Isolation without Containers

on YouTube ↗32m

" summary

Claims that WebAssembly plus an ahead‑of‑time compiler and runtime can isolate thousands of sandboxes in a single process and hit production scale: seven million requests per second overall, tens of thousands per server, request latencies under five milliseconds. Uses WebAssembly linear memory, a VM context pointer, trap tables and a modified calling convention; applies cranelift for AOT codegen, bounds-check elision and large guard page mappings to avoid runtime slowdowns. A compiler/runtime that emits ELF shared objects is in development but not yet fully open source.

AI-written summary · about

" chapters (17)

1. 0:00Isolation without Containers
2. 0:43Multi-tenancy
3. 1:05Isolation?
4. 1:52Resource Isolation
5. 2:13Fault Detection, Isolation, and Recovery
6. 4:23Fault Domain
7. 6:01Processes
8. 7:07Virtual Memory
9. 9:45Dynamic Libraries
10. 12:50Higher-level Isolation
11. 14:56Control Flow
12. 15:26Memory Safety
13. 18:41Calling Convention
14. 20:28Trap Tables
15. 22:39Bounds Checking
16. 24:38Bounds Check Elision
17. 30:37Review

" related talks

• 29mIsolation without ContainersTyler McMullen · LISA18
• 20mIsolation without ContainersTyler McMullen · SREcon18 Asia/Australia
• 36mSandboxing Your Sandbox: Leveraging Hypervisors for WebAssembly SecurityDanilo (Dan) Chiarlone · WasmCon 2023
• 48mDon't Trust Anything! Real-world Uses For WebAssemblyKatie Bell · YOW! Perth 2023
• 53mWebAssemblyBrian Sletten · Developer Summit 2020
• 24mWebAssembly as an Intermediate Language for Provably-Safe Software SandboxingJay Bosamiya · PriSC 2020
• 29mThe Return of Write Once, Run AnywhereTyler McMullen · Wasm I/O 2023
• 26mSyscall Me by Your Name: Sandboxing Wasm ProgramsRyan Petrich · Cloud Native Wasm Day NA 2023