a lightweight isolation layer that avoids processes or containers by compiling WebAssembly to native AOT code and running thousands of sandboxes per server with millisecond request lifetimes and tens of thousands of RPS. Uses a modified calling convention (RDI holds a VM context), linear memory plus a 4GB guard region to remove most checks, trap tables to map faults, and bounds-check elision in a Cranelift-based compiler/runtime (Fastly project); implementation is working but still under active development.
AI-written summary · about
chapters (13)
- 0:00Start
- 1:37Resource Isolation
- 1:53Fault Detection, Isolation, and Recovery
- 3:43Fault Domain
- 6:10Virtual Memory
- 8:31Containers are similar.
- 8:47In-process isolation?
- 13:13Calling Convention
- 14:52Bounds Checking
- 16:41Bounds Check Elision
- 21:08Trap Tables
- 22:18ok, enough assembly...
- 24:15Thank You
related talks
32mIsolation without Containers
20mIsolation without Containers
47mSecure Sandboxing in a Post-Spectre World
22mIsolation without Taxation: Near-Zero-Cost Transitions for WebAssembly and SFI
31mA Love Letter to Isolation
34mContainer Runtimes... on Lockdown: The Hidden Costs of Multi-tenant Workloads
36mSandboxing Your Sandbox: Leveraging Hypervisors for WebAssembly Security
54mLucet: A Compiler and Runtime for High-Concurrency Low-Latency Sandboxing