Isolation without Containers
summary
Fastly describes a compiler+sandbox that compiles WebAssembly to native code (Katana / Frittata) to run many thousands of sandboxes concurrently inside one process. Isolation rests on two concrete guarantees: control-flow checks (no raw function pointers, indirect-call tables) and bounds-checked linear memory so data accesses are confined. The implementation trades some optimization complexity for safety but is already used to host high‑performance edge tenants, demonstrating practical, low‑overhead SFI without containers.
AI-written summary · about
chapters (14)
- 0:00Intro
- 0:45Isolation?
- 2:08Isolation is about being able to run some code without it affecting other running code in unexpected ways.
- 2:32Resource Isolation
- 2:48Fault Detection, Isolation, and Recovery
- 3:56Control and Data Flow
- 5:19Fault Isolation is really about reducing the set of possible faults to a knowable, recoverable set.
- 6:09What even is a process?
- 7:26Virtual Memory
- 11:34Dynamic Libraries
- 14:39Higher-level Isolation
- 17:41Control Flow
- 19:30Isolation: Good
- 19:56WebAssembly: Super great!
related talks
29mIsolation without Containers
32mIsolation without Containers
47mSecure Sandboxing in a Post-Spectre World
22mIsolation without Taxation: Near-Zero-Cost Transitions for WebAssembly and SFI
24mWebAssembly as an Intermediate Language for Provably-Safe Software Sandboxing
19mSandbox to confidential containers: A brief on the evolution of container isolation
14mYour Containers Aren’t Alone: Demystifying Container Isolation
31mYour Containers Aren’t Alone: Demystifying Container Isolation